Archive
June 2023
Vulnerabilities first published in this month (UTC), newest first.
114 results · Clear filters · Feed
-
Low 3.7
IBM CICS TX information disclosure
IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 could transmit sensitive information in query parameters that could be intercepted using man in the middle techniques. IBM X-Force ID: 257105.
-
Low 3.5
SourceCodester Online Discussion Forum Site manage_post.php cross site scripting
A vulnerability classified as problematic was found in SourceCodester Online Discussion Forum Site 1.0. Affected by this vulnerability is an unknown functionality of the file admin\posts\manage_post.php. The manipulation of the argument title leads to cross s…
-
Low 3.5
SourceCodester Online Discussion Forum Site manage_post.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Online Discussion Forum Site 1.0. Affected is an unknown function of the file admin\posts\manage_post.php. The manipulation of the argument content leads to cross site scripting. It is…
-
Low 3.1
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in…
-
Low 3.1
Insertion of Sensitive Information Into Sent Data in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 15.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. It was possible to disclose issue notes to an unauthorized user…
-
Low 3.8
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.
-
Low 2.6
An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions star…
-
Low 3.5
URL deny list bypass via oEmbed and image URLs when generating previews in Synapse
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklist` setting potentially allowing server side request forgery or bypassing network policies. Impact is…
-
Low 2.6
Denial of service from high number of artifact signatures in notation
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation inspe…
-
Low 3.5
Dahua Smart Parking Management image server-side request forgery
A vulnerability has been found in Dahua Smart Parking Management up to 20230528 and classified as problematic. This vulnerability affects unknown code of the file /ipms/imageConvert/image. The manipulation of the argument fileUrl leads to server-side request …
-
Low 3.5
Arborator Server project.cgi start denial of service
A vulnerability classified as problematic was found in Arborator Server. This vulnerability affects the function start of the file project.cgi. The manipulation of the argument project leads to denial of service. Continious delivery with rolling releases is u…
-
Low 3.5
Fuzzy SWMP GET Parameter swmp.php cross site scripting
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Fuzzy SWMP. It has been rated as problematic. This issue affects some unknown processing of the file swmp.php of the component GET Parameter Handler. The manipulation of the argument theme leads to …
-
Low 3.5
Gravity Forms DPS PxPay Plugin cross site scripting
A vulnerability, which was classified as problematic, was found in Gravity Forms DPS PxPay Plugin up to 1.4.2 on WordPress. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgradin…
-
Low 3.3
A segmentation fault flaw was found in the Advancecomp package. This may lead to decreased availability.
-
Low —
cheqd-node affected by Inter-blockchain Communication (IBC) protocol "Huckleberry" vulnerability
### Impact This vulnerability affects the [`ibc-go` package for those running full nodes, dubbed "Huckleberry"](https://forum.cosmos.network/t/ibc-security-advisory-huckleberry/10731). According to their advisory: > This issue is low-severity in general, and …
-
Low 3.5
WooFramework Tweaks Plugin wooframework-tweaks.php admin_screen_logic redirect
A vulnerability classified as problematic was found in WooFramework Tweaks Plugin up to 1.0.1 on WordPress. Affected by this vulnerability is the function admin_screen_logic of the file wooframework-tweaks.php. The manipulation of the argument url leads to op…
-
Low 2.4
Broken Link Checker Plugin Settings Page core.php options_page cross site scripting
A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function options_page of the file core/core.php of the component Settings Page. The manipulation of t…
-
Low 3.7
IBM Maximo Asset Management information disclosure
IBM Maximo Asset Management 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or bro…
-
Low 3.5
EELV Newsletter Plugin lettreinfo.php style_newsletter cross site scripting
A vulnerability was found in EELV Newsletter Plugin 2.x on WordPress. It has been rated as problematic. Affected by this issue is the function style_newsletter of the file lettreinfo.php. The manipulation of the argument email leads to cross site scripting. T…
-
Low 3.5
X-WRT luci 404 Error Template dispatcher.uc run_action cross site scripting
A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10_b202303061504. This issue affects the function run_action of the file modules/luci-base/ucode/dispatcher.uc of the component 404 Error Template Handler. The manipul…
-
Low 3.3
Divide-by-zero in Xpdf 4.04 due to very large page size
An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code. This is related to CVE-2022-30524, but the problem here is caused by a very large page size, rather than by…
-
Low —
Vulnerable OpenSSL included in cryptography wheels
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.5-40.0.2 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://www.openssl.org/news/se…
-
Low —
Go package github.com/cosmos/cosmos-sdk module x/crisis does NOT cause chain halt
# x/crisis does NOT cause chain halt ### Impact If an invariant check fails on a Cosmos SDK network and a transaction is sent to the `x/crisis` module to halt the chain, the chain does not halt. All versions of the `x/crisis` module is affected on all version…
-
Low 2.9
Buffer overflow in Platform CLI component in Silicon Labs Gecko SDK v4.2.1 and earlier allows user to overwrite limited…
-
Low 3.5
code-projects Agro-School Management System btn_functions.php doAddQuestion cross site scripting
A vulnerability has been found in code-projects Agro-School Management System 1.0 and classified as problematic. This vulnerability affects the function doAddQuestion of the file btn_functions.php. The manipulation of the argument Question leads to cross site…
-
Low 3.5
07FLY CRM User Profile cross site scripting
A vulnerability was found in 07FLY CRM up to 1.2.0. It has been declared as problematic. This vulnerability affects unknown code of the component User Profile Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The e…
-
Low 3.5
mback2k mh_httpbl Extension class.tx_mhhttpbl.php stopOutput cross site scripting
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3. This affects the function stopOutput of the file class.tx_mhhttpbl.php. The manipulation of the argument $_SERVER['RE…
-
Low 3.5
ruddernation TinyChat Room Spy Plugin room-spy.php wp_show_room_spy cross site scripting
A vulnerability classified as problematic was found in ruddernation TinyChat Room Spy Plugin up to 1.2.8 on WordPress. This vulnerability affects the function wp_show_room_spy of the file room-spy.php. The manipulation of the argument room leads to cross site…
-
Low 3.3
In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message
-
Low 3.5
Guangdong Pythagorean OA Office System Schedule cross site scripting
A vulnerability has been found in Guangdong Pythagorean OA Office System up to 4.50.31 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Schedule Handler. The manipulation of the argument description le…
-
Low 3.3
Stack buffer overflow in "read_file" function
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf leads to DoS via malformed config files. This issue affects libeconf: before 0.5.2.
-
Low 3.3
Stack buffer overflow in "econf_writeFile" function
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files This issue affects libeconf: before 0.5.2.
-
Low 3.5
sea75300 FanPress CM Template Preview templatepreview.php getArticlesPreview cross site scripting
A vulnerability was found in sea75300 FanPress CM up to 3.6.3. It has been classified as problematic. This affects the function getArticlesPreview of the file inc/controller/action/system/templatepreview.php of the component Template Preview. The manipulation…
-
Low 3.5
Stars Alliance PsychoStats login.php cross site scripting
A vulnerability classified as problematic has been found in Stars Alliance PsychoStats up to 3.2.2a. This affects an unknown part of the file upload/admin/login.php. The manipulation of the argument ref leads to cross site scripting. It is possible to initiat…