Archive
13 February 2024
Vulnerabilities first published on this day (UTC), newest first.
59 results · Clear filters · Feed
-
Medium 6.5
Zoom Clients - Business Logic Error
Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.
-
Medium 4.9
Zoom Clients - Improper Authentication
Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access.
-
Medium 6.8
Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation
Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access.
-
Medium 6.8
Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation
Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access.
-
Medium 4.3
Information Disclosure of Hashed Passwords in TYPO3 Backend Forms
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password hashes were being reflected in the editing forms of the TYPO3 backend user interface. This allowed attackers to crack the plaintext password using brute force…
-
Medium 4.9
Information Disclosure of Encryption Key in TYPO3 Install Tool
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of `$GLOBALS['SYS']['encryptionKey']` was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utiliz…
-
Medium 4.3
Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (al…
-
Medium 5.4
Email Validation Bypass And Preventing Sign Up From Email's Owner
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up.
-
Medium 4.9
Due to a code bug in Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a guest to observe an…
-
Medium 6.0CVE-2023-31346 Public exploit
Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.
-
Medium 6.3
Path traversal vulnerability in GitHub Enterprise Server that allowed arbitrary file read with a specially crafted GitHub Pages artifact upload
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker to gain unauthorized read permission to files by deploying arbitrary symbolic links to a GitHub Pages site with a specially crafted artifact tarball. To exploit…
-
Medium 6.5
Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malic…
-
Medium 4.3
Broken Access Control in Backend Module in sf_event_mgt
sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, b…
-
Medium 5.3
Microsoft Azure File Sync Elevation of Privilege Vulnerability
Microsoft Azure File Sync Elevation of Privilege Vulnerability
-
Medium 5.5
Windows DNS Information Disclosure Vulnerability
Windows DNS Information Disclosure Vulnerability
-
Medium 5.0
Microsoft Teams for Android Information Disclosure Vulnerability
Microsoft Teams for Android Information Disclosure Vulnerability
-
Medium 5.5
Windows Kernel Security Feature Bypass Vulnerability
Windows Kernel Security Feature Bypass Vulnerability
-
Medium 6.5
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
-
Medium 5.9
Windows Network Address Translation (NAT) Denial of Service Vulnerability
Windows Network Address Translation (NAT) Denial of Service Vulnerability
-
Medium 5.9
Windows Network Address Translation (NAT) Denial of Service Vulnerability
Windows Network Address Translation (NAT) Denial of Service Vulnerability
-
Medium 6.4
Windows USB Generic Parent Driver Remote Code Execution Vulnerability
Windows USB Generic Parent Driver Remote Code Execution Vulnerability
-
Medium 6.8
Windows Kernel Remote Code Execution Vulnerability
Windows Kernel Remote Code Execution Vulnerability
-
Medium 6.5
Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability
-
Medium 5.7
Skype for Business Information Disclosure Vulnerability
Skype for Business Information Disclosure Vulnerability
-
Medium 4.1
Trusted Compute Base Elevation of Privilege Vulnerability
Trusted Compute Base Elevation of Privilege Vulnerability
-
Medium 6.5
Azure Stack Hub Spoofing Vulnerability
Azure Stack Hub Spoofing Vulnerability
-
Medium 6.8
Microsoft Azure Active Directory B2C Spoofing Vulnerability
Microsoft Azure Active Directory B2C Spoofing Vulnerability
-
Medium 4.6
Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability
-
Medium 6.1
Twister Antivirus v8.17 - Out-of-bounds Read
Twister Antivirus v8.17 is vulnerable to an Out-of-bounds Read vulnerability by triggering the 0x801120B8 IOCTL code of the filmfd.sys driver.
-
Medium 5.5
Twister Antivirus v8.17 - Denial of Service
Twister Antivirus v8.17 is vulnerable to a Denial of Service vulnerability by triggering the 0x80112067, 0x801120CB 0x801120CC 0x80112044, 0x8011204B, 0x8011204F, 0x80112057, 0x8011205B, 0x8011205F, 0x80112063, 0x8011206F, 0x80112073, 0x80112077, 0x80112078, …
-
Medium 5.3
Cleaning an ECS-enabled cache may cause excessive CPU load
If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. This issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.1…
-
Medium 4.3
HIMA: Origin Validation Error in multiple products
An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the ports are separated by VLAN.
-
Medium 6.5
Resource Consumption Identified in NTP before 4.2.4p8 and 4.2.5
Uncontrolled Resource Consumption vulnerability in Honeywell Niagara Framework on Windows, Linux, QNX allows Content Spoofing.This issue affects Niagara Framework: before Niagara AX 3.8.1, before Niagara 4.1.
-
Medium 4.6
A cross-site scripting vulnerability in Trellix Central Management (CM) prior to 9.1.3.97129 allows a remote authentica…
-
Medium 6.4
Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Raw Content
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This make…
-
Medium 5.4
Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Link
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Link in all versions up to, and including, 4.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
-
Medium 5.4
Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button URL in all versions up to, and including, 4.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate…
-
Medium 6.5
A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions …
-
Medium 6.5
A vulnerability has been identified in OpenPCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions …
-
Medium 6.5
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32…