| advantech -- r-seenet |
Advantech R-SeeNet v2.4.23 allows an unauthenticated remote attacker to read from and write to the snmpmon.ini file, which contains sensitive information. |
2023-10-18 |
not yet calculated |
CVE-2023-5642 MISC |
| amd -- radeon(tm)_graphics_driver |
An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over arbitrary hardware ports or physical addresses resulting in a potential arbitrary code execution. |
2023-10-17 |
not yet calculated |
CVE-2023-20598 MISC |
| apache -- inlong |
Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can use \t to bypass. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8814 |
2023-10-19 |
not yet calculated |
CVE-2023-46227 MISC |
| apache -- santuario-xml_security_for_java |
All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue. |
2023-10-20 |
not yet calculated |
CVE-2023-44483 MISC MISC |
| apache -- shenyu |
There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arbitrary requests and retrieve corresponding responses by inputting any URL into the requestUrl parameter. Of particular concern is our ability to exert control over the HTTP method, cookies, IP address, and headers. This effectively grants us the capability to dispatch complete HTTP requests to hosts of our choosing. This issue affects Apache ShenYu: 2.5.1. Upgrade to Apache ShenYu 2.6.0 or apply patch https://github.com/apache/shenyu/pull/4776 . |
2023-10-19 |
not yet calculated |
CVE-2023-25753 MISC |
| apollo_router -- apollo_router |
The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the @defer or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with coprocessor.supergraph.response configured in their router.yaml and also to support either @defer or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response. |
2023-10-18 |
not yet calculated |
CVE-2023-45812 MISC MISC |
| archer_technologies_llc. -- archer_platform |
Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensitive information via a popup warning message. 6.14 (6.14.0) is also a fixed release. |
2023-10-17 |
not yet calculated |
CVE-2023-45357 MISC |
| archer_technologies_llc. -- archer_platform |
Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 (6.14.0) is also a fixed release. |
2023-10-17 |
not yet calculated |
CVE-2023-45358 MISC |
| archivebox -- archivebox |
ArchiveBox is an open source self-hosted web archiving system. Any users who are using the wget extractor and view the content it outputs. The impact is potentially severe if you are logged in to the ArchiveBox admin site in the same browser session and view an archived malicious page designed to target your ArchiveBox instance. Malicious Javascript could potentially act using your logged-in admin credentials and add/remove/modify snapshots, add/remove/modify ArchiveBox users, and generally do anything an admin user could do. The impact is less severe for non-logged-in users, as malicious Javascript cannot modify any archives, but it can still read all the other archived content by fetching the snapshot index and iterating through it. Because all of ArchiveBox's archived content is served from the same host and port as the admin panel, when archived pages are viewed the JS executes in the same context as all the other archived pages (and the admin panel), defeating most of the browser's usual CORS/CSRF security protections and leading to this issue. A patch is being developed in https://github.com/ArchiveBox/ArchiveBox/issues/239 . As a mitigation for this issue would be to disable the wget extractor by setting archivebox config --set SAVE_WGET=False, ensure you are always logged out, or serve only a static HTML version of your archive. |
2023-10-19 |
not yet calculated |
CVE-2023-45815 MISC MISC |
| arduino -- arduino-create-agent |
Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint /v2/pkgs/tools/installed. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version 1.3.3. Users are advised to upgrade. There are no known workarounds for this issue. |
2023-10-18 |
not yet calculated |
CVE-2023-43800 MISC |
| arduino -- arduino-create-agent |
Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint /v2/pkgs/tools/installed and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP DELETE request. This issue has been addressed in version 1.3.3. Users are advised to upgrade. There are no known workarounds for this issue. |
2023-10-18 |
not yet calculated |
CVE-2023-43801 MISC |
| arduino -- arduino-create-agent |
Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint /upload which handles request with the filename parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate their privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version 1.3.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-18 |
not yet calculated |
CVE-2023-43802 MISC |
| arduino -- arduino-create-agent |
Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint /v2/pkgs/tools/installed and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP POST request. This issue has been addressed in version 1.3.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-18 |
not yet calculated |
CVE-2023-43803 MISC |
| artifact_hub -- artifact_hub |
Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which the registryIsDockerHub function was only checking that the registry domain had the docker.io suffix. Artifact Hub allows providing some Docker credentials that are used to increase the rate limit applied when interacting with the Docker Hub registry API to read publicly available content. Due to the incorrect check described above, it'd be possible to hijack those credentials by purchasing a domain which ends with docker.io and deploying a fake OCI registry on it. < https://artifacthub.io/ > uses some credentials that only have permissions to read public content available in the Docker Hub. However, even though credentials for private repositories (disabled on artifacthub.io) are handled in a different way, other Artifact Hub deployments could have been using them for a different purpose. This issue has been resolved in version 1.16.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-19 |
not yet calculated |
CVE-2023-45821 MISC MISC |
| artifact_hub -- artifact_hub |
Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which a default unsafe rego built-in was allowed to be used when defining authorization policies. Artifact Hub includes a fine-grained authorization mechanism that allows organizations to define what actions can be performed by their members. It is based on customizable authorization policies that are enforced by the Open Policy Agent. Policies are written using rego and their data files are expected to be json documents. By default, rego allows policies to make HTTP requests, which can be abused to send requests to internal resources and forward the responses to an external entity. In the context of Artifact Hub, this capability should have been disabled. This issue has been resolved in version 1.16.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-19 |
not yet calculated |
CVE-2023-45822 MISC MISC MISC MISC |
| artifact_hub -- artifact_hub |
Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which by using symbolic links in certain kinds of repositories loaded into Artifact Hub, it was possible to read internal files. Artifact Hub indexes content from a variety of sources, including git repositories. When processing git based repositories, Artifact Hub clones the repository and, depending on the artifact kind, reads some files from it. During this process, in some cases, no validation was done to check if the file was a symbolic link. This made possible to read arbitrary files in the system, potentially leaking sensitive information. This issue has been resolved in version 1.16.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-19 |
not yet calculated |
CVE-2023-45823 MISC MISC |
| baker_hughes_co. -- bently_nevada_3500_system |
Baker Hughes - Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device. |
2023-10-19 |
not yet calculated |
CVE-2023-34437 MISC |
| baker_hughes_co. -- bently_nevada_3500_system |
Baker Hughes - Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests. |
2023-10-19 |
not yet calculated |
CVE-2023-34441 MISC |
| baker_hughes_co. -- bently_nevada_3500_system |
Baker Hughes - Bently Nevada 3500 System TDI Firmware version 5.05 contains a replay vulnerability which could allow an attacker to replay older captured packets of traffic to the device to gain access. |
2023-10-19 |
not yet calculated |
CVE-2023-36857 MISC |
| bunkum -- bunkum |
Bunkum is an open-source protocol-agnostic request server for custom game servers. First, a little bit of background. So, in the beginning, Bunkum's AuthenticationService only supported injecting IUsers. However, as Refresh and SoundShapesServer implemented permissions systems support for injecting ITokens into endpoints was added. All was well until 4.0. Bunkum 4.0 then changed to enforce relations between ITokens and IUsers. This wasn't implemented in a very good way in the AuthenticationService and ended up breaking caching in such a way that cached tokens would persist after the lifetime of the request - since we tried to cache both tokens and users. From that point until now, from what I understand, Bunkum was attempting to use that cached token at the start of the next request once cached. Naturally, when that token expired, downstream projects like Refresh would remove the object from Realm - and cause the object in the cache to be in a detached state, causing an exception from invalid use of IToken.User. A use-after-free since Realm can't manage the lifetime of the cached token. Security-wise, the scope is fairly limited, can only be pulled off on a couple endpoints given a few conditions, and you can't guarantee which token you're going to get. Also, the token would get invalidated properly if the endpoint had either a IToken usage or a IUser usage. The fix is to just wipe the token cache after the request was handled, which is now in 4.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-18 |
not yet calculated |
CVE-2023-45814 MISC MISC |
| byzoro -- smart_s45f_firmware |
A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btn_file_renew leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243059. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
2023-10-21 |
not yet calculated |
CVE-2023-5683 MISC MISC MISC |
| byzoro -- smart_s45f_firmware |
A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /importexport.php. The manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243061 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
2023-10-21 |
not yet calculated |
CVE-2023-5684 MISC MISC MISC |
| cisco -- catalyst_sd-wan_manager |
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve arbitrary files from an affected system. This vulnerability is due to improper validation of parameters that are sent to the web UI. An attacker could exploit this vulnerability by logging in to Cisco Catalyst SD-WAN Manager and issuing crafted requests using the web UI. A successful exploit could allow the attacker to obtain arbitrary files from the underlying Linux file system of an affected system. To exploit this vulnerability, the attacker must be an authenticated user. |
2023-10-18 |
not yet calculated |
CVE-2023-20261 MISC |
| cisco -- ios_xe |
Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software when exposed to the internet or to untrusted networks. This vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access. The attacker can then use that account to gain control of the affected system. For steps to close the attack vector for this vulnerability, see the Recommendations section of this advisory. Cisco will provide updates on the status of this investigation and when a software patch is available. |
2023-10-16 |
not yet calculated |
CVE-2023-20198 MISC MISC MISC |
