Archive
January 2024
Vulnerabilities first published in this month (UTC), newest first.
2,612 results · Feed
-
High 7.6
Potential authentication and CSRF tokens leak in JupyterLab
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party…
-
Medium 5.3
AWS Encryption SDK for Java Improper Verification of Cryptographic Signature
AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures.
-
High 7.5
SurrealDB vulnerable to Uncontrolled CPU Consumption via WebSocket Interface
SurrealDB depends on the `tungstenite` and `tokio-tungstenite` crates used by the `axum` crate, which handles connections to the SurrealDB WebSocket interface. On versions before `0.20.1`, the `tungstenite` crate presented an issue which allowed the parsing o…
-
Medium 6.3
Smsot get.php sql injection
A vulnerability was found in Smsot up to 2.12. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /get.php. The manipulation of the argument tid leads to sql injection. The attack can be launched remotely.…
-
Medium 6.3
Smsot HTTP POST Request api.php sql injection
A vulnerability was found in Smsot up to 2.12. It has been classified as critical. Affected is an unknown function of the file /api.php of the component HTTP POST Request Handler. The manipulation of the argument data[sign] leads to sql injection. It is possi…
-
Critical 9.8
Enonic XP Session Fixation Vulnerability
Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.
-
Medium 6.1
MolecularFaces XSS
MolecularFaces before 0.3.0 is vulnerable to cross site scripting. A remote attacker can execute arbitrary JavaScript in the context of a victim browser via crafted molfiles.
-
High 8.2
Artemis Java Test Sandbox Class Loading Escape
Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed …
-
Medium 5.5
An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use sys…
-
Medium 6.3
A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical acc…
-
High 7.8
A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integri…
-
Low 3.3
An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to ga…
-
Medium 6.8
A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications ac…
-
Medium 6.7
Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software…
-
Medium 6.7
Incorrect default permissions in some Intel Integrated Sensor Hub (ISH) driver for Windows 10 for Intel NUC P14E Laptop…
-
High 7.3
Improper access control in some Intel HotKey Services for Windows 10 for Intel NUC P14E Laptop Element software install…
-
Medium 6.7
Improper buffer restrictions for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to pote…
-
High 7.9
Uncontrolled search path in some Intel NUC Pro Software Suite Configuration Tool software installers before version 3.0…
-
High 7.5
Improper input validation for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potenti…
-
High 7.5
Improper input validation for some Intel NUC BIOS firmware before version QN0073 may allow a privileged user to potenti…
-
High 7.5
Improper input validation for some Intel NUC BIOS firmware before version JY0070 may allow a privileged user to potenti…
-
High 7.5
Improper input validation in some Intel NUC BIOS firmware may allow a privileged user to potentially enable escalation …
-
High 7.5
Improper input validation in some Intel NUC 8 Compute Element BIOS firmware may allow a privileged user to potentially …
-
High 7.5
Improper buffer restrictions in some Intel NUC BIOS firmware may allow a privileged user to potentially enable escalati…
-
Medium 5.3
PCMan FTP Server STOR Command denial of service
A vulnerability was found in PCMan FTP Server 2.0.7 and classified as problematic. This issue affects some unknown processing of the component STOR Command Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit…
-
Low 3.7
FreeRDP integer Overflow leading to Heap Overflow
FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server imp…
-
Low 3.7
changedetection.io API endpoint is not secured with API token
changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/history` can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch …
-
High 7.5
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is simila…
-
Medium 5.3
PCMan FTP Server PUT Command denial of service
A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as problematic. This vulnerability affects unknown code of the component PUT Command Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploi…
-
Medium 6.3
Project Worlds Online Time Table Generator course_ajax.php sql injection
A vulnerability, which was classified as critical, was found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of the file course_ajax.php. The manipulation of the argument id leads to sql injection. It is possible to initiate th…
-
Medium 5.5
ForU CMS cms_admin.php sql injection
A vulnerability, which was classified as critical, has been found in ForU CMS up to 2020-06-23. Affected by this issue is some unknown functionality of the file cms_admin.php. The manipulation of the argument a_name leads to sql injection. The exploit has bee…
-
Medium 4.7
ForU CMS channel.php file inclusion
A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channel.php. The manipulation of the argument c_cmodel leads to file inclusion. The attack can be launched…
-
Medium 4.3
Project Worlds Student Project Allocation System Admin Login Module admin_login.php cross site scripting
A vulnerability was found in Project Worlds Student Project Allocation System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file admin_login.php of the component Admin Login Module. The manipulation of the argument m…
-
Medium 5.3CVE-2024-0725 Public exploit
ProSSHD denial of service
A vulnerability was found in ProSSHD 1.2 on Windows. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public …
-
Medium 5.3CVE-2024-0723 Public exploit
freeSSHd denial of service
A vulnerability was found in freeSSHd 1.0.9 on Windows. It has been classified as problematic. This affects an unknown part. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the pub…
-
Low 3.5
code-projects Social Networking Site Message Page message.php cross site scripting
A vulnerability was found in code-projects Social Networking Site 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file message.php of the component Message Page. The manipulation of the argument Story leads to cr…
-
Low 3.5
Jspxcms Survey Label cross site scripting
A vulnerability has been found in Jspxcms 10.2.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Survey Label Handler. The manipulation leads to cross site scripting. The attack can be launched remote…
-
Low 3.5
FactoMineR FactoInvestigate HTML Report Generator cross site scripting
A vulnerability, which was classified as problematic, was found in FactoMineR FactoInvestigate up to 1.9. Affected is an unknown function of the component HTML Report Generator. The manipulation leads to cross site scripting. It is possible to launch the atta…
-
Low 2.4
liuwy-dlsdys zhglxt HTTP POST Request edit cross site scripting
A vulnerability, which was classified as problematic, has been found in liuwy-dlsdys zhglxt 4.7.7. This issue affects some unknown processing of the file /oa/notify/edit of the component HTTP POST Request Handler. The manipulation of the argument notifyTitle …
-
Medium 5.3CVE-2024-0717 EPSS 18%
D-Link Good Line Router v2 HTTP GET Request devinfo information disclosure
A vulnerability classified as critical was found in D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR-815AC, DIR-815S, DIR-816, DIR-820, DIR-822, DIR-825, DIR-825AC, DIR-825ACF, DIR-825ACG1, DIR-841, D…