Archive
23 June 2023
Vulnerabilities first published on this day (UTC), newest first.
57 results · Clear filters · Feed
-
Medium 6.5
OrangeScrum 2.0.11 - AWS Credentials Leak via PDF Rendering
OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF.
-
Medium 5.7
End-to-End encrypted file-drops can be made inaccessible
Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side. By providing an invalid meta data file, an attacker can make previously dropped files inaccessible. It is recommended that the Nextcloud…
-
Medium 4.1
Nextcloud Server vulnerable to open redirect on "Unsupported browser" warning
NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior to version 26.0.2, an attacker could supply a URL that redirects an unsuspecting victim from a legit…
-
Medium 6.6
AWS CDK EKS overly permissive trust policies
AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages `aws-cdk-lib` 2.0.0 until 2.80.0 and `@aws-cdk/aws-eks` 1.57.0 until 1.202…
-
Medium 6.0
Vega's validators able to submit duplicate transactions
Vega is a decentralized trading platform that allows pseudo-anonymous trading of derivatives on a blockchain. Prior to version 0.71.6, a vulnerability exists that allows a malicious validator to trick the Vega network into re-processing past Ethereum events f…
-
Medium 4.8
Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`)…
-
Medium 5.0
When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id
Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the `@Entity` decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the `id` of an entity inst…
-
Medium 6.8
Session Fixation in fossbilling/fossbilling
Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1.
-
Medium 4.4
NVIDIA Jetson Linux Driver Package contains a vulnerability in nvbootctrl, where a privileged local attacker can config…
-
Medium 6.3
SourceCodester Human Resource Management System detailview.php sql injection
A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file detailview.php. The manipulation of the argument employeeid leads to sql injection. The att…
-
Medium 4.3
XWiki Platform's tags on non-viewable pages can be revealed to users
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, tags from pages not viewable to the current user are leaked by t…
-
Medium 6.2
FastAsyncWorldEdit vulnerable to Uncontrolled Resource Consumption
FastAsyncWorldEdit (FAWE) is designed for efficient world editing. This vulnerability enables the attacker to select a region with the `Infinity` keyword (case-sensitive!) and executes any operation. This has a possibility of bringing the performing server do…
-
Medium 4.6
WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.7 is vulnerable to Insecure Direct Object References (IDOR)
Authorization Bypass Through User-Controlled Key vulnerability in JS Help Desk js-support-ticket allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk: from n/a through 2.7.7.
-
Medium 5.9
WordPress Wp Ultimate Review Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions.
-
Medium 5.9
WordPress CRM Memberships Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NTZApps CRM Memberships plugin <= 1.6 versions.
-
Medium 5.9
WordPress Password Protected Plugin <= 2.6.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPExperts Password Protected plugin <= 2.6.2 versions.
-
Medium 5.9
WordPress Booking and Rental Manager Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MagePeople Team Booking and Rental Manager for Bike plugin <= 1.2.1 versions.
-
Medium 6.7
Dell Command | Update, Dell Update, and Alienware Update versions 4.8.0 and prior contain an Insecure Operation on Wind…
-
Medium 6.8
Dell BIOS contains an Improper Input Validation vulnerability. An unauthenticated physical attacker may potentially exp…
-
Medium 6.3
Dell Command | Update, Dell Update, and Alienware Update versions 4.9.0, A01 and prior contain an Insecure Operation on…
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 6.3
SourceCodester Game Result Matrix System GET Parameter athlete-profile.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Game Result Matrix System 1.0. This affects an unknown part of the file /dipam/athlete-profile.php of the component GET Parameter Handler. The manipulation of the argument id leads…
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …
-
Medium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator …