Archive
30 June 2023
Vulnerabilities first published on this day (UTC), newest first.
23 results · Clear filters · Feed
-
Medium 5.4
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Medium 6.1
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
-
Medium 4.3
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
-
Medium —
s2n-quic potential denial of service vulnerability when receiving empty UDP packets
### Impact An issue in s2n-quic results in the endpoint shutting down after receiving an empty UDP packet on a connection. No AWS services are affected by this issue and customers of AWS services do not need to take action. Applications using s2n-quic should …
-
Medium 6.2
Post-authentication remote command injection vulnerability on Western Digital My Cloud OS 5 devices
Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context of the root user on vulnerable CGI files. This vulnerability can only be exploited over the network…
-
Medium 6.0
Limited Post-Authentication Remote Command Injection in My Cloud Products
A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attacker to build files with redirects and execute larger payloads. This issue affects My Cloud OS 5 devices: before 5.26.3…
-
Medium 6.9
Dependency cache path traversal in Gradle
Gradle is a build tool with a focus on build automation and support for multi-language development. When Gradle writes a dependency into its dependency cache, it uses the dependency's coordinates to compute a file location. With specially crafted dependency c…
-
Medium 6.9
Path traversal vulnerabilities in handling of Tar archives in Gradle
Gradle is a build tool with a focus on build automation and support for multi-language development. In affected versions when unpacking Tar archives, Gradle did not check that files could be written outside of the unpack location. This could lead to important…
-
Medium 6.2
Quadratic runtime with malformed PDF missing xref marker in pypdf
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current proc…
-
Medium 6.2
Infinite Loop when reading malformed objects in pypdf
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In version 2.10.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This infinite loop blocks the curre…
-
Medium 4.7
IBOS OA Add User edit&op=member actionEdit sql injection
A vulnerability classified as critical was found in IBOS OA 4.5.5. Affected by this vulnerability is the function actionEdit of the file ?r=dashboard/roleadmin/edit&op=member of the component Add User Handler. The manipulation of the argument id leads to sql …
-
Medium 4.3CVE-2023-3479 Scanner template
Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8.
-
Medium 4.7
Campcodes Retro Cellphone Online Store edit_product.php sql injection
A vulnerability, which was classified as critical, was found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unknown function of the file /admin/edit_product.php. The manipulation of the argument username leads to sql injection. It is possible t…
-
Medium 5.3
Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.
-
Medium 5.2
Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2.
-
Medium 6.1CVE-2023-34840 Public exploit
angular-ui-notification Cross-site Scripting vulnerability
angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.
-
Medium 6.5CVE-2023-3338 Public exploit
Crash due to a null pointer dereference in the dn_nsp_send function
A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash the system.
-
Medium 5.5
Libtiff: null pointer dereference in tif_dir.c
A null pointer dereference issue was found in Libtiff's tif_dir.c file. This issue may allow an attacker to pass a crafted TIFF image file to the tiffcp utility which triggers a runtime error that causes undefined behavior. This will result in an application …
-
Medium 6.1
Joplin Cross-site Scripting vulnerability
Joplin before 2.11.5 allows XSS via an AREA element of an image map.
-
Medium 6.5
hnswlib Double Free vulnerability
Hnswlib 0.7.0 has a double free in init_index when the M argument is a large integer.
-
Medium 5.9
pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the…
-
Medium 6.1
Joplin Cross-site Scripting vulnerability
Joplin before 2.11.5 allows XSS via a USE element in an SVG document.
-
Medium 6.1
MediaWiki Cross-site Scripting vulnerability
An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a…