CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
emlog v5.3.1 has full path disclosure vulnerability in t/index.php, which allows an attacker to see the path to the webroot/file.
All versions of Uffizio GPS Tracker may allow an attacker to perform unintended actions on behalf of a user.
The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License Manager” that allows incoming connections from private networks using TCP Port 1947. While uninstalling, the uninstaller fails to close Port 1947.
An attacker may be able to inject client-side JavaScript code on multiple instances within all versions of Uffizio GPS Tracker.
Compactlogix_5370_l1_firmware, Compactlogix_5370_l1, Compactlogix_5370_l2_firmware, Compactlogix_5370_l2, Compactlogix_5370_l3_firmware, Compactlogix_5370_l3, Armor_compact_guardlogix_5370_firmware, Armor_compact_guardlogix_5370, Compact_guardlogix_5370_firmware, Compact_guardlogix_5370
2022-10-25
N/A
7.5 HIGH
When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the message that includes the legitimate, new password hash and replace it with an illegitimate hash. The user would no longer be able to authenticate to the controller (Micro800: All versions, MicroLogix 1400: Version 21 and later) causing a denial-of-service condition
admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities.
Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPScmsmodulesfrontpages_builder::previewBlock method interacts unsafely with the IPS_Theme::runProcessFunction method.
Boundary, Consul, Consul_docker_image, Consul_template, Go-getter, Go-slug, Nomad, Packer, Sentinel, Terraform
2022-10-25
N/A
7.4 HIGH
HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.
An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a timing attack to reveal the contents of secret strings to an attacker.
Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests.