Archive
5 June 2023
Vulnerabilities first published on this day (UTC), newest first.
73 results · Feed
-
Medium 4.4
KylinSoft youker-assistant Arbitrary File dbus.SystemBus delete_file access control
A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function delete_file in the library dbus.SystemBus of the component Arbitrary File Handler. The manipulation leads to improper acc…
-
Medium 4.4
KylinSoft youker-assistant restore_all_sound_file path traversal
A vulnerability classified as critical has been found in KylinSoft youker-assistant on KylinOS. Affected is the function restore_all_sound_file. The manipulation leads to path traversal: '../filedir'. Attacking locally is a requirement. The exploit has been d…
-
Medium 5.3
KylinSoft kylin-software-properties setMainSource os command injection
A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been rated as critical. This issue affects the function setMainSource. The manipulation leads to os command injection. Local access is required to approach this attack. The ex…
-
Medium 5.3
KylinSoft kylin-software-properties changedSource access control
A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been declared as critical. This vulnerability affects the function changedSource. The manipulation leads to improper access controls. An attack has to be approached locally. T…
-
High 7.2
Remote Code Execution via Command Injection
Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2…
-
High 7.8
Privilege escalation to root
Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R202…
-
Low 2.4
Broken Link Checker Plugin Settings Page core.php options_page cross site scripting
A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function options_page of the file core/core.php of the component Settings Page. The manipulation of t…
-
Medium 6.3
IBM Security Guardium session fixation
IBM Security Guardium 11.5 could allow a user to take over another user's session due to insufficient session expiration. IBM X-Force ID: 243657.
-
Low 3.7
IBM Maximo Asset Management information disclosure
IBM Maximo Asset Management 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or bro…
-
Medium 5.9
IBM Maximo Application Suite information disclosure
IBM Maximo Application Suite - Manage Component 8.8.0 and 8.9.0 transmits sensitive information in cleartext that could be intercepted by an attacker using man in the middle techniques. IBM X-Force ID: 249208.
-
High 7.5
*File Upload vulnerability found in Emlog EmlogCMS v.6.0.0 allows a remote attacker to gain access to sensitive informa…
-
High 7.5
OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a U…
-
Medium 5.3
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate valid…
-
Medium 5.4
DokuWiki before 2023-04-04a allows XSS via RSS titles.
-
High 7.5
xml-rs vulnerable to denial of service via invalid token in XML document
The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.
-
High 7.8
A buffer overflow in EasyPlayerPro-Win v3.2.19.0106 to v3.6.19.0823 allows attackers to cause a Denial of Service (DoS)…
-
High 8.8CVE-2023-33410 Public exploit
Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The v…
-
Critical 9.8
MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading attachments in the background.
-
High 7.8CVE-2023-33733 Public exploit
Reportlab vulnerable to remote code execution
Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.
-
Unscored —
SonicJS up to v0.7.0 allows attackers to execute an authenticated path traversal when an attacker injects special chara…
-
Medium 5.4CVE-2023-33408 Public exploit
Minical 1.0.0 is vulnerable to Cross Site Scripting (XSS). The vulnerability exists due to insufficient input validatio…
-
Medium 5.3
Advent/SSC Inc. Tamale RMS < 23.1 is vulnerable to Directory Traversal. If one traverses to the affected URL, one enume…
-
Medium 6.5CVE-2023-33409 Public exploit
Minical 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/co…
-
Medium 5.3
emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtai…
-
Medium 6.1
Gitpod vulnerable to Cross-site Scripting
Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).
-
Critical 9.8
PrestaShop jmsthemelayout 2.5.5 is vulnerable to SQL Injection via ajax_jmsvermegamenu.php.
-
Critical 9.8
PrestaShop jmsslider 1.6.0 is vulnerable to Incorrect Access Control via ajax_jmsslider.php.
-
Critical 9.8
PrestaShop jmsmegamenu 1.1.x and 2.0.x is vulnerable to SQL Injection via ajax_jmsmegamenu.php.
-
High 7.5
Telefnica Brasil Vivo Play (IPTV) Firmware: 2023.04.04.01.06.15 is vulnerable to Denial of Service (DoS) via DNS Recurs…
-
High 7.5
On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.
On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.
-
High 7.8
The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain s…
-
High 7.8
A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. …
-
Medium 6.3
Cross-site Scripting (XSS) - Stored in admidio/admidio
Cross-site Scripting (XSS) - Stored in GitHub repository admidio/admidio prior to 4.2.8.