Archive
14 August 2023
Vulnerabilities first published on this day (UTC), newest first.
136 results · Feed
-
Unscored —
In multiple locations, there is a possible way to obscure the microphone privacy indicator due to a logic error in the …
-
Unscored —
In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission che…
-
Unscored —
In writeToParcel of CursorWindow.cpp, there is a possible information disclosure due to uninitialized data. This could …
-
Unscored —CVE-2023-21275 Public exploit
In decideCancelProvisioningDialog of AdminIntegratedFlowPrepareActivity.java, there is a possible way to bypass factory…
-
Unscored —
In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. T…
-
Unscored —
In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check. This could …
-
Unscored —CVE-2023-21272 Public exploit
In readFrom of Uri.java, there is a possible bad URI permission grant due to improper input validation. This could lead…
-
Unscored —
In parseInputs of ShimPreparedModel.cpp, there is a possible out of bounds read due to improper input validation. This …
-
Unscored —
In startActivityInner of ActivityStarter.java, there is a possible way to launch an activity into PiP mode from the bac…
-
Unscored —
In update of MmsProvider.java, there is a possible way to change directory permissions due to a path traversal error. T…
-
Unscored —
In multiple functions of KeyguardViewMediator.java, there is a possible way to bypass lockdown mode with screen pinning…
-
High 7.5
In multiple locations, there are root CA certificates which need to be disabled. This could lead to remote information …
-
Unscored —
In multiple functions of mem_protect.c, there is a possible way to access hypervisor memory due to a memory access chec…
-
Unscored —
In isServerCertChainValid of InsecureEapNetworkHandler.java, there is a possible way to trust an imposter server due to…
-
Medium 6.8
In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a mis…
-
Medium 6.8
In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a mis…
-
Medium 6.8
In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a mis…
-
Medium 6.8
In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a mis…
-
Critical 9.8
In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic…
-
Medium 5.4
Execution of arbitrary JavaScript from Svelecte item names
Svelecte is a flexible autocomplete/select component written in Svelte. Svelecte item names are rendered as raw HTML with no escaping. This allows the injection of arbitrary HTML into the Svelecte dropdown. This can be exploited to execute arbitrary JavaScrip…
-
Medium 6.1
Insufficient input validation in efibootguard
efibootguard is a simple UEFI boot loader with support for safely switching between current and updated partition sets. Insufficient or missing validation and sanitization of input from untrustworthy bootloader environment files can cause crashes and probably…
-
High 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in external-svg-loader
SVG Loader is a javascript library that fetches SVGs using XMLHttpRequests and injects the SVG code in the tag's place. According to the docs, svg-loader will strip all JS code before injecting the SVG file for security reasons but the input sanitization logi…
-
Critical 9.9
Improper Authentication in PrivateUploader
PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions `app/routes/v3/admin.controller.ts` did not correctly verify whether the user was an administrator (High Level) or moderator (Low Level) causing the req…
-
Medium 6.5
Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading
yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion (LFI) vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web applica…
-
Medium 5.4
Reflected Cross-Site Scripting (XSS) in scancode.io license endpoint
ScanCode.io is a server to script and automate software composition analysis pipelines. In the `/license/` endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting (XSS) vulnerability when a…
-
Unscored —
WP Brutal AI < 2.06 - Admin+ Stored XSS
The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for ex…
-
Unscored —
Custom Field For WP Job Manager < 1.2 - Admin+ Stored XSS
The Custom Field For WP Job Manager WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is …
-
Medium 4.3
Simple Author Box < 2.52 - Contributor+ Arbitrary User Information Disclosure via IDOR
The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbitrary user information disclosure to users with a role as low as Contributor.
-
Unscored —
Ultimate Addons for Contact Form 7 < 3.1.29 - Admin+ Stored XSS
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capabili…
-
Unscored —
User Activity Log < 1.6.5 - Unauthenticated SQLi
The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks.
-
Unscored —CVE-2022-4953 Public exploit
Elementor < 3.5.5 - Iframe Injection
The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.
-
Unscored —
Ultimate Addons for Contact Form 7 < 3.1.29 - Reflected XSS
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
-
Unscored —
Contact Form Builder by Bit Form < 2.2.0 - Admin+ Stored XSS
The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability …
-
Medium 4.8
WP-EMail < 2.69.1 - Admin+ Stored Cross-Site Scripting
The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for exam…
-
Medium 6.7
Reflected XSS in multiple JSP files in opennms/opennms
Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that an attacker can modify to craft a malicious XSS payload. The solution is to upgrade to M…
-
Medium 6.7
Stored XSS in multiple JSP files in opennms/opennms
Multiple stored XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that allow an attacker to store on database and then load on JSPs or Angular templates. The solu…
-
High 8.4
IBM i privilege escalation
The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability. A malicious actor could gain access to a command line with elevated privileges allowing root access to the host operating system. IBM X-Force…
-
High 8.2CVE-2023-0872 Public exploit
ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users
The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizo…
-
High 7.5
IBM TXSeries for Multiplatforms denial of service
IBM TXSeries for Multiplatforms 8.1, 8.2, and 9.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting a slowloris-type attacks, a remote attacker could exploit this vulnerability to …
-
High 8.8
A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01(ABIR.1…