Archive
9 December 2023
Vulnerabilities first published on this day (UTC), newest first.
24 results · Feed
-
Low 3.5
linkding cross site scripting
A vulnerability classified as problematic has been found in linkding 1.23.0. Affected is an unknown function. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the…
-
Medium 4.1
Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversal
The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the upload_certificate_file function. This makes it possible for administrators to upload .pem or .crt files to arbitrary location…
-
Medium 5.4
Digital Publications by Supsystic <= 1.7.6 - Cross-Site Request Forgery via AJAX action
The Digital Publications by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthe…
-
Medium 6.2
IBM API Connect information disclosure
IBM API Connect V10.0.5.3 and V10.0.6.0 stores user credentials in browser cache which can be read by a local user. IBM X-Force ID: 271912.
-
High 8.4
IBM Informix Dynamic Server buffer overflow
IBM Informix Dynamic Server 12.10 and 14.10 onsmsync is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow an attacker to execute arbitrary code. IBM X-Force ID: 250753.
-
Medium 6.2
IBM Informix Dynamic Server buffer overflow
IBM Informix Dynamic Server 12.10 and 14.10 archecker is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local user to cause a segmentation fault. IBM X-Force ID: 251204.
-
Medium 6.2
IBM Informix Dynamic Server buffer overflow
IBM Informix Dynamic Server 12.10 and 14.10 cdr is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local user to cause a segmentation fault. IBM X-Force ID: 251206.
-
Medium 5.9
Micro Focus ArcSight Management Center Remote Vulnerability
A potential vulnerability has been identified in Micro Focus ArcSight Management Center. The vulnerability could be remotely exploited resulting in stored Cross-Site Scripting (XSS).
-
High 7.4
Quarkus: graphql operations over websockets bypass
A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an…
-
High 8.8
Local Privilege Escalation in pyinstaller on Windows
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise…
-
Unscored —
In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by ob…
-
Unscored —
sec_attest_info in drivers/accel/habanalabs/common/habanalabs_ioctl.c in the Linux kernel through 6.6.5 allows an infor…
-
Unscored —
IzyBat Orange casiers before 20230803_1 allows getEnsemble.php ensemble SQL injection.
-
Unscored —
The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection P…
-
Unscored —
The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sit…
-
Unscored —
Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry information of the ope…
-
Unscored —
Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers read the contents of arbitrary files on…
-
Unscored —
Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operat…
-
Unscored —
An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown edit…
-
Unscored —
Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to…
-
Critical 9.8
Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitr…
-
Unscored —
An issue in GPAC v.2.2.1 and before allows a local attacker to cause a denial of service (DoS) via the ctts_box_read fu…
-
Unscored —
An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbi…
-
Unscored —
SyncTrayzor 1.1.29 enables CEF (Chromium Embedded Framework) remote debugging, allowing a local attacker to control the…