Archive
28 March 2024
Vulnerabilities first published on this day (UTC), newest first.
85 results · Clear filters · Feed
-
Medium 5.5
Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. A remote high p…
-
Medium 5.3
Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A re…
-
Medium 5.9
Dell PowerScale OneFS, versions 8.2.2.x through 9.5.0.x contains a use of a broken cryptographic algorithm vulnerabilit…
-
Medium 6.0
Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability…
-
Medium 6.0
Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability…
-
Medium 6.0
Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an improper privilege management vulnerability. A local…
-
Medium 6.5
The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, iOS 17.2 and iPadOS 17.2, ma…
-
Medium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Monterey 12.7.2…
-
Medium 5.5
An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Monterey 12.7.2, macOS V…
-
Medium 5.5
This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Mo…
-
Medium 5.5
A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sonoma 14.…
-
Medium 5.5
A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macO…
-
Medium 4.1
In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing t…
-
Medium 5.9
In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector
-
Medium 4.6CVE-2024-31138 EPSS 75%
In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings
-
Medium 6.8
In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration
-
Medium 6.5
In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users …
-
Medium 6.1
In JetBrains TeamCity before 2024.03 open redirect was possible on the login page
-
Medium 6.3
SourceCodester Simple Subscription Website manage_user.php sql injection
A vulnerability was found in SourceCodester Simple Subscription Website 1.0 and classified as critical. This issue affects some unknown processing of the file manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be initi…
-
Medium 6.3
Netentsec NS-ASG Application Security Gateway listloginfo.php sql injection
A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. This vulnerability affects unknown code of the file /protocol/log/listloginfo.php. The manipulation leads to sql injection. The attack can be initi…
-
Medium 6.3
Netentsec NS-ASG Application Security Gateway list_crl_conf sql injection
A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/list_crl_conf. The manipulation of the argument CRLId leads to sql injection. It is possible to …
-
Medium 6.3
Shanghai Brad Technology BladeX API export-user sql injection
A vulnerability classified as critical has been found in Shanghai Brad Technology BladeX 3.4.0. Affected is an unknown function of the file /api/blade-user/export-user of the component API. The manipulation with the input updatexml(1,concat(0x3f,md5(123456),0…
-
Medium 4.9
Oversight in fix for GHSA-4rcf-3cj2-46mq may have exposed suppressed wiki requests on private wikis
CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-29897 may have exposed suppressed wiki requests to private wikis that added Special:RequestWikiQueue to the read whitelist …
-
Medium 4.9
CreateWiki Leak of suppressed wiki requests outside of `CreateWikiGlobalWiki`
CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users with (delete) or (suppressrevision) on any wiki in the farm to access suppressed wiki requests by going to the request's entry on Special:RequestWikiQueue o…
-
Medium 6.8
API returns timesheet entries a user should not be authorized to view
Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and the API, thus returning unexpected data through the API. When setting the `view_other_timesheet` permission to true, on …
-
Medium 6.5
WordPress Elementor Addon Elements plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder.This issue affects Elementor Addon Elements: from n/a through <= 1.13.1.
-
Medium 4.3
WordPress Events Manager plugin <= 6.4.7.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Pixelite Events Manager.This issue affects Events Manager: from n/a through 6.4.7.1.
-
Medium 4.3
Allocation of Resources Without Limits or Throttling in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. It was possible for an attacker to cause a denial of service using malicious cra…
-
Medium 6.1
WordPress Image Map Pro premium plugin < 5.6.9 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro allows Stored XSS.This issue affects Image Map Pro: from n/a before 5.6.9.
-
Medium 6.5
WordPress Booster Plus for WooCommerce plugin < 7.1.2 - Auth. Sensitive Data Exposure vulnerability
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.2.
-
Medium 6.5
WordPress Booster Elite for WooCommerce plugin < 7.1.2 - Auth. Sensitive Data Exposure vulnerability
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Elite for WooCommerce.This issue affects Booster Elite for WooCommerce: from n/a before 7.1.2.
-
Medium 5.5
WordPress CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin <= 4.1.10 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery (SSRF) vulnerability in NiteoThemes CMP – Coming Soon & Maintenance.This issue affects CMP – Coming Soon & Maintenance: from n/a through 4.1.10.
-
Medium 5.3
WordPress Seraphinite Accelerator plugin <= 2.20.47 - Sensitive Data Exposure via Log File vulnerability
Insertion of Sensitive Information into Log File vulnerability in Seraphinite Solutions Seraphinite Accelerator.This issue affects Seraphinite Accelerator: from n/a through 2.20.47.
-
Medium 4.3
Missing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 …
-
Medium 5.4
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Recording.CountBy…
-
Medium 5.4
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log.CountByCatego…
-
Medium 5.4
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in ActionRule.Delete…
-
Medium 5.4
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in AudioPattern.Dele…
-
Medium 5.4
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in IOModule.EnumLog …
-
Medium 5.4
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Group.Save webapi…