Archive
8 March 2024
Vulnerabilities first published on this day (UTC), newest first.
103 results · Feed
-
High 7.3
Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters
Wasmi is an efficient and lightweight WebAssembly interpreter with a focus on constrained and embedded systems. In the WASMI Interpreter, an Out-of-bounds Buffer Write will arise if the host calls or resumes a Wasm function with more parameters than the defau…
-
Medium 5.8
CWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2. The vulnerability could allow upl…
-
High 8.0
Improper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule
PostgreSQL Anonymizer v1.2 contains a vulnerability that allows a user who owns a table to elevate to superuser. A user can define a masking function for a column and place malicious code in that function. When a privileged user applies the masking rules usin…
-
High 8.0
SQL Injection in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule
PostgreSQL Anonymizer v1.2 contains a SQL injection vulnerability that allows a user who owns a table to elevate to superuser when dynamic masking is enabled. PostgreSQL Anonymizer enables users to set security labels on tables to mask specified columns. Ther…
-
Medium 6.2
IBM SPSS Statistics denial of service
IBM SPSS Statistics 26.0, 27.0.1, and 28.0 IO Module could allow a local user to create multiple files that could exhaust the file handles capacity and cause a denial of service.
-
Medium 4.7CVE-2024-21901 EPSS 19%
myQNAPcloud
A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: myQNAPcl…
-
Medium 4.3
QTS, QuTS hero, QuTScloud
An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions…
-
Critical 9.8CVE-2024-21899 EPSS 24%
QTS, QuTS hero, QuTScloud
An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in t…
-
Medium 4.9
Network & Virtual Switch
A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the fo…
-
Medium 5.9
QTS, QuTS hero
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in th…
-
Medium 5.5
Photo Station
A path traversal vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vuln…
-
Medium 5.4
Cross-Site Scripting vulnerability in Django MarkdownX
Cross-Site Scripting (XSS) vulnerability in the Django MarkdownX project, affecting version 4.0.2. An attacker could store a specially crafted JavaScript payload in the upload functionality due to lack of proper sanitisation of JavaScript elements.
-
Medium 4.3
ZKTeco ZKBio Media Service Port 9999 download path traversal
A vulnerability was found in ZKTeco ZKBio Media 2.0.0_x64_2024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /pro/common/download of the component Service Port 9999. The manipulation of the argument fileName wi…
-
Low 3.8
Bdtask Hospital AutoManager Prescription Page improper authorization
A vulnerability was found in Bdtask Hospital AutoManager up to 20240227 and classified as problematic. This issue affects some unknown processing of the file /prescription/prescription/delete/ of the component Prescription Page. The manipulation leads to impr…
-
Medium 4.3
Bdtask Hospital AutoManager Update Bill Page cross-site request forgery
A vulnerability has been found in Bdtask Hospital AutoManager up to 20240227 and classified as problematic. This vulnerability affects unknown code of the file /billing/bill/edit/ of the component Update Bill Page. The manipulation leads to cross-site request…
-
Medium 6.3
affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_list
The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_create_list() function in all versions up to, and including, 3.5.4. This makes it possible for authentic…
-
Medium 4.3
affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_import_product
The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_import_product() function in all versions up to, and including, 3.5.4. This makes it possible for authen…
-
Medium 6.4
WP-Members Membership Plugin <= 3.4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.4.9.1 due to insufficient input sanitization and output escaping on user supplied attribut…
-
Low 3.5
boyiddha Automated-Mess-Management-System member_edit.php cross site scripting
A vulnerability, which was classified as problematic, has been found in boyiddha Automated-Mess-Management-System 1.0. Affected by this issue is some unknown functionality of the file /member/member_edit.php. The manipulation of the argument name leads to cro…
-
Low 3.5
boyiddha Automated-Mess-Management-System Chat Book chat.php cross site scripting
A vulnerability classified as problematic was found in boyiddha Automated-Mess-Management-System 1.0. Affected by this vulnerability is an unknown functionality of the file /member/chat.php of the component Chat Book. The manipulation of the argument msg lead…
-
Medium 6.3
boyiddha Automated-Mess-Management-System view.php sql injection
A vulnerability classified as critical has been found in boyiddha Automated-Mess-Management-System 1.0. Affected is an unknown function of the file /member/view.php. The manipulation of the argument date leads to sql injection. It is possible to launch the at…
-
Medium 6.5
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS …
-
High 7.8
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.4…
-
High 8.1
A logic issue was addressed with improved validation. This issue is fixed in Safari 17.4, iOS 16.7.6 and iPadOS 16.7.6,…
-
Medium 4.7
A race condition was addressed with additional validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 1…
-
Critical 9.1
An authentication issue was addressed with improved state management. This issue is fixed in iOS 17.4 and iPadOS 17.4, …
-
High 7.1
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.4. An app may b…
-
High 7.5
An injection issue was addressed with improved validation. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4…
-
Medium 5.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in iOS 17.4 and iPadOS 17.4, tvOS 17.4, watchOS 10.4.…
-
High 7.7
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS …
-
High 8.2CVE-2024-0258 Public exploit
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14…
-
Medium 6.2
This issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.4. An app may be able t…
-
Medium 5.9
A race condition was addressed with improved state handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Son…
-
Low 3.3
A privacy issue was addressed by not logging contents of text fields. This issue is fixed in iOS 17.4 and iPadOS 17.4, …
-
Medium 6.5
The issue was addressed with improved UI handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS …
-
High 8.4
An injection issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.4, macOS So…
-
Medium 4.3
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 1…
-
High 8.1
A race condition was addressed with additional validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.…
-
High 7.8
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.4, visionOS …