Archive
July 2023
Vulnerabilities first published in this month (UTC), newest first.
797 results · Clear filters · Feed
-
Medium 6.5
IBM Watson Knowledge Catalog denial of service
IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 could allow an authenticated user send a specially crafted request that could cause a denial of service. IBM X-Force ID: 251704.
-
Medium 5.9
IBM Watson CP4D Data Stores denial of service
IBM Watson CP4D Data Stores 4.6.0 does not properly allocate resources without limits or throttling which could allow a remote attacker with information specific to the system to cause a denial of service. IBM X-Force ID: 248924.
-
Medium 5.9
IBM Db2 denial of service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 federated server is vulnerable to a denial of service as the server may crash when using a specially crafted wrapper using certain options. IBM X-Force ID: 253202.
-
Medium 6.5
SmartBPM.NET - Path Traversal
SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files.
-
Medium 4.3
IBM Db2 audit logging
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to insufficient audit logging. IBM X-Force ID: 245918.
-
Medium 5.3
IBM Db2 information disclosure
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to an information disclosure due to improper privilege management when certain federation features are used. IBM X-Force ID: 252046.
-
Medium 6.1
XSS in SoftMed's SelfPatron
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softmed SelfPatron allows Reflected XSS. This issue affects SelfPatron : before 2.0.
-
Medium 6.3
IBM Db2 code execution
IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked class instantiation when providing plugin classes. By sending a specially …
-
Medium 6.3
IBM Db2 code execution
IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI Injection. By sending a specially crafted request using the property clientRerouteServerListJNDIName, a…
-
Medium 6.3
IBM Db2 code execution
IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked logger injection. By sending a specially crafted request using the named t…
-
Medium 5.9
IBM Db2 denial of service
IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253437.
-
Medium 5.9
IBM Db2 denial of service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253361 .
-
Medium 5.9
IBM Db2 denial of service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253436.
-
Medium 5.2
Cross-site Scripting (XSS) - Generic in nilsteampassnet/teampass
Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
-
Medium 5.3
Exposure of Sensitive Information to an Unauthorized Actor in nilsteampassnet/teampass
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
-
Medium 4.3
A vulnerability in the web interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct…
-
Medium 5.4
A vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a…
-
Medium —
Barberry Security Advisory - regarding x/auth periodic vesting accounts
### Impact In `PeriodicVestingAccount`, defined in `x/auth`, an attacker can initialize a victim's account as a malicious vesting account, which allows deposits but does not allow withdrawals. When the user then deposits funds into their account, those funds …
-
Medium 6.4
IBM Cloud Object Storage System cross-site scripting
IBM Cloud Object System 3.15.8.97 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a tr…
-
Medium 4.7
A null pointer dereference was found in libpano13, version libpano13-2.9.20. The flow allows attackers to cause a denia…
-
Medium 6.3
SourceCodester Shopping Website check_availability.php sql injection
A vulnerability was found in SourceCodester Shopping Website 1.0. It has been classified as critical. Affected is an unknown function of the file check_availability.php. The manipulation of the argument email leads to sql injection. It is possible to launch t…
-
Medium 4.3
Site Kit by Google plugin for WordPress
The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This is due to the lack of capability checks on the admin_enqueue_scripts action which displays the connection key. This make…
-
Medium 5.3
Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe…
-
Medium 5.1
IBM WebSphere Application Server information disclosure
IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file. IBM X-Force ID: 258637.
-
Medium 6.5
PiiGAB M-Bus Plaintext Storage of a Password
PiiGAB M-Bus stores credentials in a plaintext file, which could allow a low-level user to gain admin credentials.
-
Medium 5.9
PiiGAB M-Bus Improper Restriction of Excessive Authentication Attempts
The number of login attempts is not limited. This could allow an attacker to perform a brute force on HTTP basic authentication.
-
Medium 6.8
Sentry CORS misconfiguration vulnerability
Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `…
-
Medium 6.1
yt-dlp File Downloader cookie leak
yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments diffe…
-
Medium 5.4
Mastodon's verified profile links can be formatted in a misleading way
Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link…
-
Medium 5.3
Rotem Dynamics Rotem CRM OTP URI Interface information exposure
A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729. This affects an unknown part of the file /LandingPages/api/otp/send?id=[ID][ampersand]method=sms of the component OTP URI Interface. The manipulation leads to…
-
Medium 6.3
ThinuTech ThinuCMS category.php sql injection
A vulnerability was found in ThinuTech ThinuCMS 1.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /category.php. The manipulation of the argument cat_id leads to sql injection. The attack may be launched remo…
-
Medium 4.3
ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was…
-
Medium —
@vendure/admin-ui-plugin authenticated Cross-site Scripting vulnerability
### Impact Vendure provides an authorization system with different levels of privileges. For example, an administrator cannot create another administrator. In the admin UI, there are a couple of places with description inputs, such as inventory/collection cat…
-
Medium 6.3
SQLFluff vulnerability for users with access to config file, using `library_path` to call arbitrary python code.
SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the `library_path` config value to allow arbitrary python code to …
-
Medium 6.5
A directory traversal vulnerability exists in the luci2-io file-export mib functionality of Milesight UR32L v32.3.0.5. …
-
Medium 4.7
Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN…
-
Medium 4.7
Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN…
-
Medium 4.2
A misconfiguration vulnerability exists in the urvpn_client functionality of Milesight UR32L v32.3.0.5. A specially-cra…
-
Medium 5.4
Novu Open Redirect Vulnerability in Sign-In with GitHub Functionality
Novu provides an API for sending notifications through multiple channels. Versions prior to 0.16.0 contain an open redirect vulnerability in the "Sign In with GitHub" functionality of Novu's open-source repository. It could have allowed an attacker to force a…
-
Medium 6.0
Metersphere missing permission check
Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks. This allows ordinary users to execute APIs that can only be executed by space administrators or project administra…