Archive
22 February 2024
Vulnerabilities first published on this day (UTC), newest first.
37 results · Clear filters · Feed
-
Medium 4.7
Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config
### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a [`Choices`](https://labelstud.io/tags/choices) or [`Labels`](https://labelstud.io/tags/labels) tag, resu…
-
Medium 5.3
User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository
### Impact A bug in permissions validation allows a user with the `ci:ReadAction` permission to skip read checks when copying an object. If they additionally have read and write permission to path in the repository, they can copy an otherwise unreadable objec…
-
Medium 5.6
TemmokuMVC Image Download images_get_down.php img_replace deserialization
A vulnerability, which was classified as critical, was found in TemmokuMVC up to 2.3. Affected is the function get_img_url/img_replace in the library lib/images_get_down.php of the component Image Download Handler. The manipulation leads to deserialization. I…
-
Medium 5.0
van_der_Schaar LAB AutoPrognosis Release Note load_model_from_file deserialization
A vulnerability classified as critical was found in van_der_Schaar LAB AutoPrognosis 0.1.21. This vulnerability affects the function load_model_from_file of the component Release Note Handler. The manipulation leads to deserialization. The attack can be initi…
-
Medium 5.4
baserCMS Cross-site Scripting vulnerability in Content Management
baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the content management feature. Version 5.0.9 contains a fix for this vulnerability.
-
Medium 5.4
Tuleap's mass update clears the permissions on artifact field
Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and prior to versions 15.5-4 and 15.4-7 of Tuleap Enterprise Edition, users with a read access to a tracke…
-
Medium 4.3
User can see invitees in events created in PMs and private categories
Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discourse. Prior to version 0.4, event invitees created in topics in private categories or PMs (private messages) can be retri…
-
Medium 5.5
erofs: fix inconsistent per-file compression format
In the Linux kernel, the following vulnerability has been resolved: erofs: fix inconsistent per-file compression format EROFS can select compression algorithms on a per-file basis, and each per-file compression algorithm needs to be marked in the on-disk supe…
-
Medium 4.7
Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the cu…
-
Medium 6.1
Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website,…
-
Medium 5.6
baserCMS OS command injection vulnerability in Installer
baserCMS is a website development framework. Prior to version 5.0.9, there is an OS Command Injection vulnerability in the site search feature of baserCMS. Version 5.0.9 contains a fix for this vulnerability.
-
Medium 6.1
baserCMS Cross-site Scripting vulnerability in Site search Feature
baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the site search feature. Version 5.0.9 contains a fix for this vulnerability.
-
Medium —
Path Traversal in TYPO3 Core
Due to a too loose type check in an API method, attackers could bypass the directory traversal check by providing an invalid UTF-8 encoding sequence.
-
Medium 5.4
Apache Answer: XSS vulnerability when submitting summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. XSS attack when user enters summary. A logged-in user, when modifying their own submitted ques…
-
Medium 6.4
A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12,…
-
Medium 5.9
Apache Answer: Repeated submission at registration created duplicate users with the same name
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Repeated submission during registration resulted in the registration of the same user. …
-
Medium 4.3
Event Tickets and Registration <= 5.8.1 - Missing Authorization
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in all versions up to, and including, 5.8.1. This makes it possible for authenticated attackers, with …
-
Medium 5.4
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.0.13 - Unauthenticated Stored Cross-Site Scripting
The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_submitted' 'link' value in all versions up to, and including, 1.0.13 due to insufficient i…
-
Medium 4.3
Missing Authorization in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 12.0 to 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. This vulnerability allows for bypassing the 'group ip restriction' set…
-
Medium 6.5CVE-2023-52160 Public exploit
The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_su…
-
Medium 6.2
An issue in flvmeta v.1.2.2 allows a local attacker to cause a denial of service via the flvmeta/src/flv.c:375:21 funct…
-
Medium 5.4
Enhavo Cross-site Scripting vulnerability
A cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Create Tag text field.
-
Medium 4.6
SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload …
-
Medium 6.1
A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafte…
-
Medium 6.1
Enhavo Cross-site Scripting vulnerability
A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Undertitle text field.
-
Medium 6.1
Enhavo Cross-site Scripting vulnerability
A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field.
-
Medium 4.9
cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php.
-
Medium 5.4
Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote …
-
Medium 4.7
WayOS IBR-7150 <17.06.23 is vulnerable to Cross Site Scripting (XSS).
-
Medium 4.3
flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_tr…
-
Medium 6.1
flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_pl…
-
Medium 5.4
A cross-site scripting (XSS) vulnerability in the Addon JD Simple module of flusity-CMS v2.33 allows attackers to execu…
-
Medium 6.1
A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Media Gallery with description' module of flusity-C…
-
Medium 6.1
A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Social block links' module of flusity-CMS v2.33 all…
-
Medium 6.1
A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attacker…
-
Medium 6.1
flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_pl…
-
Medium 4.7
Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field
Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter.