Archive
May 2023
Vulnerabilities first published in this month (UTC), newest first.
1,208 results · Clear filters · Feed
-
Medium 5.3
Authentication bypass vulnerability in NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series) all versions allows a re…
-
Medium 6.5
n8n Directory Traversal vulnerability
The n8n package 0.218.0 for Node.js allows Directory Traversal.
-
Medium 5.0
Improper Neutralization of Formula Elements in a CSV File in pimcore/customer-data-framework
Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.
-
Medium 6.8
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
-
Medium 6.8
Cross-site Scripting (XSS) - DOM in pimcore/pimcore
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
-
Medium 5.7
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
-
Medium 6.8
Cross-site Scripting (XSS) - Generic in pimcore/pimcore
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
-
Medium 4.8
Improper following of a certificate's chain of trust exists in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, an…
-
Medium 4.8
Cleartext transmission of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier. If the…
-
Medium 5.4
BUG-000155004 HTML injection issue in Portal for ArcGIS.
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser (no stateful change made…
-
Medium 6.5
Use of weak credentials exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unaut…
-
Medium 5.3
Use of weak credentials exists in Seiko Solutions SkyBridge and SkySpider series, which may allow a remote unauthentica…
-
Medium 4.3CVE-2023-22361 EPSS 36%
Improper privilege management vulnerability in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier allows a remote au…
-
Medium 5.5
In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Ser…
-
Medium 6.1
BUG-000154236 There is a reflected cross-site scripting (XSS) vulnerability in Portal for ArcGIS.
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browse…
-
Medium 5.9
Time-of-check Time-of-use (TOCTOU) in the BIOS2PSP command may allow an attacker with a malicious BIOS to create a race…
-
Medium 6.1
Improper syscall input validation in AMD TEE (Trusted Execution Environment) may allow an attacker with physical access…
-
Medium 5.5
A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure …
-
Medium 5.5
Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause…
-
Medium 6.8
Improper input validation in ABL may enable an attacker with physical access, to perform arbitrary memory overwrites, p…
-
Medium 5.3
Microsoft Remote Desktop app for Windows Information Disclosure Vulnerability
Microsoft Remote Desktop app for Windows Information Disclosure Vulnerability
-
Medium 5.5
Windows Driver Revocation List Security Feature Bypass Vulnerability
Windows Driver Revocation List Security Feature Bypass Vulnerability
-
Medium 6.7
Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
-
Medium 6.6
Visual Studio Code Spoofing Vulnerability
Visual Studio Code Spoofing Vulnerability
-
Medium 6.5CVE-2023-29324 Public exploit
Windows MSHTML Platform Security Feature Bypass Vulnerability
Windows MSHTML Platform Security Feature Bypass Vulnerability
-
Medium 6.5
Microsoft SharePoint Server Information Disclosure Vulnerability
Microsoft SharePoint Server Information Disclosure Vulnerability
-
Medium 6.5CVE-2023-24950 EPSS 67%
Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
-
Medium 6.5
Windows Bluetooth Driver Information Disclosure Vulnerability
Windows Bluetooth Driver Information Disclosure Vulnerability
-
Medium 5.5
Windows iSCSI Target Service Information Disclosure Vulnerability
Windows iSCSI Target Service Information Disclosure Vulnerability
-
Medium 5.9
Windows NTLM Security Support Provider Information Disclosure Vulnerability
Windows NTLM Security Support Provider Information Disclosure Vulnerability
-
Medium 6.1
BUG-000154662 Reflected XSS vulnerability in Portal for ArcGIS
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and before which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s brows…
-
Medium 6.1
BUG-000155001 - Unvalidated redirect in Portal for ArcGIS.
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.
-
Medium 5.4
Time Tracker has Stored XSS vulnerability in Week View plugin
Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements …
-
Medium 6.1
Craft CMS vulnerable to cross site scripting in RSS feed widget
Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.
-
Medium 5.9
Mage terminal user authentication not working properly
mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users …
-
Medium 6.5
DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to…
-
Medium 4.3
DHIS2 Core unrestricted session cookies with Personal Access Tokens
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens (PATs) generate unrestricted session cookies. This …
-
Medium 4.4
A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbit…
-
Medium 4.8
Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites
Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites, but in versions 1.0.0 until 1.0.9, 1.1.0 until 1.1.4, and 1.2.0 until 1.2.5, the isolation can be bypassed by redirec…
-
Medium 6.3
SourceCodester Online Reviewer System GET Parameter user-update.php sql injection
A vulnerability was found in SourceCodester Online Reviewer System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /reviewer/system/system/admins/manage/users/user-update.php of the component GET Parameter Hand…