| cmsmadesimple -- cmsmadesimple |
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in the news menu component. |
2023-10-20 |
not yet calculated |
CVE-2023-43353 MISC |
| cmsmadesimple -- cmsmadesimple |
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions -MicroTiny WYSIWYG editor component. |
2023-10-20 |
not yet calculated |
CVE-2023-43354 MISC |
| cmsmadesimple -- cmsmadesimple |
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again parameters in the My Preferences - Add user component. |
2023-10-20 |
not yet calculated |
CVE-2023-43355 MISC MISC |
| cmsmadesimple -- cmsmadesimple |
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata parameter in the Global Settings Menu component. |
2023-10-20 |
not yet calculated |
CVE-2023-43356 MISC |
| cmsmadesimple -- cmsmadesimple |
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the Manage Shortcuts component. |
2023-10-20 |
not yet calculated |
CVE-2023-43357 MISC |
| cmsmadesimple -- cmsmadesimple |
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data parameters in the Content Manager Menu component. |
2023-10-19 |
not yet calculated |
CVE-2023-43359 MISC |
| connected_vehicle_systems_alliance -- connected_vehicle_systems_alliance |
Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 was discovered to contain a buffer overflow via the component /shared/dlt_common.c. |
2023-10-17 |
not yet calculated |
CVE-2023-36321 MISC MISC |
| curl -- curl |
This flaw makes curl overflow a heap-based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap-based buffer, and the host name coming from the URL that curl has been told to operate with. |
2023-10-18 |
not yet calculated |
CVE-2023-38545 MISC |
| curl -- curl |
This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called curl_easy_duphandle. If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as none (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named none - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course. |
2023-10-18 |
not yet calculated |
CVE-2023-38546 MISC |
| dexma -- dexgate |
The affected product is vulnerable to a cross-site scripting vulnerability, which could allow an attacker to access the web application to introduce arbitrary Java Script by injecting an XSS payload into the 'hostname' parameter of the vulnerable software. |
2023-10-19 |
not yet calculated |
CVE-2023-40153 MISC |
| dexma -- dexgate |
The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker with access to the network, where clients have access to the DexGate server, could capture traffic. The attacker can later us the information within it to access the application. |
2023-10-19 |
not yet calculated |
CVE-2023-41088 MISC |
| dexma -- dexgate |
The affected product is vulnerable to an improper authentication vulnerability, which may allow an attacker to impersonate a legitimate user as long as the device keeps the session active, since the attack takes advantage of the cookie header to generate "legitimate" requests. |
2023-10-19 |
not yet calculated |
CVE-2023-41089 MISC |
| dexma -- dexgate |
The affected product is vulnerable to a cross-site request forgery vulnerability, which may allow an attacker to perform actions with the permissions of a victim user. |
2023-10-19 |
not yet calculated |
CVE-2023-42435 MISC |
| dexma -- dexgate |
The affected product is vulnerable to an exposure of sensitive information to an unauthorized actor vulnerability, which may allow an attacker to create malicious requests for obtaining the information of the version about the web server used. |
2023-10-19 |
not yet calculated |
CVE-2023-42666 MISC |
| directus-- directus |
Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus. This issue has been addressed in version 10.6.2. Users are advised to upgrade. Users unable to upgrade should avoid using websockets. |
2023-10-19 |
not yet calculated |
CVE-2023-45820 MISC MISC |
| discourse -- discourse |
Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins use topic custom fields. For a default Discourse installation with the default plugins, this vulnerability has no impact. The problem has been patched in the latest version of Discourse. Users are advised to update to version 3.1.1 if they are on the stable branch or 3.2.0.beta2 if they are on the beta branch. Users unable to upgrade should disable any plugins that access topic custom fields. |
2023-10-16 |
not yet calculated |
CVE-2023-45147 MISC |
| dotcms -- dotcms |
In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses for XSS and access controls. An example affected URL is https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp , which should return a 404 response but didn't. The oversight in the default invalid URL character list can be viewed at the provided GitHub link https://github.com/dotCMS/core/blob/master/dotCMS/src/main/java/com/dotcms/filters/NormalizationFilter.java#L37 . To mitigate, users can block URLs with double slashes at firewalls or utilize dotCMS config variables. Specifically, they can use the DOT_URI_NORMALIZATION_FORBIDDEN_STRINGS environmental variable to add // to the list of invalid strings. Additionally, the DOT_URI_NORMALIZATION_FORBIDDEN_REGEX variable offers more detailed control, for instance, to block //html.* URLs. Fix Version:23.06+, LTS 22.03.7+, LTS 23.01.4+ |
2023-10-17 |
not yet calculated |
CVE-2023-3042 MISC |
| eaton -- easye4_plc |
Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card (*.PRG file ending). |
2023-10-17 |
not yet calculated |
CVE-2023-43776 MISC |
| eaton -- easysoft |
Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. This software has a password protection functionality to secure the project file from unauthorized access. This password was being stored insecurely and could be retrieved by skilled adversaries. |
2023-10-17 |
not yet calculated |
CVE-2023-43777 MISC |
| eclipse -- mosquito |
In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6 |
2023-10-18 |
not yet calculated |
CVE-2023-5632 MISC MISC |
| engelsystem -- engelsystem |
Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixed in the commit dbb089315ff3d. Users are advised to update their installations. There are no known workarounds for this vulnerability. |
2023-10-17 |
not yet calculated |
CVE-2023-45659 MISC MISC |
| engelsystem -- engelsystem |
Engelsystem is a shift planning system for chaos events. A Blind SSRF in the "Import schedule" functionality makes it possible to perform a port scan against the local environment. This vulnerability has been fixed in commit ee7d30b33. If a patch cannot be deployed, operators should ensure that no HTTP(s) services listen on localhost and/or systems only reachable from the host running the engelsystem software. If such services are necessary, they should utilize additional authentication. |
2023-10-17 |
not yet calculated |
CVE-2023-45152 MISC MISC |
| eprosima -- fast_dds |
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA sub messages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attacker's control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-16 |
not yet calculated |
CVE-2023-42459 MISC MISC MISC |
| esst_monitoring -- esst_monitoring |
A lack of input sanitizing in the file download feature of eSST Monitoring v2.147.1 allows attackers to execute a path traversal. |
2023-10-17 |
not yet calculated |
CVE-2023-41629 MISC |
| esst_monitoring -- esst_monitoring |
eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the Gii code generator component. |
2023-10-17 |
not yet calculated |
CVE-2023-41630 MISC |
| esst_monitoring -- esst_monitoring |
eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the file upload function. |
2023-10-17 |
not yet calculated |
CVE-2023-41631 MISC |
| etsi -- tetra_standard |
A flaw in the TETRA authentication procedure allows a MITM adversary that can predict the MS challenge RAND2 to set session key DCK to zero. |
2023-10-19 |
not yet calculated |
CVE-2022-24400 MISC |
| etsi -- tetra_standard |
Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame counters, which are frequently broadcast by the infrastructure in an unauthenticated manner. An active adversary can manipulate the view of these counters in a mobile station, provoking keystream re-use. By sending crafted messages to the MS and analyzing MS responses, keystream for arbitrary frames can be recovered. |
2023-10-19 |
not yet calculated |
CVE-2022-24401 MISC |
| etsi -- tetra_standard |
The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystream generation phase, which is insufficient to safeguard against exhaustive search attacks. |
2023-10-19 |
not yet calculated |
CVE-2022-24402 MISC |
| etsi -- tetra_standard |
Lack of cryptographic integrity check on TETRA air-interface encrypted traffic. Since a stream cipher is employed, this allows an active adversary to manipulate cleartext data in a bit-by-bit fashion. |
2023-10-19 |
not yet calculated |
CVE-2022-24404 MISC |
| evolution _evo -- evolution _evo |
Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter. |
2023-10-19 |
not yet calculated |
CVE-2023-43341 MISC MISC |
| evolution -- evolution |
Cross-site scripting (XSS) vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword and cmspasswordconfim parameters |
2023-10-19 |
not yet calculated |
CVE-2023-43340 MISC MISC |
| expense_management_system -- expense_management_system |
An issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploaded to the sign-up.php component. |
2023-10-17 |
not yet calculated |
CVE-2023-44824 MISC MISC |
| extreme_networks_switch_engine -- extreme_networks_switch_engine |
Cross Site Request Forgery (CSRF) vulnerability in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 allows attackers to run arbitrary code and cause other unspecified impacts via /jsonrpc API. |
2023-10-16 |
not yet calculated |
CVE-2023-43118 MISC |
| extreme_networks_switch_engine -- extreme_networks_switch_engine |
An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to gain escalated privileges using crafted telnet commands via Redis server. |
2023-10-16 |
not yet calculated |
CVE-2023-43119 MISC |
| extreme_networks_switch_engine -- extreme_networks_switch_engine |
An issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7 and before 31.7.1 allows attackers to gain escalated privileges via crafted HTTP request. |
2023-10-16 |
not yet calculated |
CVE-2023-43120 MISC |
| extreme_networks_switch_engine -- extreme_networks_switch_engine |
A Directory Traversal vulnerability discovered in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7, and before 31.7.2 allows attackers to read arbitrary files. |
2023-10-16 |
not yet calculated |
CVE-2023-43121 MISC |
| fiber -- fiber |
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This vulnerability has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes. |
2023-10-16 |
not yet calculated |
CVE-2023-45141 MISC |
| fortinet -- fortianalyzer/fortimanager |
A server-side request forgery vulnerability [CWE-918] in Fortinet FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 and FortiManager version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 allows a remote attacker with low privileges to view sensitive data from internal servers or perform a local port scan via a crafted HTTP request. |
2023-10-20 |
not yet calculated |
CVE-2023-44256 MISC MISC |
| getsimplecms -- getsimplecms |
An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo(). |
2023-10-19 |
not yet calculated |
CVE-2023-46042 MISC |
| gifsicle-1.94 -- gifsicle-1.94 |
gifsicle-1.94 was found to have a floating point exception (FPE) vulnerability via resize_stream at src/xform.c. |
2023-10-18 |
not yet calculated |
CVE-2023-46009 MISC |
| go-ethereum -- go-ethereum |
Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic. |
2023-10-18 |
not yet calculated |
CVE-2023-42319 MISC MISC |
| google -- android |
In multiple functions of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
2023-10-18 |
not yet calculated |
CVE-2023-35656 MISC |
| google -- android |
In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
2023-10-18 |
not yet calculated |
CVE-2023-35663 MISC |
| grafana -- grafana |
Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn't call specific hosts. However, the restriction can be bypassed used punycode encoding of the characters in the request address. |
2023-10-17 |
not yet calculated |
CVE-2023-4399 MISC |
| hcl_software -- hcl_appscan |
An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gain elevated privileges. |
2023-10-17 |
not yet calculated |
CVE-2023-37537 MISC |
| hcl_software -- hcl_compass |
HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user's web browser. |
2023-10-18 |
not yet calculated |
CVE-2023-37502 MISC |
| hcl_software -- hcl_compass |
HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts. |
2023-10-19 |
not yet calculated |
CVE-2023-37503 MISC |
| hcl_software -- hcl_compass |
HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user. |
2023-10-19 |
not yet calculated |
CVE-2023-37504 MISC |
| hewlett_packard_enterprise -- hpe_integrated_lights-out |
HPE Integrated Lights-Out 5, and Integrated Lights-Out 6 using iLOrest may cause denial of service. |
2023-10-18 |
not yet calculated |
CVE-2023-30911 MISC |
| home_assistant -- home_assistant |
Home assistant is an open source home automation. The audit team's analyses confirmed that the redirect_uri and client_id are alterable when logging in. Consequently, the code parameter utilized to fetch the access_token post-authentication will be sent to the URL specified in the aforementioned parameters. Since an arbitrary URL is permitted and homeassistant.local represents the preferred, default domain likely used and trusted by many users, an attacker could leverage this weakness to manipulate a user and retrieve account access. Notably, this attack strategy is plausible if the victim has exposed their Home Assistant to the Internet, since after acquiring the victim's access_token the adversary would need to utilize it directly towards the instance to achieve any pertinent malicious actions. To achieve this compromise attempt, the attacker must send a link with a redirect_uri that they control to the victim's own Home Assistant instance. In the eventuality the victim authenticates via said link, the attacker would obtain code sent to the specified URL in redirect_uri, which can then be leveraged to fetch an access_token. Pertinently, an attacker could increase the efficacy of this strategy by registering a near identical domain to homeassistant.local, which at first glance may appear legitimate and thereby obfuscate any malicious intentions. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-20 |
not yet calculated |
CVE-2023-41893 MISC MISC |
| home_assistant -- home_assistant |
Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable via the *.ui.nabu.casa URL without authentication, even when the webhook is marked as Only accessible from the local network. This issue is facilitated by the SniTun proxy, which sets the source address to 127.0.0.1 on all requests sent to the public URL and forwarded to the local Home Assistant. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-20 |
not yet calculated |
CVE-2023-41894 MISC MISC |
| home_assistant -- home_assistant |
Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials and log in to another website that specifies the redirect_uri and client_id parameters. Although the redirect_uri validation typically ensures that it matches the client_id and the scheme represents either http or https, Home Assistant will fetch the client_id and check for <link rel="redirect_uri" href="..."> HTML tags on the page. These URLs are not subjected to the same scheme validation and thus allow for arbitrary JavaScript execution on the Home Assistant administration page via usage of javascript: scheme URIs. This Cross-site Scripting (XSS) vulnerability can be executed on the Home Assistant frontend domain, which may be used for a full takeover of the Home Assistant account and installation. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-19 |
not yet calculated |
CVE-2023-41895 MISC |
| home_assistant -- home_assistant |
Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected auth_callback=1, which is leveraged by the WebSocket authentication logic in tandem with the state parameter. The state parameter contains the hassUrl, which is subsequently utilized to establish a WebSocket connection. This behavior permits an attacker to create a malicious Home Assistant link with a modified state parameter that forces the frontend to connect to an alternative WebSocket backend. Henceforth, the attacker can spoof any WebSocket responses and trigger cross site scripting (XSS). Since the XSS is executed on the actual Home Assistant frontend domain, it can connect to the real Home Assistant backend, which essentially represents a comprehensive takeover scenario. Permitting the site to be iframed by other origins, as discussed in GHSA-935v-rmg9-44mw, renders this exploit substantially covert since a malicious website can obfuscate the compromise strategy in the background. However, even without this, the attacker can still send the auth_callback link directly to the victim user. To mitigate this issue, Cure53 advises modifying the WebSocket code's authentication flow. An optimal implementation in this regard would not trust the hassUrl passed in by a GET parameter. Cure53 must stipulate the significant time required of the Cure53 consultants to identify an XSS vector, despite holding full control over the WebSocket responses. In many areas, data from the WebSocket was properly sanitized, which hinders post-exploitation. The audit team eventually detected the js_url for custom panels, though generally, the frontend exhibited reasonable security hardening. This issue has been addressed in Home Assistant Core version 2023.8.0 and in the npm package home-assistant-js-websocket in version 8.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-19 |
not yet calculated |
CVE-2023-41896 MISC MISC |
| home_assistant -- home_assistant |
Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which specifies whether the web page is allowed to be framed. The omission of this and correlating headers facilitates covert clickjacking attacks and alternative exploit opportunities, such as the vector described in this security advisory. This fault incurs major risk, considering the ability to trick users into installing an external and malicious add-on with minimal user interaction, which would enable Remote Code Execution (RCE) within the Home Assistant application. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-19 |
not yet calculated |
CVE-2023-41897 MISC MISC MISC |
| home_assistant -- home_assistant |
Home assistant is an open source home automation. In affected versions the hassio.addon_stdin is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service (e.g.: through GHSA-h2jp-7grc-9xpp) may be able to invoke any Supervisor REST API endpoints with a POST request. An attacker able to exploit will be able to control the data dictionary, including its addon and input key/values. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: GHSL-2023-162. |
2023-10-19 |
not yet calculated |
CVE-2023-41899 MISC MISC |
| home_assistant -- home_assistant_companion_for_android |
Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: GHSL-2023-142. |
2023-10-19 |
not yet calculated |
CVE-2023-41898 MISC |
| home_assistant -- home_assistant_companion_for_ios |
The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistant installation. Combined with this security advisory, may result in full compromise and remote code execution (RCE). Version 2023.7 addresses this issue and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: GHSL-2023-161. |
2023-10-19 |
not yet calculated |
CVE-2023-44385 MISC |
| hp_inc. -- multiple_products |
A potential security vulnerability has been identified in the system BIOS for certain HP PC products which might allow escalation of privilege. HP is releasing firmware updates to mitigate the potential vulnerability. |
2023-10-18 |
not yet calculated |
CVE-2023-26300 MISC |
| i-doit_pro -- i-doit_pro |
I-doit pro 25 and below is vulnerable to Cross Site Scripting (XSS) via index.php. |
2023-10-21 |
not yet calculated |
CVE-2023-46003 MISC MISC |
| ichitaro_2023 -- ichitaro_2023 |
An out-of-bounds write vulnerability exists within the parsers for both the "DocumentViewStyles" and "DocumentEditStyles" streams of Ichitaro 2023 1.0.1.59372 when processing types 0x0000-0x0009 of a style record with the type 0x2008. A specially crafted document can cause memory corruption, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. |
2023-10-19 |
not yet calculated |
CVE-2023-35126 MISC MISC MISC |
| ichitaro_2023 -- ichitaro_2023 |
An integer overflow exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause the parser to make an under-sized allocation, which can later allow for memory corruption, potentially resulting in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. |
2023-10-19 |
not yet calculated |
CVE-2023-38127 MISC MISC |
| ichitaro_2023 -- ichitaro_2023 |
An out-of-bounds write vulnerability exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause a type confusion, which can lead to memory corruption and eventually arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. |
2023-10-19 |
not yet calculated |
CVE-2023-38128 MISC MISC MISC |
| ichitaro_2023 -- ichitaro_2023 |
A use-after-free vulnerability exists in the Figure stream parsing functionality of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause memory corruption, resulting in arbitrary code execution. Victim would need to open a malicious file to trigger this vulnerability. |
2023-10-19 |
not yet calculated |
CVE-2023-34366 MISC MISC |
| insyde -- insydeh2o |
An issue was discovered in TrEEConfigDriver in Insyde InsydeH2O with kernel 5.0 through 5.5. It can report false TPM PCR values, and thus mask malware activity. Devices use Platform Configuration Registers (PCRs) to record information about device and software configuration to ensure that the boot process is secure. (For example, Windows uses these PCR measurements to determine device health.) A vulnerable device can masquerade as a healthy device by extending arbitrary values into Platform Configuration Register (PCR) banks. This requires physical access to a target victim's device, or compromise of user credentials for a device. This issue is similar to CVE-2021-42299 (on Surface Pro devices). |
2023-10-19 |
not yet calculated |
CVE-2023-30633 MISC MISC |
| ivanti -- endpoint_manager |
Allows an authenticated attacker with network access to read arbitrary files on Endpoint Manager recently discovered on 2022 SU3 and all previous versions potentially leading to the leakage of sensitive information. |
2023-10-18 |
not yet calculated |
CVE-2023-35083 MISC |
| ivanti -- endpoint_manager |
Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which could allow an attacker to execute commands remotely. |
2023-10-18 |
not yet calculated |
CVE-2023-35084 MISC |
| ixp_data -- easy_install |
An issue found in IXP Data Easy Install 6.6.148840 allows a remote attacker to escalate privileges via insecure PRNG. |
2023-10-19 |
not yet calculated |
CVE-2023-27791 MISC |
| ixp_data -- easy_install |
An issue found in IXP Data Easy Install v.6.6.14884.0 allows an attacker to escalate privileges via lack of permissions applied to sub directories. |
2023-10-19 |
not yet calculated |
CVE-2023-27792 MISC |
| ixp_data -- easy_install |
An issue discovered in IXP Data Easy Install v.6.6.14884.0 allows local attackers to gain escalated privileges via weak encoding of sensitive information. |
2023-10-19 |
not yet calculated |
CVE-2023-27793 MISC |
| ixp_data -- easy_install |
