Archive
July 2023
Vulnerabilities first published in this month (UTC), newest first.
2,318 results · Feed
-
Medium 6.5
Vulnerability in the Oracle Mobile Security Suite product of Oracle Fusion Middleware (component: Android Mobile Authen…
-
Critical 9.0
Vulnerability in the Application Express Customers Plugin product of Oracle Application Express (component: User Accoun…
-
Medium 5.6
Vulnerability in the Application Express Administration product of Oracle Application Express (component: None). Suppor…
-
Critical 9.0
Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Ac…
-
Medium 6.0
Vulnerability in the Oracle Hyperion Essbase Administration Services product of Oracle Essbase (component: EAS Administ…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…
-
Low 3.7
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affect…
-
High 7.5
Rockwell Automation ThinManager ThinServer Path Traversal Vulnerability
An executable used in Rockwell Automation ThinManager ThinServer can be configured to enable an API feature in the HTTPS Server Settings. This feature is disabled by default. When the API is enabled and handling requests, a path traversal vulnerability exists…
-
Medium 4.9
HCL BigFix WebUI Software Distribution is affected by a cross site server request forgery vulnerability
A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access files on server side systems (server machine and all the ones in its network).
-
Medium 5.9
BigFix WebUI is vulnerable to use of a risky cryptographic algorithm
The BigFix WebUI uses weak cipher suites.
-
High 7.2
Command injection in firewall ip functionality in 1Panel
1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an …
-
Low 2.7
Fides Webserver Vulnerable to Zip Bomb File Uploads
Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit a weakness in the connector template upload f…
-
Low 2.7
Fides Webserver Vulnerable to SVG Bomb File Uploads
Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files contai…
-
Medium 4.7
URL redirection affects BigFix WebUI
URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header.
-
Medium 5.5
An SQL injection affects BigFix WebUI API
Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.
-
High 7.1
WordPress Easy Captcha Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wppal Easy Captcha plugin <= 1.0 versions.
-
Medium 5.5
Iagona ScrutisWeb Use of Hard-coded Cryptographic Key
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a cryptographic vulnerability that could allow an unauthenticated user to decrypt encrypted passwords into plaintext.
-
High 7.5
Iagona ScrutisWeb Absolute Path Traversal
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a directory traversal vulnerability that could allow an unauthenticated user to directly access any file outside the webroot.
-
High 7.5
CVE-2023-38257
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to an insecure direct object reference vulnerability that could allow an unauthenticated user to view profile information, including user login names and encrypted passwords.
-
Medium 5.9
WordPress Custom Post Type Generator Plugin <= 2.4.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Hijiri Custom Post Type Generator plugin <= 2.4.2 versions.
-
Critical 10.0
Iagona ScrutisWeb Unrestricted Upload of File with Dangerous Type
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a remote code execution vulnerability that could allow an unauthenticated user to upload a malicious payload and execute it.
-
High 8.2
Code injection via Dynamic Redfish Extension interface
AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.
-
High 8.4
Authentication Bypass via HTTP Header Spoofing
AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vulnerability may lead to loss of confidentiality, integrity, and availability.
-
Low 2.7
what3words Autosuggest Plugin Setting class-w3w-autosuggest-public.php enqueue_scripts information disclosure
A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the c…
-
Medium 6.1
Cross site scripting in Export Chat feature
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting …
-
Medium 6.1
XSS in SolarWinds Database Performance Analyzer 2023.2
XSS attack was possible in DPA 2023.2 due to insufficient input validation
-
Medium 4.7
Possibility of deadlock in libbpf function sock_hash_delete_elem
A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system.
-
High 7.3CVE-2023-34035 Public exploit
Spring Security's authorization rules can be misconfigured when using multiple servlets
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s Dispatche…
-
High 7.5
Rockwell Automation Kinetix 5700 DC Bus Power Supply Series A – CIP Message Attack Could Cause Denial-Of-Service
The Rockwell Automation Kinetix 5700 DC Bus Power Supply Series A is vulnerable to CIP fuzzing. The new ENIP connections cannot be established if impacted by this vulnerability, which prohibits operational capabilities of the device resulting in a denial-of…
-
Medium 5.5CVE-2020-36762 Public exploit
ONS Digital RAS Collection Instrument comment.yml jobs os command injection
A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the file .github/workflows/comment.yml. The manipulation of the argument $COMMENT_BODY leads to os comma…
-
Medium 5.9
WordPress Event Manager for WooCommerce Plugin <= 3.9.5 is vulnerable to Cross Site Scripting (XSS)
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.9.5 versions.
-
High 7.1
WordPress Booking Calendar Contact Form Plugin <= 1.2.40 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodePeople Booking Calendar Contact Form plugin <= 1.2.40 versions.
-
Medium 5.9
WordPress WeSecur Security Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WeSecur Security plugin <= 1.2.1 versions.
-
Medium 5.9
WordPress ARMember (free) and ARMember (premium) plugins - vulnerable to Auth. Stored Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember (free), Repute InfoSystems ARMember (premium) plugins.
-
High 7.5
The vulnerability could be locally exploited to allow escalation of privilege.
-
High 8.8CVE-2022-34155 Public exploit
WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken Authentication
Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.
-
High 7.1
WordPress Jazz Popups Plugin <= 1.8.7 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CRUDLab Jazz Popups plugin <= 1.8.7 versions.
-
Medium 5.5
Blue Yonder postgraas_server PostgreSQL Backend postgres_cluster_driver.py create_postgres_db sql injection
A vulnerability, which was classified as critical, was found in Blue Yonder postgraas_server up to 2.0.0b2. Affected is the function _create_pg_connection/create_postgres_db of the file postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py of …
-
High 8.5
WordPress MainWP Maintenance Extension Plugin <= 4.1.1 is vulnerable to SQL Injection
Auth. (subscriber+) SQL Injection (SQLi) vulnerability in MainWP MainWP Maintenance Extension plugin <= 4.1.1 versions.
-
Medium 4.3
WordPress Shortcode IMDB Plugin <= 6.0.8 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB plugin <= 6.0.8 versions.