Archive
7 July 2023
Vulnerabilities first published on this day (UTC), newest first.
58 results · Feed
-
Unscored —
A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor…
-
High 7.6CVE-2023-37270 Scanner template
Piwigo SQL Injection vulnerability in "User-Agent"
Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records use…
-
Low 2.0CVE-2023-37269 Public exploit
Winter CMS vulnerable to stored XSS through privileged upload of SVG file
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could …
-
Critical 9.6
CC: Tweaked SSRF to Cloud Services Metadata Services not Blocked by Default
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3, if the cc-tweaked plugin is running on a Minecraft serve…
-
Critical 9.6
OpenComputers's SSRF to cloud service metadata services and local IPv6 addresses not blocked by default
OpenComputers is a Minecraft mod that adds programmable computers and robots to the game. This issue affects every version of OpenComputers with the Internet Card feature enabled; that is, OpenComputers 1.2.0 until 1.8.3 in their most common, default configur…
-
Critical 10.0CVE-2022-4361 Public exploit
Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC
Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL val…
-
Medium 4.3
A vulnerability in the web interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct…
-
Medium 5.4
A vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a…
-
Medium —
Barberry Security Advisory - regarding x/auth periodic vesting accounts
### Impact In `PeriodicVestingAccount`, defined in `x/auth`, an attacker can initialize a victim's account as a malicious vesting account, which allows deposits but does not allow withdrawals. When the user then deposits funds into their account, those funds …
-
Critical 10.0
Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function. Attacker can read freed memory aft…
-
Critical 10.0
Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. This allow attackers to create …
-
Medium 6.4
IBM Cloud Object Storage System cross-site scripting
IBM Cloud Object System 3.15.8.97 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a tr…
-
Critical 10.0
In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service.
-
Medium 4.7
A null pointer dereference was found in libpano13, version libpano13-2.9.20. The flow allows attackers to cause a denia…
-
Low 3.5
GZ Scripts Time Slot Booking Calendar PHP load.php cross site scripting
A vulnerability was found in GZ Scripts Time Slot Booking Calendar PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country lea…
-
Low 3.5
GZ Scripts Availability Booking Calendar PHP HTTP POST Request load.php cross site scripting
A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.8. It has been classified as problematic. This affects an unknown part of the file load.php of the component HTTP POST Request Handler. The manipulation of the argument cid/first_name…
-
Low 3.7
Pipelines do not validate child UIDs
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelin…
-
Low 3.5
ThinuTech ThinuCMS contact.php cross site scripting
A vulnerability was found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this issue is some unknown functionality of the file /contact.php. The manipulation of the argument name/body leads to cross site scripting. The attack may be launc…
-
Low 3.5
ThinuTech ThinuCMS author_posts.php cross site scripting
A vulnerability has been found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /author_posts.php. The manipulation of the argument author with the input g6g12<script>alert(1)</scr…
-
Low 3.5
SimplePHPscripts NewsLetter Script PHP URL Parameter preview.php cross site scripting
A vulnerability, which was classified as problematic, was found in SimplePHPscripts NewsLetter Script PHP 2.4. Affected is an unknown function of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. It …
-
Low 3.5
SimplePHPscripts Simple Forum PHP URL Parameter preview.php cross site scripting
A vulnerability, which was classified as problematic, has been found in SimplePHPscripts Simple Forum PHP 2.7. This issue affects some unknown processing of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scr…
-
Low 3.5
SimplePHPscripts Photo Gallery PHP URL Parameter preview.php cross site scripting
A vulnerability classified as problematic was found in SimplePHPscripts Photo Gallery PHP 2.0. This vulnerability affects unknown code of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack …
-
Low 3.5
SimplePHPscripts News Script PHP Pro URL Parameter preview.php cross site scripting
A vulnerability classified as problematic has been found in SimplePHPscripts News Script PHP Pro 2.4. This affects an unknown part of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. It is possible …
-
Low 3.5
SimplePHPscripts Funeral Script PHP URL Parameter preview.php cross site scripting
A vulnerability was found in SimplePHPscripts Funeral Script PHP 3.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site …
-
Low 3.5
SimplePHPscripts FAQ Script PHP URL Parameter preview.php cross site scripting
A vulnerability was found in SimplePHPscripts FAQ Script PHP 2.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross …
-
Medium 6.3
SourceCodester Shopping Website check_availability.php sql injection
A vulnerability was found in SourceCodester Shopping Website 1.0. It has been classified as critical. Affected is an unknown function of the file check_availability.php. The manipulation of the argument email leads to sql injection. It is possible to launch t…
-
Medium 4.3
Site Kit by Google plugin for WordPress
The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This is due to the lack of capability checks on the admin_enqueue_scripts action which displays the connection key. This make…
-
Medium 5.3
Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe…
-
High 7.8
Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the ha…
-
High 8.5
Cross-site Scripting (XSS) - Stored in outline/outline
Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to 0.70.1.
-
Medium 5.1
IBM WebSphere Application Server information disclosure
IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file. IBM X-Force ID: 258637.
-
Unscored —
Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300…
-
Unscored —
ai-dev aicombinationsonfly before v0.3.1 was discovered to contain a SQL injection vulnerability via the component /inc…
-
Unscored —
A Cross-site scripting (XSS) vulnerability in the content editor in Gis3W g3w-suite 3.5 allows remote authenticated use…
-
Unscored —
The Online Examination System Project 1.0 version is vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attack…
-
Unscored —
An issue in JerryscriptProject jerryscript v.3.0.0 allows an attacker to obtain sensitive information via a crafted scr…
-
Unscored —
In TravianZ 8.3.4 and 8.3.3, Incorrect Access Control in the installation script allows an attacker to overwrite the se…
-
Unscored —
The cryptographically insecure random number generator being used in TravianZ 8.3.4 and 8.3.3 in the password reset fun…
-
Unscored —
PHP injection in TravianZ 8.3.4 and 8.3.3 in the config editor in the admin page allows remote attackers to execute PHP…
-
Unscored —
SQL injection vulnerability found in PrestaShop lekerawen_ocs before v.1.4.1 allow a remote attacker to gain privileges…