An issue found in IXP Data Easy Install v.6.6.14884.0 allows a local attacker to gain privileges via a static XOR key. |
2023-10-19 |
not yet calculated |
CVE-2023-27795 MISC |
| ixp_data -- easy_install |
An issue discovered in IXP EasyInstall 6.6.14884.0 allows attackers to run arbitrary commands, gain escalated privilege, and cause other unspecified impacts via unauthenticated API calls. |
2023-10-19 |
not yet calculated |
CVE-2023-30131 MISC |
| ixp_data -- easy_install |
An issue discovered in IXP Data EasyInstall 6.6.14907.0 allows attackers to gain escalated privileges via static Cryptographic Key. |
2023-10-19 |
not yet calculated |
CVE-2023-30132 MISC |
| kaibutsunosato -- kaibutsunosato |
The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages. |
2023-10-20 |
not yet calculated |
CVE-2023-39731 MISC |
| knowband -- supercheckout |
KnowBand supercheckout > 5.0.7 and < 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module "Module One Page Checkout, Social Login & Mailchimp" (supercheckout), a guest can upload files with extensions .php |
2023-10-19 |
not yet calculated |
CVE-2023-45384 MISC MISC |
| langchain -- langchain |
In Langchain through 0.0.155, prompt injection allows execution of arbitrary code against the SQL service provided by the chain. |
2023-10-20 |
not yet calculated |
CVE-2023-32785 MISC |
| langchain -- langchain |
In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks. |
2023-10-20 |
not yet calculated |
CVE-2023-32786 MISC |
| langchain -- langchain |
LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server. |
2023-10-19 |
not yet calculated |
CVE-2023-46229 MISC MISC |
| leantime -- leantime |
Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-19 |
not yet calculated |
CVE-2023-45826 MISC MISC |
| liferay_inc. -- portal/dxp |
Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_translation_web_internal_portlet_TranslationPortlet_redirect parameter. |
2023-10-17 |
not yet calculated |
CVE-2023-42497 MISC |
| liferay_inc. -- portal/dxp |
Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping Address 3, (6) Shipping Zip, (7) Shipping City, (8) Shipping Region (9), Shipping Country, (10) Billing Name, (11) Billing Phone Number, (12) Billing Address, (13) Billing Address 2, (14) Billing Address 3, (15) Billing Zip, (16) Billing City, (17) Billing Region, (18) Billing Country, or (19) Region Code. |
2023-10-17 |
not yet calculated |
CVE-2023-42627 MISC |
| liferay_inc. -- portal/dxp |
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's 'Content' text field. |
2023-10-17 |
not yet calculated |
CVE-2023-42628 MISC |
| liferay_inc. -- portal/dxp |
Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field. |
2023-10-17 |
not yet calculated |
CVE-2023-42629 MISC |
| liferay_inc. -- portal/dxp |
Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into any non-HTML field of a linked source asset. |
2023-10-17 |
not yet calculated |
CVE-2023-44309 MISC |
| liferay_inc. -- portal/dxp |
Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field. |
2023-10-17 |
not yet calculated |
CVE-2023-44310 MISC |
| liferay_inc. -- portal/dxp |
Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941. |
2023-10-17 |
not yet calculated |
CVE-2023-44311 MISC |
| lylme_spage -- lylme_spage |
lylme_spage v1.7.0 was discovered to contain a SQL injection vulnerability via the userip parameter at function.php. |
2023-10-17 |
not yet calculated |
CVE-2023-45951 MISC |
| lylme_spage -- lylme_spage |
An arbitrary file upload vulnerability in the component ajax_link.php of lylme_spage v1.7.0 allows attackers to execute arbitrary code via uploading a crafted file. |
2023-10-17 |
not yet calculated |
CVE-2023-45952 MISC |
| m-files -- web_companion |
Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution |
2023-10-20 |
not yet calculated |
CVE-2023-5523 MISC |
| m-files -- web_companion |
Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution via specific file types |
2023-10-20 |
not yet calculated |
CVE-2023-5524 MISC |
| m-files-- web |
Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on user's browser via stored HTML document. |
2023-10-20 |
not yet calculated |
CVE-2023-2325 MISC |
| mantisbt -- mantisbt |
MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs. This issue has been addressed in commit 65c44883f which has been included in release 2.258. Users are advised to upgrade. Users unable to upgrade should disable wiki integration ( $g_wiki_enable = OFF;). |
2023-10-16 |
not yet calculated |
CVE-2023-44394 MISC MISC MISC |
| mattermost -- mattermost |
Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password entry being logged. |
2023-10-17 |
not yet calculated |
CVE-2023-5339 MISC |
| mattermost -- mattermost |
Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and freeze the mobile app of users when viewing that particular channel. |
2023-10-17 |
not yet calculated |
CVE-2023-5522 MISC |
| meta -- react_developer_tools |
The React Developer Tools extension registers a message listener with window.addEventListener('message', ) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitized before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL's via the victim's browser. |
2023-10-19 |
not yet calculated |
CVE-2023-5654 MISC |
| mintty -- mintty |
Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal. |
2023-10-19 |
not yet calculated |
CVE-2022-47583 MISC MISC |
| modoboa -- modoboa |
Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2. |
2023-10-20 |
not yet calculated |
CVE-2023-5688 MISC MISC |
| modoboa -- modoboa |
Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2. |
2023-10-20 |
not yet calculated |
CVE-2023-5689 MISC MISC |
| modoboa -- modoboa |
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2. |
2023-10-20 |
not yet calculated |
CVE-2023-5690 MISC MISC |
| mosparo -- mosparo |
Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3. |
2023-10-20 |
not yet calculated |
CVE-2023-5687 MISC MISC |
| motorola -- mobile_radio |
A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is improperly handled, allowing for a write-anything-anywhere scenario. This can be leveraged to obtain arbitrary code execution inside the teds_app binary, which runs with root privileges. |
2023-10-19 |
not yet calculated |
CVE-2022-26941 MISC |
| motorola -- mobile_radio |
The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives. |
2023-10-19 |
not yet calculated |
CVE-2022-26942 MISC |
| motorola -- mobile_radio |
The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count register as its sole entropy source. Low boottime entropy and limited re-seeding of the pool renders the authentication challenge vulnerable to two attacks. First, due to the limited boottime pool entropy, an adversary can derive the contents of the entropy pool by an exhaustive search of possible values, based on an observed authentication challenge. Second, an adversary can use knowledge of the entropy pool to predict authentication challenges. As such, the unit is vulnerable to CVE-2022-24400. |
2023-10-19 |
not yet calculated |
CVE-2022-26943 MISC |
| motorola -- mobile_radio |
Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoC provides two memory protection units, MPU1 and MPU2, to enforce the trust boundary between the two cores. Since both units are left unconfigured by the firmwares, an adversary with control over either core can trivially gain code execution on the other, by overwriting code located in shared RAM or DDR2 memory regions. |
2023-10-19 |
not yet calculated |
CVE-2022-27813 MISC |
| mycli -- mycli |
Inadequate encryption strength in mycli 1.27.0 allows attackers to view sensitive information via /mycli/config.py |
2023-10-19 |
not yet calculated |
CVE-2023-44690 MISC |
| nagvis -- nagvis |
XSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php. |
2023-10-20 |
not yet calculated |
CVE-2023-46287 MISC MISC MISC |
| national_instruments -- system_configuration |
A stack-based buffer overflow vulnerability exists in NI System Configuration that could result in information disclosure and/or arbitrary code execution. Successful exploitation requires that an attacker can provide a specially crafted response. This affects NI System Configuration 2023 Q3 and all previous versions. |
2023-10-18 |
not yet calculated |
CVE-2023-4601 MISC |
| netentsec_wangkang_technology -- ns-asg_application_security_gateway |
A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/list_addr_fwresource_ip.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243057 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
2023-10-20 |
not yet calculated |
CVE-2023-5681 MISC MISC MISC |
| nocodb -- nocodb |
Nocodb is an open source Airtable alternative. Affected versions of nocodb contain a SQL injection vulnerability, that allows an authenticated attacker with creator access to query the underlying database. By supplying a specially crafted payload to the given an attacker can inject arbitrary SQL queries to be executed. Since this is a blind SQL injection, an attacker may need to use time-based payloads which would include a function to delay execution for a given number of seconds. The response time indicates whether the result of the query execution was true or false. Depending on the result, the HTTP response will be returned after a given number of seconds, indicating TRUE, or immediately, indicating FALSE. In that way, an attacker can reveal the data present in the database. This vulnerability has been addressed in version 0.111.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GHSL-2023-141. |
2023-10-17 |
not yet calculated |
CVE-2023-43794 MISC |
| node.js -- node.js |
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. |
2023-10-18 |
not yet calculated |
CVE-2023-39331 MISC |
| node.js -- node.js |
Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through non-Buffer Uint8Array objects. This is distinct from CVE-2023-32004 (report 2038134), which only referred to Buffer objects. However, the vulnerability follows the same pattern using Uint8Array instead of Buffer. Impacts: This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. |
2023-10-18 |
not yet calculated |
CVE-2023-39332 MISC |
| node.js -- node.js |
When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js. |
2023-10-18 |
not yet calculated |
CVE-2023-38552 MISC |
| nxp -- multiple_products |
A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family processors. Under certain conditions, a crafted Flattened Image Tree (FIT) format structure can be used to overwrite SPL memory, allowing unauthenticated software to execute on the target, leading to privilege escalation. This affects i.MX 8M, i.MX 8M Mini, i.MX 8M Nano, and i.MX 8M Plus. |
2023-10-17 |
not yet calculated |
CVE-2023-39902 MISC MISC |
| ojs -- ojs |
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16. |
2023-10-18 |
not yet calculated |
CVE-2023-5626 MISC MISC |
| onsinview2 -- onsinview2 |
Improper restriction of operations within the bounds of a memory buffer issue exists in OnSinView2 versions 2.0.1 and earlier. If this vulnerability is exploited, information may be disclosed, or arbitrary code may be executed by having a user open a specially crafted OnSinView2 project file. |
2023-10-17 |
not yet calculated |
CVE-2023-42506 MISC MISC |
| onsinview2 -- onsinview2 |
Stack-based buffer overflow vulnerability exists in OnSinView2 versions 2.0.1 and earlier. If this vulnerability is exploited, information may be disclosed, or arbitrary code may be executed by having a user open a specially crafted OnSinView2 project file. |
2023-10-17 |
not yet calculated |
CVE-2023-42507 MISC MISC |
| openfga -- openfga |
OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial-of-service attack. When a number of ListObjects calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability. |
2023-10-17 |
not yet calculated |
CVE-2023-45810 MISC |
| openvpn_inc -- openvpn_connect |
OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the user's credentials |
2023-10-17 |
not yet calculated |
CVE-2022-3761 MISC MISC |
| papercut -- mobility_print_server |
A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an authenticated attacker to achieve read-only access to the server's filesystem, because requests beginning with "GET /ui/static/..//.." reach getStaticContent in UIContentResource.class in the static-content-files servlet. |
2023-10-19 |
not yet calculated |
CVE-2023-31046 MISC MISC MISC MISC |
| pdm -- pdm |
pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g., an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project foo can be targeted by creating the project foo-2 and uploading the file foo-2-2.tar.gz to pypi.org. PyPI will see this as project foo-2 version 2, while PDM will see this as project foo version 2-2. The version must only be parseable as a version and the filename must be a prefix of the project name, but it's not verified to match the version being installed. Version 2-2 is also not a valid normalized version per PEP 440. Matching the project name exactly (not just prefix) would fix the issue. When installing dependencies with PDM, what's actually installed could differ from what's listed in pyproject.toml (including arbitrary code execution on install). It could also be used for downgrade attacks by only changing the version. This issue has been addressed in commit 6853e2642df which is included in release version 2.9.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-20 |
not yet calculated |
CVE-2023-45805 MISC MISC MISC MISC MISC |
| pegasystems_inc. -- pega_platform |
Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation |
2023-10-18 |
not yet calculated |
CVE-2023-32087 MISC |
| pegasystems_inc. -- pega_platform |
Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation |
2023-10-18 |
not yet calculated |
CVE-2023-32088 MISC |
| pegasystems_inc. -- pega_platform |
Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description |
2023-10-18 |
not yet calculated |
CVE-2023-32089 MISC |
| pleaser -- pleaser |
please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.) |
2023-10-20 |
not yet calculated |
CVE-2023-46277 MISC MISC MISC MISC |
| prestashop -- dm_concept_configurator |
DM Concept configurator before v4.9.4 was discovered to contain a SQL injection vulnerability via the component ConfiguratorAttachment::getAttachmentByToken. |
2023-10-19 |
not yet calculated |
CVE-2023-43986 MISC MISC |
| prestashop -- prestashop |
In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via PireosPayValidationModuleFrontController::postProcess(). |
2023-10-17 |
not yet calculated |
CVE-2023-45375 MISC |
| prestashop -- prestashop |
In the module "Carousels Pack - Instagram, Products, Brands, Supplier" (hicarouselspack) for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a guest can perform SQL injection via HiCpProductGetter::getViewedProduct().` |
2023-10-19 |
not yet calculated |
CVE-2023-45376 MISC MISC |
| prestashop -- prestashop |
In the module "Rotator Img" (posrotatorimg) in versions at least up to 1.1 from PosThemes for PrestaShop, a guest can perform SQL injection. |
2023-10-19 |
not yet calculated |
CVE-2023-45379 MISC MISC |
| prestashop -- prestashop |
In the module "Creative Popup" (creativepopup) up to version 1.6.9 from WebshopWorks for PrestaShop, a guest can perform SQL injection via cp_download_popup(). |
2023-10-19 |
not yet calculated |
CVE-2023-45381 MISC MISC |
| prestashop -- prestashop |
In the module "SoNice etiquetage" (sonice_etiquetage) up to version 2.5.9 from Common-Services for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system. |
2023-10-18 |
not yet calculated |
CVE-2023-45383 MISC MISC |
| prestashop -- prestashop |
In the module extratabspro before version 2.2.8 from MyPresta.eu for PrestaShop, a guest can perform SQL injection via extratabspro::searchcategory(), extratabspro::searchproduct() and `extratabspro::searchmanufacturer().' |
2023-10-17 |
not yet calculated |
CVE-2023-45386 MISC |
| proself -- multiple_products |
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker. |
2023-10-18 |
not yet calculated |
CVE-2023-45727 MISC MISC |
| qad -- search_server |
The QAD Search Server is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to, and including, 1.0.0.315 due to insufficient checks on indexes. This makes it possible for unauthenticated attackers to create a new index and inject a malicious web script into its name, that will execute whenever a user accesses the search page. |
2023-10-20 |
not yet calculated |
CVE-2023-45471 MISC |
| qnap_systems_inc. -- qusbcam2 |
An OS command injection vulnerability has been reported to affect QUSBCam2. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: QUSBCam2 2.0.3 ( 2023/06/15 ) and later |
2023-10-20 |
not yet calculated |
CVE-2023-23373 MISC |
| quick_cms -- quick_cms |
Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Languages Menu component. |
2023-10-19 |
not yet calculated |
CVE-2023-43342 MISC MISC |
| quick_cms -- quick_cms |
Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the SEO - Meta description parameter in the Pages Menu component. |
2023-10-19 |
not yet calculated |
CVE-2023-43344 MISC |
| quick_cms -- quick_cms |
Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Content - Name parameter in the Pages Menu component. |
2023-10-19 |
not yet calculated |
CVE-2023-43345 MISC |
| quick_cms -- quick_cms |
Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Backend - Dashboard parameter in the Languages Menu component. |
2023-10-20 |
not yet calculated |
CVE-2023-43346 MISC MISC |
| qumu_inc. -- multicast_extension |
A privilege escalation vulnerability exists within the Qumu Multicast Extension v2 before 2.0.63 for Windows. When a standard user triggers a repair of the software, a pop-up window opens with SYSTEM privileges. Standard users may use this to gain arbitrary code execution as SYSTEM. |
2023-10-19 |
not yet calculated |
CVE-2023-45883 MISC MISC |
| radare -- radare2 |
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. |
2023-10-20 |
not yet calculated |
CVE-2023-5686 MISC MISC |
| reconftw -- reconftw |
reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities. A vulnerability has been identified in reconftw where inadequate validation of retrieved subdomains may lead to a Remote Code Execution (RCE) attack. An attacker can exploit this vulnerability by crafting a malicious CSP entry on it's own domain. Successful exploitation can lead to the execution of arbitrary code within the context of the application, potentially compromising the system. This issue has been addressed in version 2.7.1.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-20 |
not yet calculated |
CVE-2023-46117 MISC MISC |
| redis -- redis |
Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory. |
2023-10-18 |
not yet calculated |
CVE-2023-45145 MISC MISC |
| roundcube -- roundcube |
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code. |
2023-10-18 |
not yet calculated |
CVE-2023-5631 MISC MISC MISC MISC MISC MISC MISC MISC MISC |
| ruckus_wireless -- ruckus_cloudpath |
Cross Site Scripting vulnerability in Ruckus Wireless (CommScope) Ruckus CloudPath v.5.12.54414 allows a remote attacker to escalate privileges via a crafted script to the macaddress parameter in the onboarding portal. |
2023-10-19 |
not yet calculated |
CVE-2023-45992 MISC MISC MISC MISC MISC |
| santesoft -- dicom_viewer_pro |
Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. |
2023-10-19 |
not yet calculated |
CVE-2023-39431 MISC |
| santesoft -- dicom_viewer_pro |
Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to a stack-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. |
2023-10-19 |
not yet calculated |
CVE-2023-35986 MISC |
| santesoft -- sante_fft_imaging |
Santesoft Sante FFT Imaging lacks proper validation of user-supplied data when parsing DICOM files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. |
2023-10-19 |
not yet calculated |
CVE-2023-5059 MISC |
| secudos -- qiata |
SECUDOS Qiata (DOMOS OS) 4.13 has Insecure Permissions for the previewRm.sh daily cronjob. To exploit this, an attacker needs access as a low-privileged user to the underlying DOMOS system. Every user on the system has write permission for previewRm.sh, which is executed by the root user. |
2023-10-20 |
not yet calculated |
CVE-2023-40361 MISC |
| silicon_labs -- gecko_bootloader |
An integer overflow in Silicon Labs Gecko Bootloader version 4.3.1 and earlier allows unbounded memory access when reading from or writing to storage slots. |
2023-10-20 |
not yet calculated |
CVE-2023-3487 MISC MISC |
| silverstripe-graphql -- silverstripe-graphql |
silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack (DDOS attack) against a website. This mostly affects websites with publicly exposed graphql schemas. If your Silverstripe CMS project does not expose a public facing graphql schema, a user account is required to trigger the DDOS attack. If your site is hosted behind a content delivery network (CDN), such as Imperva or CloudFlare, this may further mitigate the risk. This issue has been addressed in versions 3.8.2, 4.1.3, 4.2.5, 4.3.4, and 5.0.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-16 |
not yet calculated |
CVE-2023-40180 MISC MISC MISC MISC MISC |
| sitolog -- sitologapplicationconnect |
Sitolog sitologapplicationconnect v7.8.a and before was discovered to contain a SQL injection vulnerability via the component /activate_hook.php. |
2023-10-20 |
not yet calculated |
CVE-2023-37824 MISC |
| small_crm -- small_crm |
Stored Cross-Site Scripting (XSS) vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker to store and execute malicious javascript code in the Admin panel which leads to Admin account takeover. |
2023-10-20 |
not yet calculated |
CVE-2023-45394 MISC |
| sophos -- sophos_firewall |
A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the password type is set to "Specified by sender". |
2023-10-18 |
not yet calculated |
CVE-2023-5552 MISC |
| sourcecodester -- best_courier_management_system |
Sourcecodester Best Courier Management System 1.0 is vulnerable to Arbitrary file upload in the update_user function. |
2023-10-18 |
not yet calculated |
CVE-2023-46004 MISC |
| sourcecodester -- best_courier_management_system |
Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_branch.php. |
2023-10-18 |
not yet calculated |
CVE-2023-46005 MISC |
| sourcecodester -- best_courier_management_system |
Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_user.php. |
2023-10-18 |
not yet calculated |
CVE-2023-46006 MISC |
| sourcecodester -- best_courier_management_system |
Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_staff.php. |
2023-10-18 |
not yet calculated |
CVE-2023-46007 MISC |
| sourcecodester -- free_hospital_management_system |
A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /vm/admin/doctors.php of the component Parameter Handler. The manipulation of the argument search leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-242186 is the identifier assigned to this vulnerability. |
2023-10-15 |
not yet calculated |
CVE-2023-5587 MISC MISC MISC |
| sourcecodester -- judging_management_system |
A vulnerability was found in SourceCodester Judging Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-242188. |
2023-10-15 |
not yet calculated |
CVE-2023-5589 MISC MISC MISC |
| south_river_technologies -- titan_mft/sftp |
Insufficient path validation when extracting a zip archive in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal |
2023-10-16 |
not yet calculated |
CVE-2023-45685 MISC MISC |
| south_river_technologies -- titan_mft/sftp |
Insufficient path validation when writing a file via WebDAV in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal |
2023-10-16 |
not yet calculated |
CVE-2023-45686 MISC MISC |
| south_river_technologies -- titan_mft/sftp |
