WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product library✕
Overview 631 matches · 73 in Waratek scope · 15 protected · 12 exploited · 5 CISA KEV · 63 public PoC · 14 EPSS ≥ 0.5
631matches 73in Waratek scope11.6% 15protected2.4% 12exploited1.9% 5CISA KEV0.8% 63public PoC10.0% 14EPSS ≥ 0.52.2%
Protected by Waratek 15 2.4% Rule in development 0 0.0% Mitigation candidate 1 0.2% No exploit published 57 9.0% Outside Waratek scope 4 0.6% Not applicable 554 87.8% Withdrawn CVE 0 0.0%
Critical 99 15.7% High 253 40.1% Medium 247 39.1% Low 32 5.1% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 15 2.4% partly blocked 0 0.0% not blocked 616 97.6% not established 0 0.0% unrecorded 0 0.0%
Exploited 12 1.9% Working exploit published 51 8.1% Proof of concept only 164 26.0% Forecast only 3 0.5% No public exploit 401 63.5%
split by peak 108 / year
Not applicable: 554Outside Waratek scope: 4No exploit published: 57Mitigation candidate: 1Protected by Waratek: 15 Low: 32Medium: 247High: 253Critical: 99 not blocked: 616blocked by ARMR today: 15 No public exploit: 401Forecast only: 3Proof of concept only: 164Working exploit published: 51Exploited: 12
19991 Not applicable1 Medium1 not blocked1 No public exploit1 20000 20010 20022 Not applicable2 High1 Medium1 not blocked2 Working exploit published1 No public exploit1 20033 Not applicable3 Medium3 not blocked3 No public exploit3 20045 Not applicable5 High4 Medium1 not blocked5 Working exploit published1 No public exploit4 20052 Not applicable2 High1 Medium1 not blocked2 No public exploit2 200614 Not applicable14 High5 Medium8 Low1 not blocked14 Working exploit published6 No public exploit8 200735 Not applicable35 High18 Medium16 Low1 not blocked35 Working exploit published11 No public exploit24 20087 No exploit published2 Not applicable5 High2 Medium5 not blocked7 Working exploit published3 No public exploit4 200910 Not applicable10 High9 Medium1 not blocked10 Working exploit published5 No public exploit5 201010 Not applicable10 High8 Medium2 not blocked10 Working exploit published3 No public exploit7 20113 Not applicable3 High1 Medium2 not blocked3 Working exploit published2 No public exploit1 20126 No exploit published1 Not applicable5 High2 Medium4 not blocked6 Working exploit published1 No public exploit5 20132 Not applicable2 Medium1 Low1 not blocked2 No public exploit2 201416 Not applicable16 High1 Medium14 Low1 not blocked16 No public exploit16 201525 Not applicable25 Critical5 High12 Medium8 not blocked25 Working exploit published3 No public exploit22 201612 No exploit published8 Outside Waratek scope1 Not applicable3 Critical1 High2 Medium9 not blocked12 Forecast only1 No public exploit11 201722 Protected by Waratek1 Mitigation candidate1 No exploit published6 Outside Waratek scope1 Not applicable13 Critical3 High10 Medium9 blocked by ARMR today1 not blocked21 Working exploit published5 Proof of concept only1 No public exploit16 201821 Protected by Waratek5 No exploit published4 Outside Waratek scope1 Not applicable11 Critical7 High9 Medium5 blocked by ARMR today5 not blocked16 Working exploit published3 Proof of concept only1 Forecast only2 No public exploit15 201923 Protected by Waratek2 No exploit published3 Outside Waratek scope1 Not applicable17 Critical7 High5 Medium10 Low1 blocked by ARMR today2 not blocked21 Exploited4 Working exploit published2 No public exploit17 202021 No exploit published5 Not applicable16 Critical7 High7 Medium7 not blocked21 Exploited2 No public exploit19 202122 Protected by Waratek2 No exploit published2 Not applicable18 Critical7 High9 Medium6 blocked by ARMR today2 not blocked20 Exploited2 Working exploit published1 Proof of concept only4 No public exploit15 2022108 Protected by Waratek1 No exploit published2 Not applicable105 Critical28 High64 Medium16 blocked by ARMR today1 not blocked107 Exploited1 Working exploit published2 Proof of concept only44 No public exploit61 202376 No exploit published3 Not applicable73 Critical10 High32 Medium33 Low1 not blocked76 Exploited2 Proof of concept only26 No public exploit48 202469 Protected by Waratek2 No exploit published5 Not applicable62 Critical15 High22 Medium30 Low2 blocked by ARMR today2 not blocked67 Exploited1 Working exploit published1 Proof of concept only22 No public exploit45 202580 Protected by Waratek2 No exploit published3 Not applicable75 Critical4 High9 Medium46 Low21 blocked by ARMR today2 not blocked78 Working exploit published1 Proof of concept only58 No public exploit21 202636 No exploit published13 Not applicable23 Critical5 High20 Medium8 Low3 not blocked36 Proof of concept only8 No public exploit28
