Archive
21 February 2025
Vulnerabilities first published on this day (UTC), newest first.
92 results · Feed
-
Low —
Leantime allows Cross-Site Scripting (XSS)
### Summary There is a cross-site scripting vulnerability on To-Do that affects a title field of a To-Do.
-
Low —
Leantime has Missing Authorization Check for Host Parameter
### Finding Description Application has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" paramete…
-
Low 3.3
IBM Security Verify Bridge information disclosure
IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 stores potentially sensitive information in log files that coul…
-
High —
Leantime allows Stored Cross-Site Scripting (XSS)
### Description Leantime allows stored cross-site scripting (XSS) in the API key name while generating the API key. ### Impact Any low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the…
-
Medium —
Leantime allows Cross-Site Request Forgery (CSRF)
**CSRF** ### Summary A cross-site request forgery vulnerability allows a remote actor to create an account with Owner privileges. By luring an Owner or Administrator into clicking a button on an attacker-controlled website, a request will be issued, generatin…
-
High —
Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)
### Summary A cross-site scripting (XSS) vulnerability has been identified in Leantime. The vulnerability allows an attacker to inject malicious scripts into certain fields, potentially leading to the execution of arbitrary code or unauthorized access to user…
-
Medium —
Leantime allows Stored Cross-Site Scripting (XSS)
### Summary Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. ### Details A Stored Cross-Site Scripting (XSS) vulnerability was found that could…
-
Medium —
Leantime allows Refelected Cross-Site Scripting (XSS)
### Summary The vulnerability in Leantime's "overdue" section allows attackers to upload malicious image files containing XSS payloads. When other users view these files, the scripts execute, enabling attackers to steal sensitive information or perform unauth…
-
Medium —
Leantime has Insufficiently Protected Credentials
Due to improper cache control an attacker can view sensitive information even if they are not logged into the account anymore. Additional Information: 1.The issue was identified during routine security testing. 2.This vulnerability poses a significant risk to…
-
Medium —
Leantime allows Stored Cross-Site Scripting (XSS)
STORED XSS +OPEN REDIRECTION in SVG uploads Vulnerable url:https://hack.leantime.io/projects/showProject/3
-
Medium 6.5
Leantime has Host Header Injection Vulnerability
### Summary A host header injection vulnerability has been identified in the user details viewing functionality of the system. This vulnerability allows an attacker to manipulate the host header in HTTP requests, thereby gaining unauthorized access to view de…
-
Low 2.3
sqrt doesn't define rounding behavior in Vyper
vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded u…
-
Low 2.3
double eval in For List Iter in Vyper
vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loo…
-
Low 2.3
AugAssign evaluation order causing OOB write within the object in Vyper
vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case when target is an access to a DynArray and the rhs modifies the array, the cached…
-
High 7.7
Code injection in binance-trading-bot
binance-trading-bot is an automated Binance trading bot with trailing buy/sell strategy. Authenticated users of binance-trading-bot can achieve Remote Code Execution on the host system due to a command injection vulnerability in the `/restore` endpoint. The r…
-
Medium 6.8
A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute…
-
High 7.3
Lack of Escaping of HTML in JSX Fragments allows for Cross-site Scripting in solid-js
solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly…
-
High 7.3
Cross-site Scripting vulnerability due to improper use of string.replace in dom-expressions
dom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of javascript's `.replace()` opens up to potential Cross-site Scripting (XSS) vulnerabilities with the special replacement patterns beginning with `$`. Partic…
-
High 8.1
Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. An authenticated user can exploit the Insecure Direct Object Reference (IDOR) vulnerability that may lead to unauthorized cross-tenant access (list ten…
-
High 7.3
hzmanyun Education and Training System saveImage unrestricted upload
A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. This vulnerability affects the function saveImage. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The …
-
Low 3.5
iteachyou Dreamer CMS edit cross site scripting
A vulnerability was found in iteachyou Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/archives/edit. The manipulation of the argument editorValue/answer/content leads to cross site scripting.…
-
High 8.6
Qiskit SDK denial of service
Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengine serialization stream which can cause a segfault within the symengine library.
