Archive
8 April 2024
Vulnerabilities first published on this day (UTC), newest first.
119 results · Feed
-
Medium 6.6
HCL BigFix Asset Discovery is affected by a security vulnerability
The NMAP Importer service may expose data store credentials to authorized users of the Windows Registry.
-
Medium 6.5
CVE
NVIDIA ChatRTX for Windows contains a vulnerability in the UI, where an attacker can cause a cross-site scripting error by network by running malicious scripts in users' browsers. A successful exploit of this vulnerability might lead to code execution, denial…
-
High 8.2
CVE
NVIDIA ChatRTX for Windows contains a vulnerability in the UI, where an attacker can cause improper privilege management by sending open file requests to the application. A successful exploit of this vulnerability might lead to local escalation of privileges,…
-
Medium 5.5
SourceCodester Laundry Management System Pengeluaran.php laporan_filter sql injection
A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been declared as critical. Affected by this vulnerability is the function laporan_filter of the file /application/controller/Pengeluaran.php. The manipulation of the argument da…
-
Medium 6.3
SourceCodester Laundry Management System Transaki.php laporan_filter sql injection
A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been classified as critical. Affected is the function laporan_filter of the file /application/controller/Transaki.php. The manipulation of the argument dari/sampai leads to sql …
-
Medium 6.3
SourceCodester Laundry Management System Pelanggan.php laporan_filter sql injection
A vulnerability was found in SourceCodester Laundry Management System 1.0 and classified as critical. This issue affects the function laporan_filter of the file /application/controller/Pelanggan.php. The manipulation of the argument jeniskelamin leads to sql …
-
Low 3.5
SourceCodester Laundry Management System edit cross site scripting
A vulnerability has been found in SourceCodester Laundry Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /karyawan/edit. The manipulation of the argument karyawan leads to cross site scripting. The atta…
-
Medium 6.3
Netentsec NS-ASG Application Security Gateway add_ikev2.php sql injection
A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3. This vulnerability affects unknown code of the file /admin/add_ikev2.php. The manipulation of the argument TunnelId leads to sql injection. The attack can b…
-
Medium 6.3
Netentsec NS-ASG Application Security Gateway config_ISCGroupNoCache.php sql injection
A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/config_ISCGroupNoCache.php. The manipulation of the argument GroupId leads to sql injection. It is poss…
-
High 7.5CVE-2023-7164 Scanner template
BackWPup < 4.0.4 - Unauthenticated Backup Download
The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.
-
Medium 6.3
Netentsec NS-ASG Application Security Gateway config_Anticrack.php sql injection
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/config_Anticrack.php. The manipulation of the argument GroupId leads to sql …
-
Medium 5.3
Shopware has Improper Session Handling in store-api
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User…
-
High 8.8
Redon-Hub has incorrect permissions on all admin related commands
Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/t…
-
Medium 6.3
Netentsec NS-ASG Application Security Gateway add_postlogin.php sql injection
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add_postlogin.php. The manipulation of the argument SingleLoginId l…
-
Medium 6.3
SourceCodester Laundry Management System laporan_filter sql injection
A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /karyawan/laporan_filter. The manipulation of the argument data_karyawan leads to sql injection. T…
-
Critical 9.8
GPT Academic: Pickle deserializing cookies may pose RCE risk
GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73. The server deserializes untrustworthy data from the client, which may risk remote code execution. Any device that exp…
-
Medium 5.9
Clients removed during unpairing process may regain access if Sunshine was not restarted
Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI interface and then pairing only one device, all of the previously devices will be temporarily paired. V…
-
Medium 4.7
Wangshen SecGate 3600 ?g=net_pro_keyword_import_save unrestricted upload
A vulnerability was found in Wangshen SecGate 3600 up to 20240408. It has been classified as critical. This affects an unknown part of the file /?g=net_pro_keyword_import_save. The manipulation of the argument reqfile leads to unrestricted upload. It is possi…
-
Low 3.5
SourceCodester Prison Management System apply_leave.php cross site scripting
A vulnerability classified as problematic was found in SourceCodester Prison Management System 1.0. This vulnerability affects unknown code of the file /Employee/apply_leave.php. The manipulation of the argument txtstart_date/txtend_date leads to cross site s…
-
Medium 6.3
SourceCodester Prison Management System delete_leave.php sql injection
A vulnerability classified as critical has been found in SourceCodester Prison Management System 1.0. This affects an unknown part of the file /Employee/delete_leave.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely.…
-
Medium 4.2
Saleor CSRF bypass in refreshToken mutation
Saleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attacker may bypass cross-set request forgery (CSRF) validation when calling refresh token mutation with empty stri…
-
Medium 5.3
DataEase has database configuration information exposure vulnerability
DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configur…
-
Medium 6.3
SourceCodester Prison Management System edit-profile.php sql injection
A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Employee/edit-profile.php. The manipulation leads to sql injection. The attack may be la…
-
Medium 4.7
SourceCodester Prison Management System edit_profile.php sql injection
A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /Admin/edit_profile.php. The manipulation leads to sql injection. The attack can…
-
Medium 5.9CVE-2024-2511 EPSS 59%
Unbounded memory growth with session handling in TLSv1.3
Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial o…
-
Low 3.5
namithjawahar Wp-Insert cross site scripting
A vulnerability was found in namithjawahar Wp-Insert up to 2.0.8 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0…
-
Low 3.5
GamerZ WP-PostRatings wp-postratings.php cross site scripting
A vulnerability was found in GamerZ WP-PostRatings up to 1.64. It has been classified as problematic. This affects an unknown part of the file wp-postratings.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. …
-
High 8.7
OpenText ArcSight Management Center and ArcSight Platform Stored XSS
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could be remotely exploited.
-
High 7.3
SourceCodester Prison Management System login.php sql injection
A vulnerability was found in SourceCodester Prison Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /Account/login.php. The manipulation leads to sql injection. It is possible to launch the attack remotely…
-
High 7.3
SourceCodester Prison Management System login.php sql injection
A vulnerability was found in SourceCodester Prison Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /Admin/login.php. The manipulation leads to sql injection. The attack may be initiated remotely. The ex…
-
Critical 9.8
ksmbd: validate payload size in ipc response
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate payload size in ipc response If installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc response to ksmbd kernel server. ksmbd should validate payload size of ip…
-
High 7.5
Input verification vulnerability in the call module. Impact: Successful exploitation of this vulnerability may affect s…
-
High 7.5
Input verification vulnerability in the log module. Impact: Successful exploitation of this vulnerability can affect in…
-
High 7.5
Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect conf…
-
Medium 6.3
Vulnerability of input parameters being not strictly verified in the RSMC module. Impact: Successful exploitation of th…
-
High 7.5
Out-of-bounds write vulnerability in the RSMC module. Impact: Successful exploitation of this vulnerability will affect…
-
Medium 6.2
Out-of-bounds write vulnerability in the RSMC module. Impact: Successful exploitation of this vulnerability will affect…
-
Medium 6.5
Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may aff…
-
High 7.4
Race condition vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability will affect ava…
-
Medium 5.4
WordPress WP2LEADS plugin <= 3.2.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads.This issue affects WP2LEADS: from n/a through <= 3.2.7.