Archive
May 2023
Vulnerabilities first published in this month (UTC), newest first.
113 results · Clear filters · Feed
-
Low 3.1
Key duplication in GSDK
Compiler removal of buffer clearing in sli_crypto_transparent_aead_encrypt_tag in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
-
Low 3.1
Key duplication in GSDK
Compiler removal of buffer clearing in sli_cryptoacc_transparent_key_agreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
-
Low 2.3
TOTOLINK N200RE Telnet Service custom.conf password in configuration file
A vulnerability classified as problematic has been found in TOTOLINK N200RE 9.3.5u.6255_B20211224. Affected is an unknown function of the file /squashfs-root/etc_ro/custom.conf of the component Telnet Service. The manipulation leads to password in configurati…
-
Low 3.5
GNU cflow parser.c parse_variable_declaration denial of service
A vulnerability was found in GNU cflow 1.7. It has been rated as problematic. This issue affects the function func_body/parse_variable_declaration of the file parser.c. The manipulation leads to denial of service. The exploit has been disclosed to the public …
-
Low 3.8
Sensitive information disclosure due to insecure registry permissions. The following products are affected: Acronis Age…
-
Low 3.3
Brother iPrint&Scan V6.11.2 and earlier contains an improper access control vulnerability. This vulnerability may be ex…
-
Low 3.3
Dgraph Audit Log Encryption nonce reuse
Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come fro…
-
Low 3.5
Sucms cross site scripting
A vulnerability was found in Sucms 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin_ads.php?action=add. The manipulation of the argument intro leads to cross site scripting. The attack may be launch…
-
Low 3.1
Multiple Page Generator Plugin <= 3.3.17 - Cross-Site Request Forgery to SQL Injection
The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to missing nonce verification on the projects_li…
-
Low 3.3
Mishandling of guest SSBD selection on AMD hardware The current logic to set SSBD on AMD Family 17h and Hygon Family 18…
-
Low 3.5
SourceCodester Guest Management System GET Parameter dateTest.php cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester Guest Management System 1.0. Affected by this issue is some unknown functionality of the file dateTest.php of the component GET Parameter Handler. The manipulation of the a…
-
Low 3.7
Jenkins SAML Single Sign On(SSO) Plugin unconditionally disables SSL/TLS certificate validation
Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercep…
-
Low 3.3
In mnld, there is a possible leak of GPS location due to a missing permission check. This could lead to local informati…
-
Low 3.5
SourceCodester ICT Laboratory Management System GET Parameter room_info.php cross site scripting
A vulnerability has been found in SourceCodester ICT Laboratory Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file views/room_info.php of the component GET Parameter Handler. The manipul…
-
Low 3.5
SourceCodester Personnel Property Equipment System POST Parameter add_item.php cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Personnel Property Equipment System 1.0. Affected is an unknown function of the file admin/add_item.php of the component POST Parameter Handler. The manipulation of the argument…
-
Low 3.5
SourceCodester File Tracker Manager System POST Parameter save_user.php cross site scripting
A vulnerability has been found in SourceCodester File Tracker Manager System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /file_manager/admin/save_user.php of the component POST Parameter Handler. The manipulation of …
-
Low 3.5
SourceCodester Lost and Found Information System Contact Form cross site scripting
A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file classes/Master.php?f=save_inquiry of the component Contact Form. The manipulation of th…
-
Low 3.5
SourceCodester Lost and Found Information System cross site scripting
A vulnerability has been found in SourceCodester Lost and Found Information System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/. The manipulation of the argument page leads to cross site scri…
-
Low 2.9
Stack overflow in Xpdf 4.04 due to object loop in PDF embedded file tree
In Xpdf 4.04 (and earlier), a PDF object loop in the embedded file tree leads to infinite recursion and a stack overflow.
-
Low 2.9
Stack overflow in Xpdf 4.04 due to object loop in PDF page label tree
In Xpdf 4.04 (and earlier), a PDF object loop in the page label tree leads to infinite recursion and a stack overflow.
-
Low 2.9
Divide-by-zero in Xpdf 4.04 due to bad color space object
In Xpdf 4.04 (and earlier), a bad color space object in the input PDF file can cause a divide-by-zero.
-
Low 3.1
etcd key name can be accessed via LeaseTimeToLive API
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read p…
-
Low 3.5
SourceCodester Online Computer and Laptop Store products.php cross site scripting
A vulnerability classified as problematic was found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this vulnerability is an unknown functionality of the file products.php. The manipulation of the argument search leads to cross site script…
-
Low 2.2
Arbitrary Files can be installed in the Setting Data Import function of Office / Small Office Multifunction Printers an…
-
Low 3.1
Improper Authentication of RemoteUI of Office / Small Office Multifunction Printers and Laser Printers(*) which may all…
-
Low 2.0
Insertion of sensitive information into log file in the Open CAS software for Linux maintained by Intel before version …
-
Low 3.3
Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user t…
-
Low 3.3
Improper buffer restriction in software for the Intel QAT Driver for Linux before version 1.7.l.4.12 may allow an authe…
-
Low 1.8
Incomplete cleanup in the Intel(R) IPP Cryptography software before version 2021.6 may allow a privileged user to poten…
-
Low 3.4
Improper input validation in BIOS Firmware for some Intel(R) NUC Kits before version PY0081 may allow a privileged user…
-
Low 2.8
Out-of-bounds read for some Intel(R) Trace Analyzer and Collector software before version 2021.8.0 published Dec 2022 m…
-
Low 2.8
Null pointer dereference for some Intel(R) Trace Analyzer and Collector software before version 2021.8.0 published Dec …
-
Low 3.9
Out-of-bounds write for some Intel(R) Trace Analyzer and Collector software before version 2021.8.0 published Dec 2022 …
-
Low 3.4
WordPress Export All URLs Plugin <= 4.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Atlas Gondal Export All URLs plugin <= 4.1 versions.
-
Low 3.1
Cleartext storage of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may a…
-
Low 2.5
Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a speci…
-
Low 1.9
Buffer Overflow Vulnerability in Western Digital My Cloud Home and ibi devices
A buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenticated remote code execution in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices. An attacker would require exploitation of an…
-
Low 3.9
Insufficient input validation in the SMU may allow an attacker to corrupt SMU SRAM potentially leading to a loss of int…
-
Low 3.3
Microsoft Access Denial of Service Vulnerability
Microsoft Access Denial of Service Vulnerability
-
Low 3.7
PostgresNIO processes unencrypted bytes from man-in-the-middle
PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of …