-
Medium 5.5
IBM Security Verify Bridge information disclosure
IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 stores user credentials in configuration files which can be rea…
-
High 7.3
BDCOM Behavior Management and Auditing System operate.mds log_operate_clear os command injection
A vulnerability has been found in BDCOM Behavior Management and Auditing System up to 20250210 and classified as critical. Affected by this vulnerability is the function log_operate_clear of the file /webui/modules/log/operate.mds. The manipulation of the arg…
-
Medium 6.3
dingfanzu CMS loadShopInfo.php sql injection
A vulnerability, which was classified as critical, was found in dingfanzu CMS up to 20250210. Affected is an unknown function of the file /ajax/loadShopInfo.php. The manipulation of the argument shopId leads to sql injection. It is possible to launch the atta…
-
Medium 4.3
iteachyou Dreamer CMS ueditor-1.4.3.3 path traversal
A vulnerability, which was classified as problematic, has been found in iteachyou Dreamer CMS 4.1.3. This issue affects some unknown processing of the file /resource/js/ueditor-1.4.3.3. The manipulation leads to path traversal. The attack may be initiated rem…
-
High 8.8
D-Link DAP-1320 storagein.pd-XXXXXX replace_special_char stack-based overflow
A vulnerability, which was classified as critical, has been found in D-Link DAP-1320 1.00. Affected by this issue is the function replace_special_char of the file /storagein.pd-XXXXXX. The manipulation leads to stack-based buffer overflow. The attack may be l…
-
High 8.8
D-Link DAP-1320 api set_ws_action heap-based overflow
A vulnerability classified as critical was found in D-Link DAP-1320 1.00. Affected by this vulnerability is the function set_ws_action of the file /dws/api/. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploi…
-
Medium 6.3
Harpia DiagSystem atualatendimento_jpeg.php sql injection
A vulnerability was found in Harpia DiagSystem 12. It has been rated as critical. This issue affects some unknown processing of the file /diagsystem/PACS/atualatendimento_jpeg.php. The manipulation of the argument codexame leads to sql injection. The attack m…
-
High 7.3
Raisecom Multi-Service Intelligent Gateway Request Parameter vpn_template_style.php os command injection
A vulnerability was found in Raisecom Multi-Service Intelligent Gateway up to 20250208. It has been declared as critical. This vulnerability affects unknown code of the file /vpn/vpn_template_style.php of the component Request Parameter Handler. The manipulat…
-
Medium 5.9
Heap Buffer overflow in Abseil
There exists a heap buffer overflow vulnerable in Abseil-cpp. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map} did not impose an upper bound on their size argument. As a result, it was possible for a caller to pass a v…
-
Medium 6.4
SVG Support <= 2.5.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…
-
Medium 4.7
Opera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack. The vulnerability allows a …
-
High 7.3
Baiyi Cloud Asset Management System admin.ticket.close.php sql injection
A vulnerability was found in Baiyi Cloud Asset Management System 8.142.100.161. It has been classified as critical. This affects an unknown part of the file /wuser/admin.ticket.close.php. The manipulation of the argument ticket_id leads to sql injection. It i…
-
Unscored —
resolve is unmaintained
resolve crate's GitHub repository is archived with no commits for seven years. Latest crates.io release is also seven years old. ## Possible alternatives * [hickory-resolver](https://crates.io/crates/hickory-resolver)
-
High 8.7
Code Injection in Wyn Enterprise
Report generation functionality in Wyn Enterprise allows for code inclusion, but not sufficiently limits what code might be included. An attacker is able use a low privileges account in order to abuse this functionality and execute malicious code, load DLL li…
-
Medium 4.9
Indeed Ultimate Learning Pro <= 3.9 - Authenticated (Administrator+) SQL Injection via post_id Parameter
The Indeed Ultimate Learning Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘post_id’ parameter in all versions up to, and including, 3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio…
-
Medium 6.4
igumbi Online Booking <= 1.40 - Authenticated (Contributor+) Stored Cross-Site Scripting
The igumbi Online Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'igumbi_calendar' shortcode in all versions up to, and including, 1.40 due to insufficient input sanitization and output escaping on user supplied att…
-
Medium 6.5
WPExperts Square For GiveWP <= 1.3.1 - Authenticated (Subscriber+) SQL Injection
The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exis…
-
Medium 5.3
Event Tickets and Registration <= 5.19.1.1 - Missing Authorization to Ticket Deletion
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete' function in all versions up to, and including, 5.19.1.1. This makes it possible for authenticated …