1999200220052008201120142017202020232026
631 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 7 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2023-27383 Medium 2023-11-14 Not applicable No public exploit Protection mechanism failure in some Intel(R) oneAPI HPC Toolkit 2023.1 and Intel(R)MPI Library software before version 2021.9 may allow a privileged user to potentially enable escalation of privilege via adjacent access.
CVE-2023-24592 High 2023-11-14 Not applicable No public exploit Path traversal in the some Intel(R) oneAPI Toolkits and Component software before version 2023.1 may allow authenticated user to potentially enable escalation of privilege via local access.
CVE-2023-22313 Low 2023-11-14 Not applicable No public exploit Improper buffer restrictions in some Intel(R) QAT Library software before version 22.07.1 may allow a privileged user to potentially enable information disclosure via local access.
CVE-2023-5904 Medium 2023-11-07 Not applicable Proof of concept only Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVE-2023-5903 Medium 2023-11-07 Not applicable Proof of concept only Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVE-2023-5902 Medium 2023-11-07 Not applicable Proof of concept only Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVE-2023-5901 Medium 2023-11-07 Not applicable No public exploit Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVE-2023-5900 Medium 2023-11-07 Not applicable Proof of concept only Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVE-2023-47271 Medium 2023-11-06 Not applicable No public exploit PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file named in an XML document (used for the native import/export plugin) is an image file, before trying to use it for an issue cover image.
CVE-2023-5899 High 2023-11-01 Not applicable Proof of concept only Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVE-2023-5898 High 2023-11-01 Not applicable Proof of concept only Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVE-2023-5896 Medium 2023-11-01 Not applicable Proof of concept only Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4.
CVE-2023-5895 Medium 2023-11-01 Not applicable Proof of concept only Cross-site Scripting (XSS) - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVE-2023-5893 High 2023-11-01 Not applicable Proof of concept only Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVE-2023-5892 Medium 2023-11-01 Not applicable Proof of concept only Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVE-2023-5891 Medium 2023-11-01 Not applicable Proof of concept only Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVE-2023-5890 Medium 2023-11-01 Not applicable Proof of concept only Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVE-2023-5889 High 2023-11-01 Not applicable No public exploit Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
CVE-2023-45996 High 2023-10-31 Not applicable Proof of concept only SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the reborrowLimit parameter in the member_type.php.
CVE-2023-24385 Medium 2023-10-17 Not applicable No public exploit Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in David Lingren Media Library Assistant plugin <= 3.11 versions.
CVE-2023-46066 Medium 2023-10-16 Not applicable No public exploit Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Codedrafty Mediabay – Media Library Folders plugin <= 1.6 versions.
CVE-2023-5580 Critical 2023-10-14 Not applicable No public exploit A vulnerability classified as critical has been found in SourceCodester Library System 1.0. This affects an unknown part of the file index.php. The manipulation of the argument category leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-242145 was assigned to this vulnerability.
