Archive
16 January 2024
Vulnerabilities first published on this day (UTC), newest first.
120 results · Clear filters · Feed
-
Medium 4.9
Broken Access Control order API in Shopware
Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users…
-
Medium 6.5CVE-2024-22411 Public exploit
Cross site scripting in Action messages on Avo
Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appear…
-
Medium 6.5
Ursa CL-Signatures Revocation allows verifiers to generate unique identifiers for holders
Ursa is a cryptographic library for use with blockchains. The revocation scheme that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model. Notably, a malicio…
-
Medium 6.5
CL-Signatures Revocation Scheme in Ursa has flaws that allow a holder to demonstrate non-revocation of a revoked credential
Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model, allowing a malicio…
-
Medium 5.4
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). The supported version tha…
-
Medium 6.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affecte…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…
-
Medium 5.4
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that a…
-
Medium 6.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 6.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 6.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 5.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…
-
Medium 5.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 6.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions…
-
Medium 4.4
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported versio…
-
Medium 6.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 6.1
Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result)…
-
Medium 5.5
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affect…
-
Medium 6.1
Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Setup, Admin). Supporte…
-
Medium 5.4
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported ver…
-
Medium 6.1
Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Create, Update, Authori…
-
Medium 6.1
Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: ECC). Supported versions that are aff…
-
Medium 6.1
Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle Supply Chain (component: LOV). …
-
Medium 6.1
Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). Supported…
-
Medium 6.3
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Content Access SDK, I…
-
Medium 6.1
Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). Su…
-
Medium 6.1
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supp…
-
Medium 5.9
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 6.1
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI). The supported…
-
Medium 4.8
Vulnerability in the Integrated Lights Out Manager (ILOM) product of Oracle Systems (component: System Management). Sup…
-
Medium 5.0
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Pod Admin)…
-
Medium 6.3
ZhongFuCheng3y Austin Email Message Template AustinFileUtils.java getRemoteUrl2File server-side request forgery
A vulnerability was found in ZhongFuCheng3y Austin 1.0. It has been rated as critical. Affected by this issue is the function getRemoteUrl2File of the file src\main\java\com\java3y\austin\support\utils\AustinFileUtils.java of the component Email Message Templ…
-
Medium 6.3
readthedocs-sphinx-search vulnerable to cross-site scripting when including search results from malicious projects
### Impact This vulnerability could have allowed an attacker to include arbitrary HTML content in search results by having a user search a malicious project. This was due to our search client not correctly escaping all user content from search results. You ca…
-
Medium 6.4
Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on Windows allows…
-
Medium 5.3
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in HYPR Workforce Access on Windo…
-
Medium 6.5
Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server
An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. This vulnerability affected all versions of GitHub Enterprise Server and was fixed…
-
Medium 5.3
Integration Objects OPC UA Server Toolkit Improper Output Neutralization for Logs
OPCUAServerToolkit will write a log message once an OPC UA client has successfully connected containing the client's self-defined description field.