Archive
15 July 2024
Vulnerabilities first published on this day (UTC), newest first.
51 results · Clear filters · Feed
-
Medium 5.4
TP-Link TL-SG1016DE XSS
An authenticated stored cross-site scripting (XSS) exists in the TP-Link TL-SG1016DE affecting version TL-SG1016DE(UN) V7.6_1.0.0 Build 20230616, which could allow an adversary to run JavaScript in an administrator's browser. This issue was fixed in TL-SG1016…
-
Medium 4.3
Path Traveral in @jmondi/url-to-png
@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the `ImageId` in the code is not sanitized and may lead to path traversal. This …
-
Medium 4.9
Denial of service via Watched Words in Discourse
Discourse is an open source platform for community discussion. In affected versions by creating replacement words with an almost unlimited number of characters, a moderator can reduce the availability of a Discourse instance. This issue has been addressed in …
-
Medium 5.3
Enumeration of valid usernames in web-auth/webauthn-lib
web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any c…
-
Medium 5.8
OpaMiddleware does not filter HTTP OPTIONS requests
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP `OPTIONS` requests are always allowed by `OpaMiddleware`, even when they lack authentication, and are passed through directly to the application. `OpaMiddleware` allows all HTTP `O…
-
Medium 4.3
HEIF Heap OOB Read in OpenImageIO
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions…
-
Medium 5.3
ZITADEL Go's GRPC example code vulnerability - GO-2024-2687 HTTP/2 CONTINUATION flood in net/http
### Summary Applications using the `zitadel-go` `v3` library (`next` branch) might be impacted by package vulnerabilities. The output of `govulncheck` suggests that only `example` code seems to be impacted, based on 1 of the 3 potential vulnerabilities. This …
-
Medium 6.6
Zoom Workplace App for Windows and Zoom Rooms App for Windows - Race Condition
Race condition in the installer for Zoom Workplace App for Windows and Zoom Rooms App for Windows may allow an authenticated user to conduct a denial of service via local access.
-
Medium 6.6
Zoom Workplace Desktop App for macOS - Uncontrolled Search Path Element
Uncontrolled search path element in the installer for Zoom Workplace Desktop App for macOS before version 6.0.10 may allow an authenticated user to conduct a denial of service via local access.
-
Medium 6.7
Zoom Workplace Apps and SDK for Windows - Improper Privilege Management
Integrity check in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct a privilege escalation via local access.
-
Medium 5.5
Zoom Workplace Desktop App for Windows - Improper Input Validation
Improper input validation in the installer for Zoom Workplace Desktop App for Windows before version 6.0.10 may allow an authenticated user to conduct a denial of service via local access.
-
Medium 6.8
Zoom Workplace Apps and SDKs - Path traversal
Race condition in Team Chat for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct information disclosure via network access.
-
Medium 5.3
Zoom Apps and SDKs - Improper Input Validation
Improper input validation in some Zoom Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.
-
Medium 5.1
Symantec Privileged Access Manager Insecure Direct Object Reference vulnerability
The vulnerability allows a malicious low-privileged PAM user to access information about other PAM users and their group memberships.
-
Medium 5.3
Symantec Privileged Access Manager User Enumeration vulnerability
A specific authentication strategy allows a malicious attacker to learn ids of all PAM users defined in its database.
-
Medium 6.8
Symantec Privileged Access Manager Reflected Cross Site Scripting vulnerability
A reflected cross-site scripting (XSS) vulnerability exists in the PAM UI web interface. A remote attacker able to convince a PAM user to click on a specially crafted link to the PAM UI web interface could potentially execute arbitrary client-side code in the…
-
Medium 5.1
Symantec Privileged Access Manager Privilege Escalation vulnerability
The vulnerability allows a malicious low-privileged PAM user to perform server upgrade related actions.
-
Medium 5.3
Symantec Privileged Access Manager Authentication Bypass vulnerability
The vulnerability allows an attacker to bypass the authentication requirements for a specific PAM endpoint.
-
Medium 4.3CVE-2024-6746 Scanner template
NaiboWang EasySpider HTTP GET Request server.js path traversal
A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulatio…
-
Medium 4.3
An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 allows infor…
-
Medium 4.2
Spoofed push notifications from malicious server
Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a malicious server to send push notifications with another server’s diagnostic ID or server URL and hav…
-
Medium 5.8
Openfind Mail2000 - HttpOnly flag bypass
Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enabled.
-
Medium 6.1
Openfind Mail2000 - Stored XSS
Openfind's Mail2000 does not properly validate email atachments, allowing unauthenticated remote attackers to inject JavaScript code within the attachment and perform Stored Cross-site scripting attacks.
-
Medium 6.5
Apache Linkis DataSource: DatasourceManager module has a JDBC parameter judgment logic vulnerability that allows for arbitrary file reading
In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should…
-
Medium 5.2
Agents are able to lock the ticket without the "Owner" permission
An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instances when a…
-
Medium 5.7
Information exlosure in external interface
Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem only occurs …
-
Medium 6.1CVE-2024-6289 Scanner template
WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure
The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.
-
Medium 5.4
WP eStore < 8.5.5 - Reflected XSS in Customer Editing
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
-
Medium 6.1
WP eStore < 8.5.5 - Reflected XSS in Category Editing
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
-
Medium 6.1
WP eStore < 8.5.5 - Reflected XSS via $_SERVER['REQUEST_URI']
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
-
Medium 4.7
WP eStore < 8.5.5 - Reflected XSS in Discount Editing
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
-
Medium 5.4
AguardNet Space Management System - Reflected Cross-Site Scripting
AguardNet Technology's Space Management System does not properly filter user input, allowing remote attackers with regular privileges to inject JavaScript and perform Reflected Cross-site scripting attacks.
-
Medium 5.3
Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' Flag
The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS.
-
Medium 5.3
WisdomGarden Tronclass - Broken Access Control
The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL.
-
Medium 4.3
IBM Datacap Navigator information disclosure
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 displays version information in HTTP requests that could allow an attacker to gather information for future attacks against the system. IBM X-Force ID: 296009.
-
Medium 4.3
IBM Datacap Navigator directory traversal
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system…
-
Medium 4.3
IBM Datacap Navigator information disclosure
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow an authenticated user to obtain sensitive information from source code that could be used in further attacks against the system. IBM X-Force ID: 295968.
-
Medium 5.4
IBM Datacap Navigator cross-site scripting
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
-
Medium 5.9
IBM Datacap Navigator information disclosure
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 295970.
-
Medium 6.4
IBM Datacap Navigator cross-site scripting
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credenti…