CVE-2023-44962 Medium 2023-10-11 Not applicable Proof of concept only File Upload vulnerability in Koha Library Software 23.05.04 and before allows a remote attacker to read arbitrary files via the upload-cover-image.pl component.
CVE-2023-44961 High 2023-10-11 Not applicable Proof of concept only SQL Injection vulnerability in Koha Library Software 23.0.5.04 and before allows a remote attacker to obtain sensitive information via the intranet/cgi bin/cataloging/ysearch.pl. component.
CVE-2023-3744 Critical 2023-10-02 Not applicable No public exploit Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal services or upload the contents of relevant files via the "scrape_image.php" file in the imageURL parameter.
CVE-2023-4716 Medium 2023-09-22 Not applicable No public exploit The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to, and including, 3.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2023-4634 Critical 2023-09-06 Not applicable Exploited The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible.
CVE-2023-36382 Medium 2023-09-04 Not applicable No public exploit Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeffrey-WP Media Library Categories plugin <= 2.0.0 versions.
CVE-2023-32102 Medium 2023-09-04 Not applicable No public exploit Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Pexle Chris Library Viewer plugin <= 2.0.6 versions.
CVE-2023-40970 High 2023-09-01 Not applicable Proof of concept only Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loan_rules.php.
CVE-2023-40969 Medium 2023-09-01 Not applicable Proof of concept only Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bibliography/pop_p2p.php.
CVE-2020-35357 Medium 2023-08-22 Not applicable No public exploit A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.
CVE-2023-28823 High 2023-08-11 Not applicable No public exploit Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2023-28711 Medium 2023-08-11 Not applicable Exploited Insufficient control flow management in the Hyperscan Library maintained by Intel(R) before version 5.4.1 may allow an authenticated user to potentially enable denial of service via local access.
CVE-2023-28658 High 2023-08-11 Not applicable No public exploit Insecure inherited permissions in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2023-27391 Medium 2023-08-11 Not applicable No public exploit Improper access control in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2022-25864 High 2023-08-11 Not applicable No public exploit Uncontrolled search path in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2023-34010 Medium 2023-08-05 Not applicable No public exploit Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in submodule of David Lingren Media Library Assistant plugin  <= 3.0.7 versions.
CVE-2023-37471 Critical 2023-07-20 No exploit published No public exploit Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the SAMLPOSTProfileServlet servlet. This problem has been patched in OpenAM 14.7.3-SNAPSHOT and later. User unable to upgrade should comment servlet `SAMLPOSTProfileServlet` from their pom file. See the linked GHSA for details.
CVE-2023-37386 High 2023-07-18 Not applicable No public exploit Cross-Site Request Forgery (CSRF) vulnerability in Media Library Helper plugin <= 1.2.0 versions.
CVE-2023-1597 High 2023-07-10 Not applicable Proof of concept only The tagDiv Cloud Library WordPress plugin before 2.7 does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated users, allowing unauthenticated users to change arbitrary user metadata, which could lead to privilege escalation by setting themselves as an admin of the blog.
CVE-2023-34411 High 2023-06-05 Not applicable Proof of concept only The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.
CVE-2022-47142 High 2023-05-22 Not applicable No public exploit Cross-Site Request Forgery (CSRF) vulnerability in Plugincraft Mediamatic – Media Library Folders plugin <= 2.8.1 versions.
CVE-2023-0892 Medium 2023-05-15 Not applicable Proof of concept only The BizLibrary WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-22355 High 2023-05-10 Not applicable No public exploit Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.0.251 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2023-21978 Medium 2023-04-18 No exploit published No public exploit Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: GUI). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Object Library, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data as well as unauthorized read access to a subset of Oracle Application Object Library accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Object Library. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).
CVE-2023-29850 High 2023-04-14 Not applicable Proof of concept only SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This allows attackers to obtain information such as the user's geolocation and device information.
CVE-2022-47596 Medium 2023-03-29 Not applicable No public exploit Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeffrey-WP Media Library Categories plugin <= 1.9.9 versions.
