Archive
6 February 2024
Vulnerabilities first published on this day (UTC), newest first.
156 results · Feed
-
Medium 6.5
A SQL injection vulnerability exists where an authenticated, low-privileged remote attacker could potentially alter sca…
-
Medium 4.8
Stored XSS vulnerability
A stored XSS vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus proxy settings, which could lead to the execution of remote arbitrary scripts.
-
Medium 6.3
Juanpao JPShop UploadsController.php actionUpdate unrestricted upload
A vulnerability has been found in Juanpao JPShop up to 1.5.02 and classified as critical. Affected by this vulnerability is the function actionUpdate of the file /api/controllers/common/UploadsController.php. The manipulation of the argument imgage leads to u…
-
High 8.8CVE-2024-1283 EPSS 22%
Heap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit …
-
Critical 9.8
Use after free in Mojo in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap c…
-
Medium 5.9
Insecure Default Initialization of Resource in HID Global
Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys.
-
Medium 6.3
Juanpao JPShop API PosterController.php actionUpdate unrestricted upload
A vulnerability, which was classified as critical, was found in Juanpao JPShop up to 1.5.02. Affected is the function actionUpdate of the file /api/controllers/merchant/shop/PosterController.php of the component API. The manipulation of the argument pic_url l…
-
Medium 6.3
Juanpao JPShop API MaterialController.php actionUpdate unrestricted upload
A vulnerability, which was classified as critical, has been found in Juanpao JPShop up to 1.5.02. This issue affects the function actionUpdate of the file /api/controllers/merchant/design/MaterialController.php of the component API. The manipulation of the ar…
-
Medium 6.3
Juanpao JPShop API ComboController.php actionIndex unrestricted upload
A vulnerability classified as critical was found in Juanpao JPShop up to 1.5.02. This vulnerability affects the function actionIndex of the file /api/controllers/merchant/app/ComboController.php of the component API. The manipulation of the argument pic_url l…
-
Medium 5.4
Westermo Lynx
An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter.
-
High 8.0
Westermo Lynx Code Injection
A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device.
-
Medium 5.4
Westermo Lynx Cross-site Scripting
An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "autorefresh" parameter.
-
Medium 6.6
Westermo Lynx Permissive Cross-domain Policy with Untrusted Domains
A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the device.
-
High 8.6
libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add`
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be lev…
-
Medium 5.4
Westermo Lynx Cross-site Scripting
An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username" parameter in the SNMP configuration.
-
Medium 6.3
Juanpao JPShop API ComboController.php actionIndex unrestricted upload
A vulnerability classified as critical has been found in Juanpao JPShop up to 1.5.02. This affects the function actionIndex of the file /api/controllers/admin/app/ComboController.php of the component API. The manipulation of the argument pic_url leads to unre…
-
High 7.5
libgit2 is vulnerable to a denial of service attack in `git_revparse_single`
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_revparse_single` can cause the function to enter an in…
-
Medium 5.7
Westermo Lynx Cleartext Transmission of Sensitive Information
An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive information exchanged via TCP communications.
-
Medium 5.4
Westermo Lynx Cross-site Scripting
An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter.
-
High 8.0
Westermo Lynx 206-F2G Cross-Site Request Forgery
The cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which could be triggered by a victim unknowingly. In a successful CSRF attack, the attacker could lead the victim user …
-
Medium 6.3
Juanpao JPShop API AppController.php unrestricted upload
A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/controllers/admin/app/AppController.php of the component API. The manipulation of the argument app_p…
-
Low 3.1
Juanpao JPShop API params.php hard-coded key
A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file api/config/params.php of the component API. The manipulation of the argument JWT_KEY_ADMIN le…
-
Low 3.5
Jspxcms find_text.do cross site scripting
A vulnerability was found in Jspxcms 10.2.0. It has been classified as problematic. Affected is an unknown function of the file /ext/collect/find_text.do. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploi…
-
Medium 4.3CVE-2024-22241 EPSS 38%
Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can…
-
Medium 4.9
Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may expl…
-
Medium 5.3
Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Op…
-
Medium 6.4
Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may…
-
High 7.8
Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Op…
-
Low 3.5
Jspxcms filter_text.do cross site scripting
A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. This issue affects some unknown processing of the file /ext/collect/filter_text.do. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit ha…
-
Medium 5.3
sepidz SepidzDigitalMenu Waiters information disclosure
A vulnerability has been found in sepidz SepidzDigitalMenu up to 7.1.0728.1 and classified as problematic. This vulnerability affects unknown code of the file /Waiters. The manipulation leads to information disclosure. The attack can be initiated remotely. Th…
-
Medium 4.7
Byzoro Smart S20 Management Platform sysmanageajax.php sql injection
A vulnerability, which was classified as critical, was found in Byzoro Smart S20 Management Platform up to 20231120. This affects an unknown part of the file /sysmanage/sysmanageajax.php. The manipulation of the argument id leads to sql injection. It is possi…
-
Low 3.3
Grub2: grub2-set-bootflag can be abused by local (pseudo-)users
A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename o…
-
High 8.8
PingFederate OAuth client_secret_jwt Authentication Bypass
Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.
-
Medium 4.7
Byzoro Smart S40 Management Platform Import web.php unrestricted upload
A vulnerability, which was classified as critical, has been found in Byzoro Smart S40 Management Platform up to 20240126. Affected by this issue is some unknown functionality of the file /useratte/web.php of the component Import Handler. The manipulation of t…
-
Medium 5.5
Tongda OA 2017 delete.php sql injection
A vulnerability classified as critical was found in Tongda OA 2017 up to 11.9. Affected by this vulnerability is an unknown functionality of the file /general/attendance/manage/ask_duty/delete.php. The manipulation of the argument ASK_DUTY_ID leads to sql inj…
-
High 7.2
A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada G…
-
High 7.2CVE-2023-43482 Public exploit
A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router…
-
High 7.2
A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada …
-
High 7.2
A post authentication command injection vulnerability exists in the GRE policy functionality of Tp-Link ER7206 Omada Gi…
-
High 7.2
A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Lin…