Archive
13 July 2023
Vulnerabilities first published on this day (UTC), newest first.
12 results · Clear filters · Feed
-
Critical 9.8
vm2 Sandbox Escape vulnerability
vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypas…
-
Critical 9.8
SQL in VegaGroup Web Collection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VegaGroup Web Collection allows SQL Injection. This issue affects Web Collection: before 31197.
-
Critical 9.1
Embedded malicious code vulnerability in Unitronics Vision1210
Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encoded malicious code in the device's data tables via the PCOM protocol, which can then be retrieved by a…
-
Critical 9.8
Controller stack overflow on decoding messages from the server
Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
Critical 9.8
Controller design flaw - unsigned firmware
Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
Critical 9.8
DoS due to heap overflow
Server or Console Station DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
Critical 9.8
Controller stack overflow when decoding messages from the server
Controller DoS due to stack overflow when decoding a message from the server. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
Critical 9.8
Server DoS due to heap overflow
Experion server DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
Critical 9.8
SQLi in Lisa Softwares Florist Site
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lisa Software Florist Site allows SQL Injection. This issue affects Florist Site: before 3.0.
-
Critical 9.8
SQLi in Elra Computers Parkmatik
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Elra Parkmatik allows SQL Injection through SOAP Parameter Tampering, Command Line Execution through SQL Injection. This issue affects Parkmatik: before 02.0…
-
Critical 9.9
User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload
The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'ur_upload_profile_pic' function in versions up to, and including, 3.0.2. This makes it possible for a…
-
Critical 9.8
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authenticati…