CVE-2023-0973 Medium 2023-03-13 Not applicable No public exploit STEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a specially constructed file, resulting in an application crash.
CVE-2021-45479 Medium 2023-03-02 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation vulnerability in Yordam Information Technologies Library Automation System allows Stored XSS. This issue affects Library Automation System: before 19.2.
CVE-2021-45478 Medium 2023-03-02 Not applicable No public exploit Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users. This issue affects Library Automation System: before 19.2.
CVE-2021-45477 Medium 2023-03-02 Not applicable No public exploit Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users. This issue affects Library Automation System: before 19.2.
CVE-2023-0279 High 2023-02-27 Not applicable Proof of concept only The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
CVE-2023-0285 Medium 2023-02-21 Not applicable Proof of concept only The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.
CVE-2015-10084 Critical 2023-02-21 Not applicable No public exploit A vulnerability was found in irontec klear-library chloe and classified as critical. Affected by this issue is the function _prepareWhere of the file Controller/Rest/BaseController.php. The manipulation leads to sql injection. Upgrading to version marla is able to address this issue. The name of the patch is b25262de52fdaffde2a4434fc2a84408b304fbc5. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221504.
CVE-2022-26425 High 2023-02-16 Not applicable No public exploit Uncontrolled search path element in the Intel(R) oneAPI Collective Communications Library (oneCCL) before version 2021.6 for Intel(R) oneAPI Base Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-26052 High 2023-02-16 Not applicable No public exploit Uncontrolled search path element in the Intel(R) MPI Library before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-25905 High 2023-02-16 Not applicable No public exploit Uncontrolled search path element in the Intel(R) oneAPI Data Analytics Library (oneDAL) before version 2021.5 for Intel(R) oneAPI Base Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-23538 High 2023-01-17 Not applicable No public exploit github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service. When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider. This occurs in a specific flow, where the library service redirects the client to a backing S3 storage server, to perform a multi-part concurrent download. Depending on site configuration, the S3 service may be provided by a third party. An attacker with access to the S3 service may be able to extract user credentials, allowing them to impersonate the user. The vulnerable multi-part concurrent download flow, with redirect to S3, is only used when communicating with a Singularity Enterprise 1.x installation, or third party server implementing this flow. Interaction with Singularity Enterprise 2.x, and Singularity Container Services (cloud.sylabs.io), does not trigger the vulnerable flow. We encourage all users to update. Users who interact with a Singularity Enterprise 1.x installation, using a 3rd party S3 storage service, are advised to revoke and recreate their authentication tokens within Singularity Enterprise. There is no workaround available at this time.
CVE-2022-4199 Medium 2023-01-16 Not applicable Proof of concept only The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2016-15020 Critical 2023-01-16 Not applicable No public exploit A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The patch is named 42ec8f2b22e0b0b98fb5b4444ed451c1b21d125a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218391.
CVE-2017-20157 Critical 2022-12-31 Not applicable No public exploit A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.php. The manipulation leads to server-side request forgery. Upgrading to version 3.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217140.
CVE-2022-45019 High 2022-12-05 Not applicable Proof of concept only SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter.
CVE-2022-41634 High 2022-11-18 Not applicable No public exploit Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.
CVE-2022-41618 Medium 2022-11-18 Not applicable No public exploit Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress.
CVE-2022-23748 High 2022-11-17 Not applicable Exploited mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In these scenarios, a malicious attacker could be using the valid and legitimate executable to load malicious files.
CVE-2022-43362 High 2022-11-01 Not applicable Proof of concept only Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collType parameter at loan_by_class.php.
CVE-2022-43361 Medium 2022-11-01 Not applicable Proof of concept only Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component pop_chart.php.
CVE-2021-45476 Medium 2022-10-27 Not applicable No public exploit Yordam Library Information Document Automation product before version 19.02 has an unauthenticated reflected XSS vulnerability.
