Archive
6 February 2024
Vulnerabilities first published on this day (UTC), newest first.
68 results · Clear filters · Feed
-
Medium 6.5
A SQL injection vulnerability exists where an authenticated, low-privileged remote attacker could potentially alter sca…
-
Medium 4.8
Stored XSS vulnerability
A stored XSS vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus proxy settings, which could lead to the execution of remote arbitrary scripts.
-
Medium 6.3
Juanpao JPShop UploadsController.php actionUpdate unrestricted upload
A vulnerability has been found in Juanpao JPShop up to 1.5.02 and classified as critical. Affected by this vulnerability is the function actionUpdate of the file /api/controllers/common/UploadsController.php. The manipulation of the argument imgage leads to u…
-
Medium 5.9
Insecure Default Initialization of Resource in HID Global
Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys.
-
Medium 6.3
Juanpao JPShop API PosterController.php actionUpdate unrestricted upload
A vulnerability, which was classified as critical, was found in Juanpao JPShop up to 1.5.02. Affected is the function actionUpdate of the file /api/controllers/merchant/shop/PosterController.php of the component API. The manipulation of the argument pic_url l…
-
Medium 6.3
Juanpao JPShop API MaterialController.php actionUpdate unrestricted upload
A vulnerability, which was classified as critical, has been found in Juanpao JPShop up to 1.5.02. This issue affects the function actionUpdate of the file /api/controllers/merchant/design/MaterialController.php of the component API. The manipulation of the ar…
-
Medium 6.3
Juanpao JPShop API ComboController.php actionIndex unrestricted upload
A vulnerability classified as critical was found in Juanpao JPShop up to 1.5.02. This vulnerability affects the function actionIndex of the file /api/controllers/merchant/app/ComboController.php of the component API. The manipulation of the argument pic_url l…
-
Medium 5.4
Westermo Lynx
An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter.
-
Medium 5.4
Westermo Lynx Cross-site Scripting
An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "autorefresh" parameter.
-
Medium 6.6
Westermo Lynx Permissive Cross-domain Policy with Untrusted Domains
A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the device.
-
Medium 5.4
Westermo Lynx Cross-site Scripting
An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username" parameter in the SNMP configuration.
-
Medium 6.3
Juanpao JPShop API ComboController.php actionIndex unrestricted upload
A vulnerability classified as critical has been found in Juanpao JPShop up to 1.5.02. This affects the function actionIndex of the file /api/controllers/admin/app/ComboController.php of the component API. The manipulation of the argument pic_url leads to unre…
-
Medium 5.7
Westermo Lynx Cleartext Transmission of Sensitive Information
An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive information exchanged via TCP communications.
-
Medium 5.4
Westermo Lynx Cross-site Scripting
An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter.
-
Medium 6.3
Juanpao JPShop API AppController.php unrestricted upload
A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/controllers/admin/app/AppController.php of the component API. The manipulation of the argument app_p…
-
Medium 4.3CVE-2024-22241 EPSS 38%
Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can…
-
Medium 4.9
Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may expl…
-
Medium 5.3
Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Op…
-
Medium 6.4
Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may…
-
Medium 5.3
sepidz SepidzDigitalMenu Waiters information disclosure
A vulnerability has been found in sepidz SepidzDigitalMenu up to 7.1.0728.1 and classified as problematic. This vulnerability affects unknown code of the file /Waiters. The manipulation leads to information disclosure. The attack can be initiated remotely. Th…
-
Medium 4.7
Byzoro Smart S20 Management Platform sysmanageajax.php sql injection
A vulnerability, which was classified as critical, was found in Byzoro Smart S20 Management Platform up to 20231120. This affects an unknown part of the file /sysmanage/sysmanageajax.php. The manipulation of the argument id leads to sql injection. It is possi…
-
Medium 4.7
Byzoro Smart S40 Management Platform Import web.php unrestricted upload
A vulnerability, which was classified as critical, has been found in Byzoro Smart S40 Management Platform up to 20240126. Affected by this issue is some unknown functionality of the file /useratte/web.php of the component Import Handler. The manipulation of t…
-
Medium 5.5
Tongda OA 2017 delete.php sql injection
A vulnerability classified as critical was found in Tongda OA 2017 up to 11.9. Affected by this vulnerability is an unknown functionality of the file /general/attendance/manage/ask_duty/delete.php. The manipulation of the argument ASK_DUTY_ID leads to sql inj…
-
Medium 6.2
IBM UrbanCode Deploy information disclosure
IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.19, 7.1 through 7.1.2.15, 7.2 through 7.2.3.8, 7.3 through 7.3.2.3, and IBM UrbanCode Deploy (UCD) - IBM DevOps Deploy 8.0.0.0 could disclose sensitive user information when installing the Windows agent. IBM X-Forc…
-
Medium 5.3
IBM PowerVM Hypervisor information disclosure
IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1020.00 through FW1020.40, and FW1030.00 through FW1030.30 could allow a system administrator to obtain sensitive partition information. IBM X-Force ID: 269695.
-
Medium 5.5
Tongda OA 2017 delete.php sql injection
A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /general/email/outbox/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclos…
-
Medium 5.3
Tuleap's content of artifacts might be readable by unauthorized users
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Some users might get access to restricted information when a process validates the permissions of multiple users (e.g. mail notifications). This issue has been pa…
-
Medium 5.5
Indent: heap-based buffer overflow in set_buf_break()
A flaw was found in indent, a program for formatting C code. This issue may allow an attacker to trick a user into processing a specially crafted file to trigger a heap-based buffer overflow, causing the application to crash.
-
Medium 5.0
Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may in…
-
Medium 5.3
In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image
-
Medium 5.3CVE-2024-24942 EPSS 32%
In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives
-
Medium 6.1
In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an …
-
Medium 5.3
In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation
-
Medium 4.6
In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible
-
Medium 4.3
In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed
-
Medium 6.8
Eap-galleon: custom provisioning creates unsecured http-invoker
An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.
-
Medium 5.5CVE-2024-0684 Public exploit
Coreutils: heap overflow in split --line-bytes with very long lines
A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service.
-
Medium 6.7
Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 …
-
Medium 6.3
DUP framework version 4.9.4.36 and prior contains insecure operation on Windows junction/Mount point vulnerability. A l…
-
Medium 6.6
Dell Display Manager application, version 2.1.1.17 and prior, contain an insecure operation on windows junction/mount p…