Archive
18 July 2023
Vulnerabilities first published on this day (UTC), newest first.
149 results · Feed
-
Medium 5.4
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics …
-
Medium 5.5
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 8.4
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers…
-
Medium 4.2
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
Medium 4.3
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics …
-
Medium 4.3
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics …
-
Medium 5.4
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics …
-
Low 2.2
Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.4.…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.3
Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Workforce Manag…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…
-
Low 3.1
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java S…
-
Medium 4.3
Vulnerability in the Oracle Applications Technology product of Oracle E-Business Suite (component: Reports Configuratio…
-
Medium 4.4
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…
-
Medium 6.5
Vulnerability in the Oracle Mobile Security Suite product of Oracle Fusion Middleware (component: Android Mobile Authen…
-
Critical 9.0
Vulnerability in the Application Express Customers Plugin product of Oracle Application Express (component: User Accoun…
-
Medium 5.6
Vulnerability in the Application Express Administration product of Oracle Application Express (component: None). Suppor…
-
Critical 9.0
Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Ac…
-
Medium 6.0
Vulnerability in the Oracle Hyperion Essbase Administration Services product of Oracle Essbase (component: EAS Administ…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…
-
Low 3.7
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affect…
-
High 7.5
Rockwell Automation ThinManager ThinServer Path Traversal Vulnerability
An executable used in Rockwell Automation ThinManager ThinServer can be configured to enable an API feature in the HTTPS Server Settings. This feature is disabled by default. When the API is enabled and handling requests, a path traversal vulnerability exists…
-
Medium 4.9
HCL BigFix WebUI Software Distribution is affected by a cross site server request forgery vulnerability
A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access files on server side systems (server machine and all the ones in its network).
-
Medium 5.9
BigFix WebUI is vulnerable to use of a risky cryptographic algorithm
The BigFix WebUI uses weak cipher suites.
-
High 7.2
Command injection in firewall ip functionality in 1Panel
1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an …
-
Low 2.7
Fides Webserver Vulnerable to Zip Bomb File Uploads
Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit a weakness in the connector template upload f…
-
Low 2.7
Fides Webserver Vulnerable to SVG Bomb File Uploads
Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files contai…
-
Medium 4.7
URL redirection affects BigFix WebUI
URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header.
-
Medium 5.5
An SQL injection affects BigFix WebUI API
Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.
-
High 7.1
WordPress Easy Captcha Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wppal Easy Captcha plugin <= 1.0 versions.
-
Medium 5.5
Iagona ScrutisWeb Use of Hard-coded Cryptographic Key
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a cryptographic vulnerability that could allow an unauthenticated user to decrypt encrypted passwords into plaintext.
-
High 7.5
Iagona ScrutisWeb Absolute Path Traversal
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a directory traversal vulnerability that could allow an unauthenticated user to directly access any file outside the webroot.
-
High 7.5
CVE-2023-38257
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to an insecure direct object reference vulnerability that could allow an unauthenticated user to view profile information, including user login names and encrypted passwords.
-
Medium 5.9
WordPress Custom Post Type Generator Plugin <= 2.4.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Hijiri Custom Post Type Generator plugin <= 2.4.2 versions.
-
Critical 10.0
Iagona ScrutisWeb Unrestricted Upload of File with Dangerous Type
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a remote code execution vulnerability that could allow an unauthenticated user to upload a malicious payload and execute it.
-
High 8.2
Code injection via Dynamic Redfish Extension interface
AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.
-
High 8.4
Authentication Bypass via HTTP Header Spoofing
AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vulnerability may lead to loss of confidentiality, integrity, and availability.
-
Low 2.7
what3words Autosuggest Plugin Setting class-w3w-autosuggest-public.php enqueue_scripts information disclosure
A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the c…
-
Medium 6.1
Cross site scripting in Export Chat feature
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting …
-
Medium 6.1
XSS in SolarWinds Database Performance Analyzer 2023.2
XSS attack was possible in DPA 2023.2 due to insufficient input validation