Archive
January 2024
Vulnerabilities first published in this month (UTC), newest first.
2,612 results · Feed
-
High 8.4
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Crestron AM-300
There is an OS command injection vulnerability in Crestron AM-300 firmware version 1.4499.00018 which may enable a user of a limited-access SSH session to escalate their privileges to root-level access.
-
High 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer
A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's …
-
Critical 9.8
SOFARPC Remote Command Execution(RCE) Vulnerbility
SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection.…
-
Medium 6.1
TuiTse-TsuSin html injection vulnerability in `tuitse_html` function
TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using `tuitse_html` with…
-
Medium 5.3
Tuta loads images from external resources
Tuta is an encrypted email service. In versions prior to 119.10, an attacker can attach an image in a html mail which is loaded from external resource in the default setting, which should prevent loading of external resources. When displaying emails containin…
-
Medium 6.1
Whoogle Search Cross-site Scripting vulnerability
Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which sends a `GET` reque…
-
Critical 9.1
Whoogle Search Server Side Request Forgery vulnerability
Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize user-supplied input from the `location` variable and passes it to the `send` method which sends a `GET` request on lines 339-343 in `reques…
-
Medium 5.3
Whoogle Search Limited File Write vulnerability
Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration options in Whoogle are enabled. The `config` function in `app/routes.py` does not validate the user-controlled `name` va…
-
Critical 9.1CVE-2024-22203 Public exploit
Whoogle Search Server Side Request Forgery vulnerability
Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which sends a GET request …
-
Medium 5.5
HPE OneView may have a missing passphrase during restore.
-
High 7.5
HPE OneView may allow clusterService Authentication Bypass resulting in denial of service.
-
High 7.8
HPE OneView may allow command injection with local privilege escalation.
-
Critical 9.6
Apache Superset: Stored XSS in Dashboard Title and Chart Title
A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For …
-
Medium —
Unsound sending of non-Send types across threads in threadalone
Affected versions can run the `Drop` impl of a non-Send type on a different thread than it was created on. The flaw occurs when a stderr write performed by the `threadalone` crate fails, for example because stderr is redirected to a location on a filesystem t…
-
Medium 4.3
No permission checks for editing/deleting records with CSV import form
Silverstripe Admin provides a basic management interface for the Silverstripe Framework. In versions on the 1.x branch prior to 1.13.19 and on the 2.x branch prior to 2.1.8, users who don't have edit or delete permissions for records exposed in a `ModelAdmin`…
-
Medium 4.3
Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter
Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user should not be able to see a record, but that record can be added to a `GridField` using the `GridFieldAd…
-
Medium 6.5
A use-after-free crash could have occurred on macOS if a Firefox update were being applied on a very busy system. This …
-
Medium 6.5
Some WASM source files could have caused a crash when loaded in devtools. This vulnerability affects Firefox < 122.
-
High 8.8
The WebAudio `OscillatorNode` object was susceptible to a stack buffer overflow. This could have led to a potentially e…
-
Medium 4.3
A compromised content process could have updated the document URI. This could have allowed an attacker to set an arbitr…
-
High 7.5
An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability a…
-
High 7.5
In some circumstances, JIT compiled code could have dereferenced a wild pointer value. This could have led to an exploi…
-
High 8.8
Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence…
-
Medium 6.5
In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox…
-
High 8.8
A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, F…
-
High 8.8
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into grantin…
-
Medium 4.3
A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the addre…
-
Medium 6.5
When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have over…
-
Medium 6.5
A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability affects Firefo…
-
Medium 6.5CVE-2024-0741 Public exploit
An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable c…
-
Medium 4.3
It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to…
-
Medium 5.3
Silverstripe GraqhQL's view permissions are bypassed for paginated lists of ORM data
The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations. In versions 4.0.0 prior to 4.3.7 and 5.0.0 prior to 5.1.3, `canView` permission checks are bypassed for ORM data in paginated GraphQL query results where the total number…
-
Medium 4.4
Sticky Buttons <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting
The Sticky Buttons – floating buttons builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via sticky URLs in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for …
-
High 8.8
Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series ve…
-
Medium 5.4
Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series version…
-
High 8.1
Relative path traversal vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series vers…
-
Medium 6.1
Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series version…
-
High 8.8
Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series ve…
-
Medium 6.1
Accelerated Mobile Pages <= 1.0.92.1 - Reflected Cross-Site Scripting
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'disqus_name' parameter in all versions up to, and including, 1.0.92.1 due to insufficient input sanitization and output escaping on the exe…
-
High 7.4
Hitron Systems DVR LGUVR-16H Improper Input Validation Vulnerability
Improper Input Validation in Hitron Systems DVR LGUVR-16H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.