Archive
6 July 2023
Vulnerabilities first published on this day (UTC), newest first.
88 results · Clear filters · Feed
-
High 8.8
PiiGAB M-Bus Cross-Site Request Forgery
PiiGAB M-Bus is vulnerable to cross-site request forgery. An attacker who wants to execute a certain command could send a phishing mail to the owner of the device and hope that the owner clicks on the link. If the owner of the device has a cookie stored that …
-
High 7.5
PiiGAB M-Bus Use of Password Hash With Insufficient Computational Effort
PiiGAB M-Bus stores passwords using a weak hash algorithm.
-
High 7.5
PiiGAB M-Bus Weak Password Requirements
There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the password is inline with recommended password guidelines.
-
High 8.0
PiiGAB M-Bus Cross-site Scripting
PiiGAB M-Bus does not validate identification strings before processing, which could make it vulnerable to cross-site scripting attacks.
-
High 7.5
PiiGAB M-Bus Unprotected Transport of Credentials
PiiGAB M-Bus transmits credentials in plaintext format.
-
High 8.8
PiiGAB M-Bus Code Injection
PiiGAB M-Bus SoftwarePack 900S does not correctly sanitize user input, which could allow an attacker to inject arbitrary commands.
-
High 8.1
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
-
High 7.5
Mastodon vulnerable to Denial of Service through slow HTTP responses
Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the…
-
High 8.3
Authentik lacks Proxy IP headers validation
authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, both in the Python code and the go code. Only authentik setups that are directly accessi…
-
High 8.2
league/oauth2-server key exposed in exception message when passing as string and providing invalid pass phrase
league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had t…
-
High 7.1
Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content
Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-…
-
High 7.2
An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.…
-
High 7.5
An access violation vulnerability exists in the eventcore functionality of Milesight UR32L v32.3.0.5. A specially craft…
-
High 7.2
An OS command injection vulnerability exists in the libzebra.so bridge_group functionality of Milesight UR32L v32.3.0.5…
-
High 7.2
An os command injection vulnerability exists in the libzebra.so change_hostname functionality of Milesight UR32L v32.3.…
-
High 7.3
An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0…
-
High 7.5
A directory traversal vulnerability exists in the server.js start functionality of Milesight VPN v2.0.2. A specially-cr…
-
High 7.3
A sql injection vulnerability exists in the requestHandlers.js LoginAuth functionality of Milesight VPN v2.0.2. A speci…
-
High 8.1
An os command injection vulnerability exists in the liburvpn.so create_private_key functionality of Milesight VPN v2.0.…
-
High 8.8
Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR3…
-
High 8.8
Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR3…
-
High 8.8
Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32…
-
High 8.8
Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32…
-
High 7.2
An OS command injection vulnerability exists in the ys_thirdparty check_system_user functionality of Milesight UR32L v3…
-
High 8.8
An OS command injection vulnerability exists in the vtysh_ubus _get_fw_logs functionality of Milesight UR32L v32.3.0.5.…
-
High 7.2
An OS command injection vulnerability exists in the ys_thirdparty system_user_script functionality of Milesight UR32L v…
-
High 8.8
An OS command injection vulnerability exists in the vtysh_ubus tcpdump_start_cb functionality of Milesight UR32L v32.3.…
-
High 8.8
A stack-based buffer overflow vulnerability exists in the libzebra.so.0.0.0 security_decrypt_password functionality of …
-
High 7.2
Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of …
-
High 7.2
Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of …
-
High 7.2
Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of …
-
High 7.2
Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of …
-
High 7.2
Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of …
-
High 7.2
Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of …
-
High 7.2
Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of …
-
High 7.2
Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of …
-
High 7.2
Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of …
-
High 7.2
Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of …
-
High 7.2
Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of …
-
High 7.2
Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of …