https://vulnogram.org/ Most recent CVEs assigned by snps (snps). https://vulnogram.org/seaview/icons/snps.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2024-8796 https://vulnogram.org/CVE-2024-8796 Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Using a shared secret shorter than the minimum to generate a multi-facto… Medium Tue, 17 Sep 2024 17:12:13 GMT https://vulnogram.org/CVE-2024-5184 https://vulnogram.org/CVE-2024-5184 The EmailGPT service contains a prompt injection vulnerability. The service uses an API service that allows a malicious user to inject a direct prompt and take over the service logic. Attackers can exploit the issue by forcing the AI service to leak… High Wed, 05 Jun 2024 17:52:13 GMT https://vulnogram.org/CVE-2024-5185 https://vulnogram.org/CVE-2024-5185 The EmbedAI application is susceptible to security issues that enable Data Poisoning attacks. This weakness could result in the application becoming compromised, leading to unauthorized entries or data poisoning attacks, which are delivered by a CSRF… High Wed, 29 May 2024 13:00:28 GMT https://vulnogram.org/CVE-2024-0226 https://vulnogram.org/CVE-2024-0226 Synopsys Seeker versions prior to 2023.12.0 are vulnerable to a stored cross-site scripting vulnerability through a specially crafted payload. Medium Tue, 09 Jan 2024 17:41:31 GMT https://vulnogram.org/CVE-2023-4480 https://vulnogram.org/CVE-2023-4480 Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the ru… Medium Tue, 05 Sep 2023 14:43:25 GMT https://vulnogram.org/CVE-2023-2453 https://vulnogram.org/CVE-2023-2453 There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘require_once’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known… High Tue, 05 Sep 2023 14:39:10 GMT https://vulnogram.org/CVE-2023-2631 https://vulnogram.org/CVE-2023-2631 A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. Medium Tue, 16 May 2023 18:06:59 GMT https://vulnogram.org/CVE-2023-2195 https://vulnogram.org/CVE-2023-2195 A cross-site request forgery (CSRF) vulnerability in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL. Medium Tue, 16 May 2023 18:02:33 GMT https://vulnogram.org/CVE-2023-2633 https://vulnogram.org/CVE-2023-2633 Jenkins Code Dx Plugin 3.1.0 and earlier does not mask Code Dx server API keys displayed on the configuration form, increasing the potential for attackers to observe and capture them. Medium Tue, 16 May 2023 17:56:40 GMT https://vulnogram.org/CVE-2023-2632 https://vulnogram.org/CVE-2023-2632 Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system… Medium Tue, 16 May 2023 17:54:11 GMT https://vulnogram.org/CVE-2023-2196 https://vulnogram.org/CVE-2023-2196 A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Item/Read permission to check for the existence of an attacker-specified file path on an agent file system. Medium Tue, 16 May 2023 17:46:59 GMT https://vulnogram.org/CVE-2023-25827 https://vulnogram.org/CVE-2023-25827 Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue share… High Network Exploitable Wed, 03 May 2023 18:36:14 GMT https://vulnogram.org/CVE-2023-25826 https://vulnogram.org/CVE-2023-25826 Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete f… Critical Network Exploitable Wed, 03 May 2023 18:33:59 GMT https://vulnogram.org/CVE-2023-2158 https://vulnogram.org/CVE-2023-2158 Code Dx versions prior to 2023.4.2 are vulnerable to user impersonation attack where a malicious actor is able to gain access to another user's account by crafting a custom "Remember Me" token. This is possible due to the use of a hard-coded cipher w… Critical Network Exploitable Thu, 27 Apr 2023 17:04:22 GMT https://vulnogram.org/CVE-2023-1663 https://vulnogram.org/CVE-2023-1663 Coverity versions prior to 2023.3.2 are vulnerable to forced browsing, which exposes authenticated resources to unauthorized actors. The root cause of this vulnerability is an insecurely configured servlet mapping for the underlying Apache Tomcat ser… Medium Network Exploitable Wed, 29 Mar 2023 13:16:40 GMT https://vulnogram.org/CVE-2023-25828 https://vulnogram.org/CVE-2023-25828 Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module. Albums are used to create collections of images that can be inserted into web pages across the site. Albums allow the upload of various… High Mon, 27 Mar 2023 16:35:22 GMT https://vulnogram.org/CVE-2023-23850 https://vulnogram.org/CVE-2023-23850 A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Medium Wed, 15 Feb 2023 00:00:00 GMT https://vulnogram.org/CVE-2023-23848 https://vulnogram.org/CVE-2023-23848 Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, cap… Medium Wed, 15 Feb 2023 00:00:00 GMT https://vulnogram.org/CVE-2023-23847 https://vulnogram.org/CVE-2023-23847 A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturi… Low Wed, 15 Feb 2023 00:00:00 GMT https://vulnogram.org/CVE-2023-23849 https://vulnogram.org/CVE-2023-23849 Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same sub domain can set a cookie for the whole subdomain which can be used to bypass other mitigati… High Network Exploitable Mon, 06 Feb 2023 00:00:00 GMT https://vulnogram.org/CVE-2023-23846 https://vulnogram.org/CVE-2023-23846 Due to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headers in GPRS tunneling protocol (GPTv1-U) messages, a protocol payload with any extension header length set to zer… High Network Exploitable Wed, 01 Feb 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-45481 https://vulnogram.org/CVE-2022-45481 The default configuration of Lazy Mouse does not require a password, allowing remote unauthenticated users to execute arbitrary code with no prior authorization or authentication. