Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartext on port UDP 514 (aka the syslog port).R ...

Continue Reading

July 10, 2022

H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS.Read More ...

Continue Reading

July 10, 2022

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash.Read More ...

Continue Reading

July 10, 2022

Exposure of sensitive information to an unauthorized actor issue in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to obtain the data without the viewing ...

Continue Reading

July 10, 2022

Cross-site scripting vulnerability in LiteCart versions prior to 2.4.2 allows a remote attacker to inject an arbitrary script via unspecified vectors.Read More ...

Continue Reading

July 10, 2022

The NotVinay/karaokey repository through 2019-12-11 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.Read More ...

Continue Reading

July 10, 2022

The Niyaz-Mohamed/mosaic repository through 1.0.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.Read More ...

Continue Reading

July 10, 2022

The Lukasavicus/WindMill repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.Read More ...

Continue Reading

July 10, 2022