A session fixation vulnerability in South River Technologies' Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the server's authentication if they can trick an administrator into authorizing a session id of their choosing. |
2023-10-16 |
not yet calculated |
CVE-2023-45687 MISC MISC |
| south_river_technologies -- titan_mft/sftp |
Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of an arbitrary file on the filesystem using path traversal in the ftp "SIZE" command |
2023-10-16 |
not yet calculated |
CVE-2023-45688 MISC MISC |
| south_river_technologies -- titan_mft/sftp |
Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker with administrative privileges to read any file on the filesystem via path traversal |
2023-10-16 |
not yet calculated |
CVE-2023-45689 MISC MISC |
| south_river_technologies -- titan_mft/sftp |
Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem |
2023-10-16 |
not yet calculated |
CVE-2023-45690 MISC MISC |
| spring -- amqp |
In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however, by default, when no allowed list was provided, all classes could be deserialized. Specifically, an application is vulnerable if * the SimpleMessageConverter or SerializerMessageConverter is used * the user does not configure allowed list patterns * untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content. |
2023-10-19 |
not yet calculated |
CVE-2023-34050 MISC |
| stb_image -- stb_image |
stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in stbi__gif_load_next. This happens because two_back points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory allocation information. |
2023-10-21 |
not yet calculated |
CVE-2023-45661 MISC MISC MISC |
| stb_image -- stb_image |
stb_image is a single file MIT licensed library for processing images. When stbi_set_flip_vertically_on_load is set to TRUE and req_comp is set to a number that doesn't match the real number of components per pixel, the library attempts to flip the image vertically. A crafted image file can trigger memcpy out-of-bounds read because bytes_per_pixel used to calculate bytes_per_row doesn't match the real image array dimensions. |
2023-10-21 |
not yet calculated |
CVE-2023-45662 MISC MISC |
| stb_image -- stb_image |
stb_image is a single file MIT licensed library for processing images. The stbi__getn function reads a specified number of bytes from context (typically a file) into the specified buffer. In case the file stream points to the end, it returns zero. There are two places where its return value is not checked: In the stbi__hdr_load function and in the stbi__tga_load function. The latter of the two is likely more exploitable as an attacker may also control the size of an uninitialized buffer. |
2023-10-21 |
not yet calculated |
CVE-2023-45663 MISC MISC MISC MISC |
| stb_image -- stb_image |
stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger stbi__load_gif_main_outofmem attempt to double-free the out variable. This happens in stbi__load_gif_main because when the layers * stride value is zero the behavior is implementation defined, but common that realloc frees the old memory and returns null pointer. Since it attempts to double-free the memory a few lines below the first "free", the issue can be potentially exploited only in a multi-threaded environment. In the worst case this may lead to code execution. |
2023-10-21 |
not yet calculated |
CVE-2023-45664 MISC MISC |
| stb_image -- stb_image |
stb_image is a single file MIT licensed library for processing images. It may look like stbi__load_gif_main doesn't give guarantees about the content of output value *delays upon failure. Although it sets *delays to zero at the beginning, it doesn't do it in case the image is not recognized as GIF and a call to stbi__load_gif_main_outofmem only frees possibly allocated memory in *delays without resetting it to zero. Thus it would be fair to say the caller of stbi__load_gif_main is responsible to free the allocated memory in *delays only if stbi__load_gif_main returns a non null value. However, at the same time the function may return null value but fail to free the memory in *delays if internally stbi__convert_format is called and fails. The issue may lead to a memory leak if the caller chooses to free delays only when stbi__load_gif_main didn't fail or to a double-free if the delays is always freed. |
2023-10-21 |
not yet calculated |
CVE-2023-45666 MISC MISC MISC |
| stb_image -- stb_image |
stb_image is a single file MIT licensed library for processing images. If stbi__load_gif_main in stbi_load_gif_from_memory fails it returns a null pointer and may keep the z variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls stbi__vertical_flip_slices with the null pointer result value and the uninitialized z value. This may result in a program crash. |
2023-10-21 |
not yet calculated |
CVE-2023-45667 MISC MISC MISC |
| stb_vorbis -- stb_vorbis |
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in f->vendor[len] = (char)'\0';. The root cause is that if the len read in start_decoder is -1 and len + 1 becomes 0 when passed to setup_malloc. The setup_malloc behaves differently when f->alloc.alloc_buffer is pre-allocated. Instead of returning NULL as in malloc case it shifts the pre-allocated buffer by zero and returns the currently available memory block. This issue may lead to code execution. |
2023-10-21 |
not yet calculated |
CVE-2023-45675 MISC MISC MISC MISC |
| stb_vorbis -- stb_vorbis |
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in f->vendor[i] = get8_packet(f);. The root cause is an integer overflow in setup_malloc. A sufficiently large value in the variable sz overflows with sz+7 in and the negative value passes the maximum available memory buffer check. This issue may lead to code execution. |
2023-10-21 |
not yet calculated |
CVE-2023-45676 MISC MISC MISC |
| stb_vorbis -- stb_vorbis |
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in f->vendor[len] = (char)'\0';. The root cause is that if len read in start_decoder is a negative number and setup_malloc successfully allocates memory in that case, but memory write is done with a negative index len. Similarly, if len is INT_MAX the integer overflow len+1 happens in f->vendor = (char*)setup_malloc(f, sizeof(char) * (len+1)); and f->comment_list[i] = (char*)setup_malloc(f, sizeof(char) * (len+1));. This issue may lead to code execution. |
2023-10-21 |
not yet calculated |
CVE-2023-45677 MISC MISC MISC MISC MISC MISC |
| stb_vorbis -- stb_vorbis |
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in start_decoder because at maximum m->submaps can be 16 but submap_floor and submap_residue are declared as arrays of 15 elements. This issue may lead to code execution. |
2023-10-21 |
not yet calculated |
CVE-2023-45678 MISC MISC MISC |
| stb_vorbis -- stb_vorbis |
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in start_decoder. In that case the function returns early, but some of the pointers in f->comment_list are left initialized and later setup_free is called on these pointers in vorbis_deinit. This issue may lead to code execution. |
2023-10-21 |
not yet calculated |
CVE-2023-45679 MISC MISC MISC |
| stb_vorbis -- stb_vorbis |
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in start_decoder. In that case the function returns early, the f->comment_list is set to NULL, but f->comment_list_length is not reset. Later in vorbis_deinit it tries to dereference the NULL pointer. This issue may lead to denial of service. |
2023-10-21 |
not yet calculated |
CVE-2023-45680 MISC MISC MISC |
| stb_vorbis -- stb_vorbis |
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in start_decoder. The root cause is a potential integer overflow in sizeof(char*) * (f->comment_list_length) which may make setup_malloc allocate less memory than required. Since there is another integer overflow an attacker may overflow it too to force setup_malloc to return 0 and make the exploit more reliable. This issue may lead to code execution. |
2023-10-21 |
not yet calculated |
CVE-2023-45681 MISC MISC |
| stb_vorbis -- stb_vorbis |
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds read in DECODE macro when var is negative. As it can be seen in the definition of DECODE_RAW a negative var is a valid value. This issue may be used to leak internal memory allocation information. |
2023-10-21 |
not yet calculated |
CVE-2023-45682 MISC MISC MISC MISC |
| subrion_cms -- subrion_cms |
Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser, adminusername and adminemail. |
2023-10-19 |
not yet calculated |
CVE-2023-43875 MISC MISC |
| superwebmailer -- superwebmailer |
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Export SQL Injection via the size parameter. |
2023-10-21 |
not yet calculated |
CVE-2023-38190 MISC MISC |
| superwebmailer -- superwebmailer |
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows spamtest_external.php XSS via a crafted filename. |
2023-10-20 |
not yet calculated |
CVE-2023-38191 MISC MISC |
| superwebmailer -- superwebmailer |
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows superadmincreate.php XSS via crafted incorrect passwords. |
2023-10-21 |
not yet calculated |
CVE-2023-38192 MISC MISC |
| superwebmailer -- superwebmailer |
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Remote Code Execution via a crafted sendmail command line. |
2023-10-21 |
not yet calculated |
CVE-2023-38193 MISC MISC |
| superwebmailer -- superwebmailer |
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows keepalive.php XSS via a GET parameter. |
2023-10-21 |
not yet calculated |
CVE-2023-38194 MISC MISC |
| synchrony -- deobfuscator |
Synchrony deobfuscator is a javascript cleaner & deobfuscator. A __proto__ pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A __proto__ pollution vulnerability exists in the LiteralMap transformer allowing crafted input to modify properties in the Object prototype. A fix has been released in [email protected]. Users are advised to upgrade. Users unable to upgrade should launch node with the [--disable-proto=delete][disable-proto] or [--disable-proto=throw][disable-proto] flags |
2023-10-17 |
not yet calculated |
CVE-2023-45811 MISC MISC MISC |
| tauri -- tauri |
Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri documentation used an insecure example configuration in the Vite guide to showcase how to use Tauri together with Vite. Copying the following snippet envPrefix: ['VITE_', 'TAURI_'], from this guide into the vite.config.ts of a Tauri project leads to bundling the TAURI_PRIVATE_KEY and TAURI_KEY_PASSWORD into the Vite frontend code and therefore leaking this value to the released Tauri application. Using the envPrefix: ['VITE_'], or any other framework than Vite means you are not impacted by this advisory. Users are advised to rotate their updater private key if they are affected by this (requires Tauri CLI >=1.5.5). After updating the envPrefix configuration, generate a new private key with tauri signer generate, saving the new private key and updating the updater's pubkey value on tauri.conf.json with the new public key. To update your existing application, the next application build must be signed with the older private key in order to be accepted by the existing application. |
2023-10-20 |
not yet calculated |
CVE-2023-46115 MISC MISC |
| terminalfour -- terminalfour |
In Terminalfour before 8.3.16, misconfigured LDAP users are able to login with an invalid password. |
2023-10-16 |
not yet calculated |
CVE-2023-29484 MISC MISC |
| texas_instruments -- omap |
The AES implementation in the Texas Instruments OMAP L138 (secure variants), present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext inputs. Using this side channel, the SK_LOAD secure kernel routine can be used to recover the Customer Encryption Key (CEK). |
2023-10-19 |
not yet calculated |
CVE-2022-25332 MISC |
| texas_instruments -- omap |