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Critical Network Exploitable Mon, 05 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45479 https://vulnogram.org/CVE-2022-45479 PC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization or authentication. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Critical Network Exploitable Mon, 05 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45478 https://vulnogram.org/CVE-2022-45478 Telepad allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypresses) in cleartext. CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Medium Mon, 05 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45477 https://vulnogram.org/CVE-2022-45477 Telepad allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization or authentication. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Critical Network Exploitable Mon, 05 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45483 https://vulnogram.org/CVE-2022-45483 Lazy Mouse allows an attacker (in a man in the middle position between the server and a connected device) to see all data (including keypresses) in cleartext. CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Medium Network Exploitable Fri, 02 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45482 https://vulnogram.org/CVE-2022-45482 Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily and quickly brute force the PIN and execute arbitrary commands. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Critical Network Exploitable Fri, 02 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-45480 https://vulnogram.org/CVE-2022-45480 PC Keyboard WiFi & Bluetooth allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypresses) in cleartext. CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Medium Network Exploitable Fri, 02 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-43945 https://vulnogram.org/CVE-2022-43945 The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a sin… High Network Exploitable Fri, 04 Nov 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-39065 https://vulnogram.org/CVE-2022-39065 A single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI gateway unresponsive, such that connected lighting cannot be controlled with the IKEA Home Smart app and TRÅDFRI remote control. The malformed Zigbee frame is an unauthenticated broadc… Medium Fri, 14 Oct 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-39064 https://vulnogram.org/CVE-2022-39064 An attacker sending a single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI bulb blink, and if they replay (i.e. resend) the same frame multiple times, the bulb performs a factory reset. This causes the bulb to lose configuration informatio… High Fri, 14 Oct 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-39063 https://vulnogram.org/CVE-2022-39063 When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Once UPF receives a request, it gets the f_teid_len from incoming message, and then uses it to copy data fr… Fri, 16 Sep 2022 18:02:12 GMT https://vulnogram.org/CVE-2022-30618 https://vulnogram.org/CVE-2022-30618 An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:use… Thu, 19 May 2022 17:08:47 GMT https://vulnogram.org/CVE-2022-30617 https://vulnogram.org/CVE-2022-30617 An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by) with content accessible to t… Thu, 19 May 2022 17:07:36 GMT https://vulnogram.org/CVE-2022-30278 https://vulnogram.org/CVE-2022-30278 A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Fl… Tue, 10 May 2022 19:47:30 GMT https://vulnogram.org/CVE-2021-43177 https://vulnogram.org/CVE-2021-43177 As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U… Mon, 11 Apr 2022 19:37:40 GMT https://vulnogram.org/CVE-2021-43176 https://vulnogram.org/CVE-2021-43176 The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do n… Tue, 07 Dec 2021 17:26:38 GMT https://vulnogram.org/CVE-2021-43175 https://vulnogram.org/CVE-2021-43175 The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial valid… Tue, 07 Dec 2021 17:25:11 GMT https://vulnogram.org/CVE-2021-33179 https://vulnogram.org/CVE-2021-33179 The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticated victim, who accesses a specially crafted malicious URL, would unknowingly execute the attached payload. Thu, 14 Oct 2021 14:57:17 GMT https://vulnogram.org/CVE-2021-33178 https://vulnogram.org/CVE-2021-33178 The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of this results in a malicious actor having the ability to arbitrarily delete files on the local… Thu, 14 Oct 2021 14:56:00 GMT https://vulnogram.org/CVE-2021-33177 https://vulnogram.org/CVE-2021-33177 The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authenticated to the vulnerable system, but once authenticated they would be able to execute arb… Thu, 14 Oct 2021 14:55:39 GMT https://vulnogram.org/CVE-2021-33176 https://vulnogram.org/CVE-2021-33176 VerneMQ MQTT Broker versions prior to 1.12.0 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of untrusted inputs. These inputs cause the message broker to consume large amounts of memory, r… Tue, 08 Jun 2021 14:31:23 GMT https://vulnogram.org/CVE-2021-33175 https://vulnogram.org/CVE-2021-33175 EMQ X Broker versions prior to 4.2.8 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of untrusted inputs. These inputs cause the message broker to consume large amounts of memory, resulting… Tue, 08 Jun 2021 14:31:16 GMT