Archive
May 2023
Vulnerabilities first published in this month (UTC), newest first.
1,208 results · Clear filters · Feed
-
Medium 4.6
kyverno seccomp control can be circumvented
Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity `validate.podSecurity` subrule in Kyverno 1.9.2 and 1.9.3 are vulnerable. This issue was patched in version 1.9.4.
-
Medium 6.1
Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker API
tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poisoned by a tgstation-server (TGS) restart and reattach. This can result in sending chat messages to one of any of the con…
-
Medium 4.4
Clipboard based cross-site scripting (blocked with default CSP) in Kanboard
Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the `contentEditable` element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attac…
-
Medium 5.9
ginuerzh/gost vulnerable to Timing Attack
gost (GO Simple Tunnel) is a simple tunnel written in golang. Sensitive secrets such as passwords, token and API keys should be compared only using a constant-time comparison function. Untrusted input, sourced from a HTTP header, is compared directly with a s…
-
Medium 6.5
imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation. Both of these a…
-
Medium 6.7
net: shell: Improper input validation
At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible.
-
Medium 5.5
A memory leak vulnerability exists in NanoMQ 0.17.2. The vulnerability is located in the file message.c. An attacker co…
-
Medium 6.1
An issue was discovered in Faronics Insight 10.0.19045 on Windows. Attacker-supplied input is not validated/sanitized b…
-
Medium 4.6
An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the …
-
Medium 6.1
Avaya IX Workforce Engagement - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Avaya IX Workforce Engagement v15.2.7.1195 - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
-
Medium 5.3
Avaya IX Workforce Engagement - User Enumeration - CWE-204: Observable Response Discrepancy
Avaya IX Workforce Engagement v15.2.7.1195 - User Enumeration - Observable Response Discrepancy
-
Medium 6.5
Avaya IX Workforce Engagement - CWE-522: Insufficiently Protected Credentials
Avaya IX Workforce Engagement v15.2.7.1195 - CWE-522: Insufficiently Protected Credentials
-
Medium 6.2
-
Medium 5.3
XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injecti…
-
Medium 6.3
Path Traversal: '\..\filename' in pimcore/pimcore
Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
-
Medium 6.5
Privilege Defined With Unsafe Actions in pimcore/pimcore
Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.
-
Medium 5.4
Prototype Pollution in antfu/utils
Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.
-
Medium 5.5
Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive …
-
Medium 6.1CVE-2023-23956 Public exploit
A user can supply malicious HTML and JavaScript code that will be executed in the client browser
-
Medium 5.4
Multiple Stored Cross-Site Scripting Vulnerabilities on Shop Beat Services
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripting (XSS) vulnerabilities via Shop Beat Control Panel found at www.shopbeat.co.za controlpanel.shopbeat.co.za.
-
Medium 5.3
Directory Traversal on Shop Beat Services
Shop Beat Solutions (pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Directory Traversal via server.shopbeat.co.za. Information Exposure Through Directory Listing vulnerability in "studio" software of Shop Beat. This issue affects: Shop B…
-
Medium 5.4
Shop Beat Services Vulnerable To Bypass 2FA via APIs
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code.…
-
Medium 5.5
An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary d…
-
Medium 4.3
Bestwebsoft Relevant Plugin Thumbnail information disclosure
A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by this vulnerability is an unknown functionality of the component Thumbnail Handler. The manipulation leads to information disclosure. The a…
-
Medium 4.8
Tuleap vulnerable toXSS via the triggered job URL of a Jenkins job
Tuleap is an open source tool for end to end traceability of application and system developments. Tuleap Community Edition prior to version 14.8.99.60 and Tuleap Enterprise edition prior to 14.8-3 and 14.7-7, the logs of the triggered Jenkins job URLs are not…
-
Medium 6.5
WordPress Progress Bar Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Chris Reynolds Progress Bar plugin <= 2.2.1 versions.
-
Medium 4.7
SourceCodester Faculty Evaluation System sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Faculty Evaluation System 1.0. Affected by this issue is some unknown functionality of the file index.php?page=edit_user. The manipulation of the argument id leads to sql inje…
-
Medium 4.3
Lack of URL normalization allows rendering previews for disallowed domains
Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link preview on a disallowed domain using a specially crafted link.
-
Medium 6.3
SourceCodester Students Online Internship Timesheet System GET Parameter rendered_report.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Students Online Internship Timesheet System 1.0. Affected is an unknown function of the file rendered_report.php of the component GET Parameter Handler. The manipulation of the arg…
-
Medium 4.3
WordPress Product Gallery Slider for WooCommerce Plugin <= 2.2.8 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Codeixer Product Gallery Slider for WooCommerce plugin <= 2.2.8 versions.
-
Medium 5.4
WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 1.8.4 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) plugin <= 1.8.4 versions.
-
Medium 5.9
An issue was discovered in Citadel through webcit-926. Meddler-in-the-middle attackers can pipeline commands after POP3…
-
Medium 6.4
An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android. The child c…
-
Medium 4.2
OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading co…
-
Medium 6.5
OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a craf…
-
Medium 4.3
OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowin…
-
Medium 4.8
Cross-site Scripting (XSS) - Stored in liangliangyy/djangoblog
Cross-site Scripting (XSS) - Stored in GitHub repository liangliangyy/djangoblog prior to master.
-
Medium 5.5
ITRS Group monitor-ninja scheduled_reports.php sql injection
A vulnerability was found in ITRS Group monitor-ninja up to 2021.11.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file modules/reports/models/scheduled_reports.php. The manipulation leads to sql injection. Upgra…
-
Medium 4.3
WordPress Download Plugin Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Plugin <= 2.0.4 versions.
-
Medium 6.5
WordPress Yoast SEO: Local Plugin <= 14.9 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.9 versions.