Archive
10 July 2023
Vulnerabilities first published on this day (UTC), newest first.
14 results · Clear filters · Feed
-
High 7.7
Denial of Service in Foundry Issues
A security defect was identified that enabled a user of Foundry Issues to perform a Denial of Service attack by submitting malformed data in an Issue that caused loss of frontend functionality to all issue participants. This defect was resolved with the relea…
-
High 7.8
Heap-buffer-overflow in src/formats_i.c
A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure.
-
High 8.8CVE-2023-30765 Public exploit
Delta Electronics InfraSuite Device Master Improper Access Control
Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contain improper access controls that could allow an attacker to alter privilege management configurations, resulting in privilege escalation.
-
High 7.8
Heap-buffer-overflow in src/hcom.c
A heap buffer overflow vulnerability was found in sox, in the startread function at sox/src/hcom.c:160:41. This flaw can lead to a denial of service, code execution, or information disclosure.
-
High 7.6
WordPress RSVPMarker Plugin < 10.5.5 is vulnerable to SQL Injection
Auth. (admin+) SQL Injection (SQLi) vulnerability in David F. Carr RSVPMaker plugin < 10.5.5 versions.
-
High 7.5
Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive inf…
-
High 7.5
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability …
-
High 7.5
Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive …
-
High 8.2
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about…
-
High 8.6
Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote a…
-
High 7.4
Reflected XSS vulnerability in OSNEXUS QuantaStor before 6.0.0.355
An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://<IPADDRESS>:8153/qstorapi/echo?inputMessage=<img%20src=x%20onerror=alert(document.cookie)>
-
High 8.7
Authenticated Stored XSS in OSNEXUS QuantaStor 6.0.0.335
An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITSM tab * add a webhook with the URL/service token value ' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters) * …
-
High 7.8
Local Privilege Escalation to root in OSNEXUS QuantaStor before 6.0.0.355
Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl 'localhost:8154/qstor/qs_upgrade.py?taskId=1&a=;`whoami`'
-
High 7.0
IBM Watson Knowledge Catalog CSV injection
IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 251782.