Archive
8 January 2024
Vulnerabilities first published on this day (UTC), newest first.
197 results · Feed
-
Medium 5.4
Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not saniti…
-
High 8.1
User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing …
-
High 7.3
Kashipara Dynamic Lab Management System admin_login_process.php sql injection
A vulnerability was found in Kashipara Dynamic Lab Management System up to 1.0. It has been classified as critical. This affects an unknown part of the file /admin/admin_login_process.php. The manipulation of the argument admin_password leads to sql injection…
-
High 7.6
The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to a…
-
Medium 5.4
The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure u…
-
High 8.8
A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as t…
-
Medium 5.3
Guangzhou Yingke Electronic Technology Ncast Guest Login IPSetup.php information disclosure
A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. The manipulation leads to in…
-
Medium 6.3
Youke365 collect.php server-side request forgery
A vulnerability has been found in Youke365 up to 1.5.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/collect.php. The manipulation of the argument url leads to server-side request forger…
-
Medium 6.3
Youke365 Parameter caiji.php server-side request forgery
A vulnerability, which was classified as critical, was found in Youke365 up to 1.5.3. Affected is an unknown function of the file /app/api/controller/caiji.php of the component Parameter Handler. The manipulation of the argument url leads to server-side reque…
-
Medium 6.3
fhs-opensource iparking vueLogin deserialization
A vulnerability, which was classified as critical, has been found in fhs-opensource iparking 1.5.22.RELEASE. This issue affects some unknown processing of the file /vueLogin. The manipulation leads to deserialization. The attack may be initiated remotely. The…
-
Medium 6.3
fhs-opensource iparking PayTempOrderAction.java getData sql injection
A vulnerability classified as critical was found in fhs-opensource iparking 1.5.22.RELEASE. This vulnerability affects the function getData of the file src/main/java/com/xhb/pay/action/PayTempOrderAction.java. The manipulation leads to sql injection. The atta…
-
Medium 6.3
Byzoro Smart S150 Management Platform HTTP POST Request userattestation.php unrestricted upload
A vulnerability was found in Byzoro Smart S150 Management Platform up to 20240101. It has been rated as critical. Affected by this issue is some unknown functionality of the file /useratte/userattestation.php of the component HTTP POST Request Handler. The ma…
-
High 7.3
Totolink N200RE cstecgi.cgi setTracerouteCfg os command injection
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been declared as critical. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to os comman…
-
High 7.3
Totolink N200RE cstecgi.cgi setDiagnosisCfg os command injection
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. Affected is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possibl…
-
High 7.3
Totolink N200RE cstecgi.cgi UploadFirmwareFile os command injection
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This issue affects the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The at…
-
High 7.3
Totolink N200RE cstecgi.cgi NTPSyncWithHost os command injection
A vulnerability has been found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This vulnerability affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument host_time leads to os command inject…
-
High 7.3
Totolink LR1200GB cstecgi.cgi setWanCfg os command injection
A vulnerability, which was classified as critical, was found in Totolink LR1200GB 9.1.0u.6619_B20230130. This affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possi…
-
High 7.3
Totolink LR1200GB cstecgi.cgi setUssd os command injection
A vulnerability, which was classified as critical, has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected by this issue is the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to os command injection.…
-
Medium 6.3
Totolink LR1200GB cstecgi.cgi setUploadSetting os command injection
A vulnerability classified as critical was found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected by this vulnerability is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command inject…
-
Medium 4.0
IBM CICS Transaction Gateway improper access controls
IBM CICS Transaction Gateway 9.3 could allow a user to transfer or view files due to improper access controls.
-
Medium 6.3
Totolink LR1200GB cstecgi.cgi setOpModeCfg os command injection
A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected is the function setOpModeCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possible t…
-
Medium 6.5
IBM Storage Fusion HCI information disclosure
IBM Storage Fusion HCI 2.1.0 through 2.6.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force I…
-
Low 3.5
Chanzhaoyu chatgpt-web cross site scripting
A vulnerability, which was classified as problematic, has been found in Chanzhaoyu chatgpt-web 2.11.1. This issue affects some unknown processing. The manipulation of the argument Description with the input <image src onerror=prompt(document.domain)> leads to…
-
Medium 6.3
Totolink LR1200GB cstecgi.cgi UploadFirmwareFile command injection
A vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been rated as critical. This issue affects the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to command injection. The…
-
Medium 6.3
Kashipara Food Management System stock_edit.php sql injection
A vulnerability, which was classified as critical, has been found in Kashipara Food Management System 1.0. This issue affects some unknown processing of the file stock_edit.php. The manipulation of the argument item_type leads to sql injection. The attack may…
-
Medium 6.3
Kashipara Food Management System stock_entry_submit.php sql injection
A vulnerability classified as critical was found in Kashipara Food Management System 1.0. This vulnerability affects unknown code of the file stock_entry_submit.php. The manipulation of the argument itemype leads to sql injection. The attack can be initiated …
-
High 7.2
SQL injection vulnerability in EmpireCMS v7.5, allows remote attackers to execute arbitrary code and obtain sensitive i…
-
Critical 9.0
Stud.IP 5.x through 5.3.3 allows XSS with resultant upload of executable files, because upload_action and edit_action i…
-
Medium 6.1
easyXDM 2.5 allows XSS via the xdm_e parameter.
-
High 8.8
FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/config_footer_…
-
High 8.8
FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/userconfig_upd…
-
Medium 6.5CVE-2023-52271 Public exploit
The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process…
-
High 8.8
FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component system/site/webconfig_updag…
-
Medium 5.4
A Cross Site Scripting (XSS) vulnerability in GetSimple CMS 3.3.16 exists when using Source Code Mode as a backend user…
-
High 8.8
Download to arbitrary folder can lead to RCE
pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.
-
High 7.5
WALLIX Bastion 7.x, 8.x, 9.x and 10.x and WALLIX Access Manager 3.x and 4.x have Incorrect Access Control which can lea…
-
Critical 9.8
In default installations of Microchip maxView Storage Manager (for Adaptec Smart Storage Controllers) where Redfish ser…