Archive
12 May 2023
Vulnerabilities first published on this day (UTC), newest first.
28 results · Clear filters · Feed
-
High 8.8
Time Tracker has Blind SQL Injection Vulnerability in Reports
Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `reports.php` page was not validating all parameters in POST requ…
-
High 8.8
aiven-extras PostgreSQL Privilege Escalation Through Overloaded Search Path
aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missing schema qualifiers …
-
High 8.8
Use after free in ChromeOS Camera in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker who co…
-
High 8.8
Out of bounds write in ChromeOS Audio Server in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote atta…
-
High 7.1
Improper access control in the Intel(R) Solid State Drive Toolbox(TM) before version 3.4.5 may allow a privileged user …
-
High 7.1
Improper access control in the Intel(R) Server Board S2600WTT belonging to the Intel(R) Server Board S2600WT Family wit…
-
High 7.2
Heap-based overflow in Intel(R) SoC Watch based software before version 2021.1 may allow a privileged user to potential…
-
High 8.8CVE-2023-32073 Public exploit
AVideo command injection vulnerability
WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-…
-
High 7.5
Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 10…
-
High 8.1
Apache OpenMeetings: allows bypass authentication
An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0
-
High 7.2
Apache OpenMeetings: allows null-byte Injection
An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0
-
High 8.8
Loadbalancer.org Enterprise VA MAX through 8.3.8 has an OS Command Injection vulnerability that allows a remote authent…
-
High 8.1
The web-services interface of Loadbalancer.org Enterprise VA MAX through 8.3.8 could allow an authenticated, remote, lo…
-
High 8.8
eXtplorer 2.1.15 is vulnerable to Insecure Permissions. File upload in file manager allows uploading zip file containin…
-
High 7.5
kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue.
-
High 7.5
QuickJS commit 2788d71 was discovered to contain a stack-overflow via the component js_proxy_isArray at quickjs.c.
-
High 8.8
Improper Access Control in openemr/openemr
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
-
High 7.5
Storage of Sensitive Data in a Mechanism without Access Control in francoisjacquet/rosariosis
Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.
-
High 8.8
CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.
-
High 7.8
A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds write vulnerabilit…
-
High 7.8
A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which coul…
-
High 7.8
A maliciously crafted DLL file can be forced to read beyond allocated boundaries in Autodesk InfraWorks 2023, and 2021 …
-
High 7.8
A malicious actor may convince a user to open a malicious USD file that may trigger a use-after-free vulnerability whic…
-
High 7.8
A DLL Hijacking issue discovered in Soft-o Free Password Manager 1.1.20 allows attackers to create arbitrary DLLs leadi…
-
High 7.8
A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds read vulnerability…
-
High 8.8
VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly pri…
-
High 7.2
VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can e…
-
High 7.5CVE-2022-47879 Public exploit
A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load …