CVE-2021-45475 High 2022-10-27 Not applicable No public exploit Yordam Library Information Document Automation product before version 19.02 has an unauthenticated Information disclosure vulnerability.
CVE-2022-42113 Medium 2022-10-18 No exploit published No public exploit A Cross-site scripting (XSS) vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the `redirect` parameter.
CVE-2022-38138 High 2022-10-11 Not applicable No public exploit The Triangle Microworks IEC 61850 Library (Any client or server using the C language library with a version number of 11.2.0 or earlier and any client or server using the C++, C#, or Java language library with a version number of 5.0.1 or earlier) and 60870-6 (ICCP/TASE.2) Library (Any client or server using a C++ language library with a version number of 4.4.3 or earlier) are vulnerable to access given to a small number of uninitialized pointers within their code. This could allow an attacker to target any client or server using the affected libraries to cause a denial-of-service condition.
CVE-2022-39859 Medium 2022-10-07 Not applicable No public exploit Implicit intent hijacking vulnerability in UPHelper library prior to version 3.0.12 allows attackers to access sensitive information via implicit intent.
CVE-2022-36944 Critical 2022-09-23 Protected by Waratek Proof of concept only Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
CVE-2022-2266 Medium 2022-09-22 Not applicable No public exploit University Library Automation System developed by Yordam Bilgi Teknolojileri before version 19.2 has an unauthenticated Reflected XSS vulnerability. This has been fixed in the version 19.2
CVE-2022-0495 Critical 2022-09-21 Not applicable No public exploit The library automation system product KOHA developed by Parantez Teknoloji before version 19.05.03 has an unauthenticated SQL Injection vulnerability. This has been fixed in the version 19.05.03.01.
CVE-2022-38292 Critical 2022-09-12 Not applicable No public exploit SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliography/marcsru.php and /bibliography/z3950sru.php.
CVE-2022-38291 Medium 2022-09-12 Not applicable No public exploit SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search bar.
CVE-2022-37794 Critical 2022-09-12 Not applicable No public exploit In Library Management System 1.0 the /card/in-card.php file id_no parameters are vulnerable to SQL injection.
CVE-2021-45027 High 2022-09-01 Not applicable Working exploit published An arbitrary file download vulnerability in Oliver v5 Library Server Versions < 5.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input.
CVE-2022-36735 Critical 2022-08-30 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /admin/delete.php.
CVE-2022-36734 Critical 2022-08-30 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /admin/delstu.php.
CVE-2022-36733 Critical 2022-08-30 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /admin/del.php.
CVE-2022-36732 Critical 2022-08-30 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /librarian/dele.php.
CVE-2022-36731 Critical 2022-08-30 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /librarian/delstu.php.
CVE-2022-36730 Critical 2022-08-30 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /librarian/delete.php.
CVE-2022-36714 Critical 2022-08-30 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /staff/lab.php.
CVE-2022-36713 Critical 2022-08-30 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /librarian/lab.php.
CVE-2022-36712 Critical 2022-08-30 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/studentdetails.php.
CVE-2022-36711 Critical 2022-08-30 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/bookdetails.php.
CVE-2022-36709 Critical 2022-08-30 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/edit_book_details.php.
CVE-2022-36657 Medium 2022-08-30 Not applicable No public exploit Library Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /librarian/edit_book_details.php.
CVE-2022-36708 Critical 2022-08-28 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /student/bookdetails.php.
CVE-2022-36704 High 2022-08-28 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /librarian/studentdetails.php.
CVE-2022-36721 High 2022-08-25 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Textbook parameter at /admin/modify.php.
CVE-2022-36720 High 2022-08-25 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/modify1.php.
CVE-2022-36719 Critical 2022-08-25 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the ok parameter at /admin/history.php.
CVE-2022-36716 Critical 2022-08-25 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/changestock.php.
CVE-2022-36715 Critical 2022-08-25 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/search.php.
CVE-2022-36729 Critical 2022-08-18 Not applicable No public exploit Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /librarian/del.php.
‹ prev page 3 of 7 next ›