Archive
August 2023
Vulnerabilities first published in this month (UTC), newest first.
2,514 results · Feed
-
Medium 6.3
SourceCodester Inventory Management System search_sales_report.php sql injection
A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file app/ajax/search_sales_report.php. The manipulation of the argument customer lea…
-
Medium 6.3
SourceCodester Inventory Management System search_sell_paymen_report.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file app/ajax/search_sell_paymen_report.php. The manipulation of the argument customer leads to sql injectio…
-
Medium 6.3
SourceCodester Inventory Management System edit_update.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Inventory Management System 1.0. This issue affects some unknown processing of the file app/action/edit_update.php. The manipulation of the argument user_id leads to sql injec…
-
Medium 6.1CVE-2023-4451 Scanner template
Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit
Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
-
High 7.7
Improper Input Validation in hamza417/inure
Improper Input Validation in GitHub repository hamza417/inure prior to build88.
-
Medium 5.1
Missing Authorization in hamza417/inure
Missing Authorization in GitHub repository hamza417/inure prior to build88.
-
Unscored —
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.4…
-
Unscored —
Veilid before 0.1.9 does not check the size of uncompressed data during decompression upon an envelope receipt, which a…
-
Unscored —
In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXml…
-
Unscored —CVE-2023-37250 Public exploit
Unity Parsec has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was in…
-
Unscored —
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and disks…
-
Medium 6.3
Typora Local File Disclosure
Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user opens a malicious markd…
-
High 8.6
MarkText DOM-Based Cross-site Scripting leading to Remote Code Execution
DOM-based XSS in src/muya/lib/contentState/pasteCtrl.js in MarkText 0.17.1 and before on Windows, Linux and macOS allows arbitrary JavaScript code to run in the context of MarkText main window. This vulnerability can be exploited if a user copies text from a …
-
High 8.6
Typora DOM-Based Cross-site Scripting leading to Remote Code Execution
DOM-based XSS in updater/update.html in Typora before 1.6.7 on Windows and Linux allows a crafted markdown file to run arbitrary JavaScript code in the context of Typora main window via loading typora://app/typemark/updater/update.html in <embed> tag. This vu…
-
High 7.4
Typora Local File Disclosure
Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/<absolute-path>". This vulnerability can be exploited if a user opens a malicious mar…
-
High 8.2
Obsidian Local File Disclosure
Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/<absolute-path>". This vulnerability can be exploited if a user opens…
-
High 8.3
Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
-
High 8.3
Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit
Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
-
Medium 6.5CVE-2023-40037 Public exploit
Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs
Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass…
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in fobybus/social-media-skeleton
Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. A Cross-site request forgery (CSRF) attack is a type of malicious attack whereby an attacker tricks a victim into performing an action on…
-
High 7.5
Unsalted passwords in fobybus/social-media-skeleton
Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1.0.5 Social media skeleton did not properly salt passwords leaving user passwords susceptible to cracking should an att…
-
Medium 6.8
Insufficient Session Expiration in fobybus/social-media-skeleton
Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient session expiration is a web application security vulnerability that occurs when a web application does not properly manage t…
-
High 7.3
Inconsistent Interpretation of HTTP Requests in puma
Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Sever…
-
High 7.5
A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of ser…
-
Medium 6.8
Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.
-
High 7.3
Ruijie RG-EW1200G login improper authentication
A vulnerability was found in Ruijie RG-EW1200G 07161417 r483. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/sys/login. The manipulation leads to improper authentication. The attack may be launched remotel…
-
Medium 6.3
Byzoro Smart S85F Management Platform decodmail.php command injection
A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230807. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /log/decodmail.php. The manipulation of the argument file leads to comm…
-
Medium 5.8
WordPress Spiffy Calendar Plugin <= 4.9.3 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Spiffy Plugins Spiffy Calendar plugin <= 4.9.3 versions.
-
Medium 5.9
WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.6 versions.
-
Medium 6.5
WordPress Manager for Icomoon Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Julien Crego Manager for Icomoon plugin <= 2.0 versions.
-
High 7.1
WordPress Albo Pretorio Online Plugin <= 4.6.3 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On line plugin <= 4.6.3 versions.
-
High 7.1
WordPress FV Flowplayer Video Player Plugin <= 7.5.32.7212 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.32.7212 versions.
-
Medium 6.3
TOTOLINK EX1200L setWanCfg os command injection
A vulnerability was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This issue affects the function setWanCfg. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed…
-
High 7.1
WordPress Albo Pretorio Online Plugin <= 4.6.3 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On line plugin <= 4.6.3 versions.
-
Medium 6.3
TOTOLINK EX1200L setTracerouteCfg os command injection
A vulnerability has been found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This vulnerability affects the function setTracerouteCfg. The manipulation leads to os command injection. The attack can be initiated remotely. The exploi…
-
Medium 6.3
TOTOLINK EX1200L setDiagnosisCfg os command injection
A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023. This affects the function setDiagnosisCfg. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit …
-
High 7.1
WordPress Photo Gallery by Ays Plugin <= 5.1.3 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin <= 5.1.3 versions.
-
High 7.1
WordPress WP Docs Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fahad Mahmood WP Docs plugin <= 1.9.9 versions.
-
High 7.1
WordPress WPPizza Plugin <= 3.17.1 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ollybach WPPizza – A Restaurant Plugin plugin <= 3.17.1 versions.
-
Medium 6.5
WordPress TP Education Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Theme Palace TP Education plugin <= 4.4 versions.