The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and append a forged payload, to be encrypted using the CEK (obtainable through CVE-2022-25332) in order to obtain arbitrary code execution in secure context. This constitutes a full break of the TEE security architecture. |
2023-10-19 |
not yet calculated |
CVE-2022-25333 MISC |
| texas_instruments -- omap |
The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) lacks a bounds check on the signature size field in the SK_LOAD module loading routine, present in mask ROM. A module with a sufficiently large signature field causes a stack overflow, affecting secure kernel data pages. This can be leveraged to obtain arbitrary code execution in secure supervisor context by overwriting a SHA256 function pointer in the secure kernel data area when loading a forged, unsigned SK_LOAD module encrypted with the CEK (obtainable through CVE-2022-25332). This constitutes a full break of the TEE security architecture. |
2023-10-19 |
not yet calculated |
CVE-2022-25334 MISC |
| thingnario_photon -- thingnario_photon |
An issue in ThingNario Photon v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the ping function to the "thingnario Logger Maintenance Webpage" endpoint. |
2023-10-21 |
not yet calculated |
CVE-2023-46055 MISC |
| thirty_bees_core -- thirty_bees_core |
Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload. |
2023-10-18 |
not yet calculated |
CVE-2023-45958 MISC MISC |
| tinylab -- tinylab |
TinyLab linux-lab v1.1-rc1 and cloud-labv0.8-rc2, v1.1-rc1 are vulnerable to insecure permissions. The default configuration could cause Container Escape. |
2023-10-19 |
not yet calculated |
CVE-2022-42150 MISC MISC MISC MISC MISC |
| tinymce -- tinymce |
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE's Notification Manager API. The vulnerability exploits TinyMCE's unfiltered notification system, which is used in error handling. The conditions for this exploit requires carefully crafted malicious content to have been inserted into the editor and a notification to have been triggered. When a notification was opened, the HTML within the text argument was displayed unfiltered in the notification. The vulnerability allowed arbitrary JavaScript execution when a notification presented in the TinyMCE UI for the current user. This issue could also be exploited by any integration which uses a TinyMCE notification to display unfiltered HTML content. This vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring that the HTML displayed in the notification is sanitized, preventing the exploit. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-19 |
not yet calculated |
CVE-2023-45819 MISC |
| tinymce -- tinymce |
TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE's core undo and redo functionality. When a carefully crafted HTML snippet passes the XSS sanitization layer, it is manipulated as a string by internal trimming functions before being stored in the undo stack. If the HTML snippet is restored from the undo stack, the combination of the string manipulation and reparative parsing by either the browser's native DOMParser API (TinyMCE 6) or the SaxParser API (TinyMCE 5) mutates the HTML maliciously, allowing an XSS payload to be executed. This vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring HTML is trimmed using node-level manipulation instead of string manipulation. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-19 |
not yet calculated |
CVE-2023-45818 MISC MISC MISC MISC MISC |
| tongda -- oa |
A vulnerability has been found in Tongda OA 2017 and classified as critical. This vulnerability affects unknown code of the file general/hr/training/record/delete.php. The manipulation of the argument RECORD_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-243058 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
2023-10-20 |
not yet calculated |
CVE-2023-5682 MISC MISC MISC |
| torbot -- torbot |
Torbot is an open source tor network intelligence tool. In affected versions the torbot.modules.validators.validate_link function uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows an attacker to cause an application crash using a well-crafted argument. An attacker can use a well-crafted URL argument to exploit the vulnerability in the regular expression and cause a Denial of Service on the system. The validators file has been removed in version 4.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-18 |
not yet calculated |
CVE-2023-45813 MISC MISC |
| tsplus -- remote_work |
TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source code for the secure single sign-on web portal. NOTE: CVE-2023-31069 is only about the TSplus Remote Access product, not the TSplus Remote Work product. |
2023-10-17 |
not yet calculated |
CVE-2023-27132 MISC |
| tsplus -- remote_work |
TSplus Remote Work 16.0.0.0 has weak permissions for .exe, .js, and .html files under the %PROGRAMFILES(X86)%\TSplus-RemoteWork\Clients\www folder. This may enable privilege escalation if a different local user modifies a file. NOTE: CVE-2023-31067 and CVE-2023-31068 are only about the TSplus Remote Access product, not the TSplus Remote Work product. |
2023-10-17 |
not yet calculated |
CVE-2023-27133 MISC |
| unicopia -- unicopia |
Sollace Unicopia version 1.1.1 and before was discovered to deserialize untrusted data, allowing attackers to execute arbitrary code. |
2023-10-20 |
not yet calculated |
CVE-2023-39680 MISC |
| urllib3 -- urllib3 |
urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like POST) to GET as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality, we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with redirects=False and disable automatic redirects with redirects=False and handle 301, 302, and 303 redirects manually by stripping the HTTP request body. |
2023-10-17 |
not yet calculated |
CVE-2023-45803 MISC MISC MISC MISC |
| vmware -- aria_operations |
VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution. |
2023-10-20 |
not yet calculated |
CVE-2023-34051 MISC |
| vmware -- aria_operations |
VMware Aria Operations for Logs contains a deserialization vulnerability. A malicious actor with non-administrative access to the local system can trigger the deserialization of data which could result in authentication bypass. |
2023-10-20 |
not yet calculated |
CVE-2023-34052 MISC |
| vmware -- fusion |
VMware Fusion (13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time. |
2023-10-20 |
not yet calculated |
CVE-2023-34045 MISC |
| vmware -- fusion |
VMware Fusion (13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time. |
2023-10-20 |
not yet calculated |
CVE-2023-34046 MISC |
| vmware -- workstation/fusion |
VMware Workstation (17.x prior to 17.5) and Fusion (13.x prior to 13.5) contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine. |
2023-10-20 |
not yet calculated |
CVE-2023-34044 MISC |
| wagtail -- wagtail |
Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user accounts, and by modifying URL parameters, the user can retrieve the display name for any user. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 4.1.8 (LTS), 5.0.5 and 5.1.3. The fix is also included in Release Candidate 1 of the forthcoming Wagtail 5.2 release. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
2023-10-19 |
not yet calculated |
CVE-2023-45809 MISC MISC |
| wbce_cms -- wbce_cms |
Cross Site Scripting (XSS) vulnerability in WBCE CMS v.1.6.1 and before allows a remote attacker to escalate privileges via a crafted script to the website_footer parameter in the admin/settings/save.php component. |
2023-10-21 |
not yet calculated |
CVE-2023-46054 MISC |
| webjet_cms -- webjet_cms |
Interway a.s WebJET CMS 8.6.896 is vulnerable to Cross Site Scripting (XSS). |
2023-10-19 |
not yet calculated |
CVE-2022-37830 MISC MISC |
| weintek -- multiple_products |
In Weintek's cMT3000 HMI Web CGI device, the cgi-bin command_wb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication. |
2023-10-19 |
not yet calculated |
CVE-2023-38584 MISC MISC |
| weintek -- multiple_products |
In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device. |
2023-10-19 |
not yet calculated |
CVE-2023-40145 MISC MISC |
| weintek -- multiple_products |
In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication. |
2023-10-19 |
not yet calculated |
CVE-2023-43492 MISC MISC |
| wipotec_gmbh -- comscale |
WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 fails to validate user sessions, allowing unauthenticated attackers to read files from the underlying operating system and obtain directory listings. |
2023-10-18 |
not yet calculated |
CVE-2023-45912 MISC |
| wipotec_gmbh -- comscale |
An issue in WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 allows unauthenticated attackers to login as any user without a password. |
2023-10-18 |
not yet calculated |
CVE-2023-45911 MISC |
| wordpress -- wordpress |
Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in David Lingren Media Library Assistant plugin <= 3.11 versions. |
2023-10-17 |
not yet calculated |
CVE-2023-24385 MISC |
| wordpress -- wordpress |
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ezoic AmpedSense - AdSense Split Tester plugin <= 4.68 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-25476 MISC |
| wordpress -- wordpress |
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Theme Blvd Tweeple plugin <= 0.9.5 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-30781 MISC |
| wordpress -- wordpress |
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in MyTechTalky User Location and IP plugin <= 1.6 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-31217 MISC |
| wordpress -- wordpress |
The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attackers to increase or decrease the rating of a post. |
2023-10-20 |
not yet calculated |
CVE-2023-3998 MISC MISC |
| wordpress -- wordpress |
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF - WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7.1 versions. |
2023-10-17 |
not yet calculated |
CVE-2023-44990 MISC |
| wordpress -- wordpress |
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wp3sixty Woo Custom Emails plugin <= 2.2 versions. |
2023-10-17 |
not yet calculated |
CVE-2023-45004 MISC |
| wordpress -- wordpress |
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ByConsole WooODT Lite - WooCommerce Order Delivery or Pickup with Date Time Location plugin <= 2.4.6 versions. |
2023-10-17 |
not yet calculated |
CVE-2023-45006 MISC |
| wordpress -- wordpress |
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fotomoto plugin <= 1.2.8 versions. |
2023-10-17 |
not yet calculated |
CVE-2023-45007 MISC |
| wordpress -- wordpress |
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPJohnny Comment Reply Email plugin <= 1.0.3 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45008 MISC |
| wordpress -- wordpress |
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex MacArthur Complete Open Graph plugin <= 3.4.5 versions. |
2023-10-17 |
not yet calculated |
CVE-2023-45010 MISC |
| wordpress -- wordpress |
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <= 4.6.7 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45049 MISC |
| wordpress -- wordpress |
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Image vertical reel scroll slideshow plugin <= 9.0 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45051 MISC |
| wordpress -- wordpress |
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AWESOME TOGI Product Category Tree plugin <= 2.5 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45054 MISC |
| wordpress -- wordpress |
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <= 1.3.26 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45056 MISC |
| wordpress -- wordpress |
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hitsteps Web Analytics plugin <= 5.86 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45057 MISC |
