Archive
August 2023
Vulnerabilities first published in this month (UTC), newest first.
2,514 results · Feed
-
Unscored —
There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Callback Widge…
-
Unscored —
There is a Cross Site Scripting (XSS) vulnerability in the value-enum-o_bf_include_timezone parameter of index.php in P…
-
Unscored —
OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause…
-
Unscored —
HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, …
-
Unscored —
MISP 2.4.174 allows XSS in app/View/Events/index.ctp.
-
Unscored —
An NTLM Hash Disclosure was discovered in ArchiMate Archi before 5.1.0. When parsing the XMLNS value of an ArchiMate pr…
-
Unscored —CVE-2023-37625 Public exploit
A stored cross-site scripting (XSS) vulnerability in Netbox v3.4.7 allows attackers to execute arbitrary web scripts or…
-
Unscored —
Code-Projects Online Hospital Management System V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an atta…
-
Unscored —
Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a modified local_graph_id…
-
Unscored —
EZ softmagic MP3 Audio Converter 2.7.3.700 was discovered to contain a buffer overflow.
-
Unscored —CVE-2022-47636 Public exploit
A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user ope…
-
Critical 9.6CVE-2023-33242 Public exploit
Lindell17 TSS Abort Mishandling
Crypto wallets implementing the Lindell17 TSS protocol might allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every signature attempt (256 in total) because of not adhering to the paper's security proof's assumption rega…
-
Critical 9.6
GG18 / GG20 TSS Beta Parameter Vulnerability
Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation,…
-
High 8.1
Unsanitized user controlled input in module generation
## Impact The `import-in-the-middle` loader used by `@opentelemetry/instrumentation` works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. It allows for remote code execu…
-
Medium —
Blst has logical error in SigValidate in Go bindings
### Impact Blst versions v0.3.0 through 0.3.10 failed to perform a signature group-check if the call to `SigValidate` in the Go bindings was complemented with a check for infinity. Formally speaking, infinity, or the identity element of the elliptic curve gro…
-
Medium 6.4
Use of a broken cryptographic algorithm affects HCL DRYiCE iAutomate
HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
-
Medium 6.4
Use of a broken cryptographic algorithm affects HCL DRYiCE MyCloud
HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
-
High 8.8
A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized use…
-
High 8.8
A SQL injection vulnerability exists in the “message viewer iframe” feature of the ScienceLogic SL1 that takes unsaniti…
-
High 8.8
A SQL injection vulnerability exists in the “message viewer print” feature of the ScienceLogic SL1 that takes unsanitiz…
-
High 8.8
A SQL injection vulnerability exists in the “network print report” feature of the ScienceLogic SL1 that takes unsanitiz…
-
High 8.8
A SQL injection vulnerability exists in the “notes view” feature of the ScienceLogic SL1 that takes unsanitized user‐co…
-
High 8.8
A SQL injection vulnerability exists in the “reporter events type” feature of the ScienceLogic SL1 that takes unsanitiz…
-
High 8.8
A SQL injection vulnerability exists in the “reporter events type date” feature of the ScienceLogic SL1 that takes unsa…
-
High 8.8
A SQL injection vulnerability exists in the “ticket event report” feature of the ScienceLogic SL1 that takes unsanitize…
-
High 8.8
A SQL injection vulnerability exists in the “ticket queue watchers” feature of the ScienceLogic SL1 that takes unsaniti…
-
High 8.8
A SQL injection vulnerability exists in the “ticket template watchers” feature of the ScienceLogic SL1 that takes unsan…
-
High 8.8
A SQL injection vulnerability exists in the “ticket watchers email” feature of the ScienceLogic SL1 that takes unsaniti…
-
High 8.8
A SQL injection vulnerability exists in the “topology data service” feature of the ScienceLogic SL1 that takes unsaniti…
-
High 8.8
A SQL injection vulnerability exists in the vendor_country parameter of the “vendor print report” feature of the Scienc…
-
High 8.8
A SQL injection vulnerability exists in the vendor_state parameter of the “vendor print report” feature of the ScienceL…
-
High 8.8
A SQL injection vulnerability exists in the “admin dynamic app mib errors” feature of the ScienceLogic SL1 that takes u…
-
High 8.8
A SQL injection vulnerability exists in the “reporting job editor” feature of the ScienceLogic SL1 that takes unsanitiz…
-
High 8.8
A SQL injection vulnerability exists in the “schedule editor decoupled” feature of the ScienceLogic SL1 that takes unsa…
-
High 8.8
A SQL injection vulnerability exists in the “schedule editor” feature of the ScienceLogic SL1 that takes unsanitized us…
-
High 8.8
A SQL injection vulnerability exists in the “json walker” feature of the ScienceLogic SL1 that takes unsanitized user‐c…
-
High 8.8
A SQL injection vulnerability exists in the “admin brand portal” feature of the ScienceLogic SL1 that takes unsanitized…
-
High 8.8
A command injection vulnerability exists in the download and convert report feature of the ScienceLogic SL1 that takes …
-
High 8.8
A command injection vulnerability exists in the dashboard scheduler feature of the ScienceLogic SL1 that takes unsaniti…
-
High 8.8
A command injection vulnerability exists in the ticket report generate feature of the ScienceLogic SL1 that takes unsan…