Archive
9 January 2024
Vulnerabilities first published on this day (UTC), newest first.
62 results · Clear filters · Feed
-
Medium 5.5
PHPGurukul Dairy Farm Shop Management System add-category.php sql injection
A vulnerability, which was classified as critical, was found in PHPGurukul Dairy Farm Shop Management System up to 1.1. Affected is an unknown function of the file add-category.php. The manipulation of the argument category leads to sql injection. The exploit…
-
Medium 5.3
unknown-o download-station index.php path traversal
A vulnerability, which was classified as critical, has been found in unknown-o download-station up to 1.1.8. This issue affects some unknown processing of the file index.php. The manipulation of the argument f leads to path traversal: '../filedir'. The attack…
-
Medium 5.3
HTML injection in email body through email subject
Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inapprop…
-
Medium 4.3
SourceCodester Engineers Online Portal File Upload resource consumption
A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been classified as problematic. Affected is an unknown function of the component File Upload Handler. The manipulation leads to resource consumption. It is possible to launch the …
-
Medium 6.5
Cri-o: pods are able to break out of resource confinement on cgroupv2
A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of servi…
-
Medium 4.3
CodeAstro Vehicle Booking System User Registration usr-register.php cross site scripting
A vulnerability, which was classified as problematic, was found in CodeAstro Vehicle Booking System 1.0. This affects an unknown part of the file usr/usr-register.php of the component User Registration. The manipulation of the argument Full_Name/Last_Name/Add…
-
Medium 5.5
soxft TimeMail check.php sql injection
A vulnerability, which was classified as critical, has been found in soxft TimeMail up to 1.1. Affected by this issue is some unknown functionality of the file check.php. The manipulation of the argument c leads to sql injection. The exploit has been disclose…
-
Medium 4.3
CodeAstro Simple House Rental System Login Panel cross site scripting
A vulnerability classified as problematic was found in CodeAstro Simple House Rental System 5.6. Affected by this vulnerability is an unknown functionality of the component Login Panel. The manipulation leads to cross site scripting. The attack can be launche…
-
Medium 6.3
Inis Sqlite.php sql injection
A vulnerability classified as critical has been found in Inis up to 2.0.1. Affected is an unknown function of the file /app/api/controller/default/Sqlite.php. The manipulation of the argument sql leads to sql injection. The exploit has been disclosed to the p…
-
Medium 4.3
Parsing JSON serialized payload without protected field can lead to segfault
jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereferenc…
-
Medium 4.4
Insertion of Sensitive Information into Log File in react-native-mmkv
react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone …
-
Medium 6.8
Microsoft Identity Denial of service vulnerability
Microsoft Identity Denial of service vulnerability
-
Medium 6.5
Windows Themes Spoofing Vulnerability
Windows Themes Spoofing Vulnerability
-
Medium 6.5
Microsoft Message Queuing Information Disclosure Vulnerability
Microsoft Message Queuing Information Disclosure Vulnerability
-
Medium 5.5
Windows Cryptographic Services Information Disclosure Vulnerability
Windows Cryptographic Services Information Disclosure Vulnerability
-
Medium 5.7CVE-2024-21306 Public exploit
Microsoft Bluetooth Driver Spoofing Vulnerability
Microsoft Bluetooth Driver Spoofing Vulnerability
-
Medium 5.7
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
-
Medium 6.1
Windows Server Key Distribution Service Security Feature Bypass
Windows Server Key Distribution Service Security Feature Bypass
-
Medium 6.5
Microsoft Message Queuing Information Disclosure Vulnerability
Microsoft Message Queuing Information Disclosure Vulnerability
-
Medium 6.5
Windows Message Queuing Client (MSMQC) Information Disclosure
Windows Message Queuing Client (MSMQC) Information Disclosure
-
Medium 4.9
Windows Online Certificate Status Protocol (OCSP) Information Disclosure Vulnerability
Windows Online Certificate Status Protocol (OCSP) Information Disclosure Vulnerability
-
Medium 6.5
Microsoft Message Queuing Information Disclosure Vulnerability
Microsoft Message Queuing Information Disclosure Vulnerability
-
Medium 6.6
Microsoft Online Certificate Status Protocol (OCSP) Remote Code Execution Vulnerability
Microsoft Online Certificate Status Protocol (OCSP) Remote Code Execution Vulnerability
-
Medium 5.3
Windows TCP/IP Information Disclosure Vulnerability
Windows TCP/IP Information Disclosure Vulnerability
-
Medium 4.4CVE-2024-21305 Public exploit
Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
-
Medium 5.5
Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability
-
Medium 5.5
Windows CoreMessaging Information Disclosure Vulnerability
Windows CoreMessaging Information Disclosure Vulnerability
-
Medium 6.5
Windows Nearby Sharing Spoofing Vulnerability
Windows Nearby Sharing Spoofing Vulnerability
-
Medium 4.7
Windows Themes Information Disclosure Vulnerability
Windows Themes Information Disclosure Vulnerability
-
Medium 6.5
Windows Message Queuing Client (MSMQC) Information Disclosure
Windows Message Queuing Client (MSMQC) Information Disclosure
-
Medium 6.6CVE-2024-20666 Public exploit
BitLocker Security Feature Bypass Vulnerability
BitLocker Security Feature Bypass Vulnerability
-
Medium 4.8
Stored Cross-Site Scripting in Synopsys Seeker
Synopsys Seeker versions prior to 2023.12.0 are vulnerable to a stored cross-site scripting vulnerability through a specially crafted payload.
-
Medium 4.4
Kernel: information disclosure in vhost/vhost.c:vhost_new_msg()
A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This issu…
-
Medium 4.3
Denial of Service of an Investigation in Splunk Enterprise Security through Investigation attachments
In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigation. The attachment endpoint does not properly limit the size of the request which lets an attacker ca…
-
Medium 6.5
Denial of Service in Splunk Enterprise Security of the Investigations manager through Investigation creation
In Splunk Enterprise Security (ES) versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service (DoS). The malformed investigation prevents the generation and rendering of the Investigations manager until it is de…
-
Medium 6.5
POLY1305 MAC implementation corrupts vector registers on PowerPC
Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker ca…
-
Medium 5.3
Totolink T6 cstecgi.cgi access control
A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923. This affects an unknown part of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to improper access control…
-
Medium 6.6
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.20), CP-8050 MASTER MODULE (All…
-
Medium 4.6
In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible
-
Medium 5.7
Possible XXE vulnerability in Jenkins Plugin for Qualys Web Application Security
Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access …