dawid-czarnecki/public-vulnerabilities
GitHub
CVE History
| CVE | Published | CVSS v3 | CVSS v2 |
|---|---|---|---|
| 4.7 MEDIUM | 4.3 MEDIUM | ||
KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730. | |||
| 2.9 LOW | 2.1 LOW | ||
KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without appropriate file access controls, allowing all local users to read its content. | |||
| 9.9 CRITICAL | 6.5 MEDIUM | ||
Imagicle Application Suite (for Cisco UC) before 2021.Summer.2 allows SQL injection. A low-privileged user could inject a SQL statement through the "Export to CSV" feature of the Contact Manager web GUI. | |||
| 6.1 MEDIUM | 4.3 MEDIUM | ||
IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page. | |||
| 9.8 CRITICAL | 7.5 HIGH | ||
IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service. | |||
| 5.3 MEDIUM | 5 MEDIUM | ||
IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_COOKIE cookie. | |||