| wordpress -- wordpress |
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gumroad plugin <= 3.1.0 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45059 MISC |
| wordpress -- wordpress |
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Thomas Scholl canvasio3D Light plugin <= 2.4.6 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45062 MISC |
| wordpress -- wordpress |
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Daisuke Takahashi (Extend Wings) OPcache Dashboard plugin <= 0.3.1 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45064 MISC |
| wordpress -- wordpress |
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mad Fish Digital Bulk NoIndex & NoFollow Toolkit plugin <= 1.42 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45065 MISC |
| wordpress -- wordpress |
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45067 MISC |
| wordpress -- wordpress |
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.18 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45070 MISC |
| wordpress -- wordpress |
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web - Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.18 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45071 MISC |
| wordpress -- wordpress |
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kardi Order auto complete for WooCommerce plugin <= 1.2.0 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45072 MISC |
| wordpress -- wordpress |
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Koch Mendeley Plugin plugin <= 1.3.2 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45073 MISC |
| wordpress -- wordpress |
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Shopfiles Ltd Ebook Store plugin <= 5.785 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45602 MISC |
| wordpress -- wordpress |
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Scott Reilly Get Custom Field Values plugin <= 4.0.1 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45604 MISC |
| wordpress -- wordpress |
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Hector Cabrera WordPress Popular Posts plugin <= 6.3.2 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45607 MISC |
| wordpress -- wordpress |
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Nicola Modugno Smart Cookie Kit plugin <= 2.3.1 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45608 MISC |
| wordpress -- wordpress |
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in QROkes QR Twitter Widget plugin <= 0.2.3 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45628 MISC |
| wordpress -- wordpress |
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery - Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45630 MISC |
| wordpress -- wordpress |
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado SpiderVPlayer plugin <= 1.5.22 versions. |
2023-10-18 |
not yet calculated |
CVE-2023-45632 MISC |
| wordpress -- wordpress |
The Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
2023-10-20 |
not yet calculated |
CVE-2023-4598 MISC MISC MISC |
| wordpress -- wordpress |
The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and including, 2.50. This is due to missing capability checks on several AJAX actions and nonce disclosure in the source page of the administrative dashboard. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to call functions and delete and/or upload files. |
2023-10-20 |
not yet calculated |
CVE-2020-36698 MISC MISC MISC |
| wordpress -- wordpress |
The Simple:Press - WordPress Forum Plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ~/admin/resources/jscript/ajaxupload/sf-uploader.php file in versions up to, and including, 6.6.0. This makes it possible for attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. |
2023-10-20 |
not yet calculated |
CVE-2020-36706 MISC MISC MISC MISC |
| wordpress -- wordpress |
The Brizy plugin for WordPress is vulnerable to authorization bypass due to an incorrect capability check on the is_administrator() function in versions up to, and including, 1.0.125. This makes it possible for authenticated attackers to access and interact with available AJAX functions. |
2023-10-20 |
not yet calculated |
CVE-2020-36714 MISC MISC |
| wordpress -- wordpress |
The Coupon Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to missing or incorrect nonce validation on the save_meta() function. This makes it possible for unauthenticated attackers to save meta fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2020-36751 MISC MISC MISC MISC MISC MISC MISC MISC MISC |
| wordpress -- wordpress |
The Hueman theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation on the save_meta_box() function. This makes it possible for unauthenticated attackers to save metabox data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2020-36753 MISC MISC MISC MISC MISC MISC MISC MISC MISC |
| wordpress -- wordpress |
The Paid Memberships Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.2. This is due to missing or incorrect nonce validation on the pmpro_page_save() function. This makes it possible for unauthenticated attackers to save pages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2020-36754 MISC MISC MISC MISC MISC MISC MISC MISC MISC |
| wordpress -- wordpress |
The Customizr theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.0. This is due to missing or incorrect nonce validation on the czr_fn_post_fields_save() function. This makes it possible for unauthenticated attackers to post fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2020-36755 MISC MISC MISC MISC MISC MISC MISC MISC MISC |
| wordpress -- wordpress |
The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This is due to missing or incorrect nonce validation on the save_feedzy_post_type_meta() function. This makes it possible for unauthenticated attackers to update post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2020-36758 MISC MISC MISC MISC MISC MISC MISC MISC MISC |
| wordpress -- wordpress |
The Woody code snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.9. This is due to missing or incorrect nonce validation on the runActions() function. This makes it possible for unauthenticated attackers to activate and deactivate snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2020-36759 MISC MISC MISC MISC MISC MISC MISC MISC MISC |
| wordpress -- wordpress |
The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check on the fpd_update_options function in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify site options, including setting the default role to administrator which can allow privilege escalation. |
2023-10-20 |
not yet calculated |
CVE-2021-4334 MISC MISC |
| wordpress -- wordpress |
The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a missing capability check on multiple AJAX functions in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify plugin settings, including retrieving arbitrary order information or creating/updating/deleting products, orders, or other sensitive information not associated with their own account. |
2023-10-20 |
not yet calculated |
CVE-2021-4335 MISC MISC |
| wordpress -- wordpress |
The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. This is due to missing authorization on the export() function which makes makes it possible for unauthenticated attackers to export the plugin's settings. |
2023-10-20 |
not yet calculated |
CVE-2021-4353 MISC MISC |
| wordpress -- wordpress |
The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to save code snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2021-4418 MISC MISC MISC MISC MISC MISC MISC MISC MISC |
| wordpress -- wordpress |
The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to and including 1.7.5. This makes it possible for unauthenticated users to run arbitrary commands leading to remote command execution, granted they can trick a site administrator into performing an action such as clicking on a link. This makes it possible for an attacker to create and or modify files hosted on the server which can easily grant attackers backdoor access to the affected server. |
2023-10-20 |
not yet calculated |
CVE-2022-2441 MISC MISC MISC MISC MISC MISC |
| wordpress -- wordpress |
The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the 'zbscrmcsvimpf' parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' function in versions up to, and including, 5.3.1. While the function performs a nonce check, steps 2 and 3 of the check do not take any action upon a failed check. These steps then perform a 'file_exists' check on the value of 'zbscrmcsvimpf'. If a phar:// archive is supplied, its contents will be deserialized and an object injected in the execution stream. This allows an unauthenticated attacker to obtain object injection if they are able to upload a phar archive (for instance if the site supports image uploads) and then trick an administrator into performing an action, such as clicking a link. |
2023-10-20 |
not yet calculated |
CVE-2022-3342 MISC MISC MISC |
| wordpress -- wordpress |
The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and including, 6.9.11. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change some plugin settings intended to be modifiable by admins only. |
2023-10-20 |
not yet calculated |
CVE-2022-3622 MISC MISC MISC MISC |
| wordpress -- wordpress |
The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the 'ctl_sanitize_title' function in versions up to, and including, 3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This potentially allows authenticated users with the ability to add or modify terms or tags to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A partial patch became available in version 3.6 and the issue was fully patched in version 3.7. |
2023-10-20 |
not yet calculated |
CVE-2022-4290 MISC MISC |
| wordpress -- wordpress |
The WP Cerber Security plugin for WordPress is vulnerable to stored cross-site scripting via the log parameter when logging in to the site in versions up to, and including, 9.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2022-4712 MISC MISC |
| wordpress -- wordpress |
The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin settings in versions up to, and including, 5.6.5. This makes it possible for unauthenticated attackers to change the plugin's settings. |
2023-10-20 |
not yet calculated |
CVE-2022-4943 MISC MISC |
| wordpress -- wordpress |
The Waiting: One-click countdowns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown name in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2022-4954 MISC MISC |
| wordpress -- wordpress |
The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthenticated attackers to reset plugin settings and remove reviews via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-18 |
not yet calculated |
CVE-2023-3254 MISC MISC |
| wordpress -- wordpress |
The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the voteOnComment function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attackers to increase or decrease the rating of a comment. |
2023-10-20 |
not yet calculated |
CVE-2023-3869 MISC MISC |
| wordpress -- wordpress |
The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2023-3933 MISC MISC |
| wordpress -- wordpress |
The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2023-3962 MISC MISC |
| wordpress -- wordpress |
The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2023-3965 MISC MISC |
| wordpress -- wordpress |
The ARMember Lite - Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. |
2023-10-20 |
not yet calculated |
CVE-2023-3996 MISC MISC MISC MISC MISC |
| wordpress -- wordpress |
The Modern Events Calendar lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Google API key and Calendar ID in versions up to, but not including, 7.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. |
2023-10-20 |
not yet calculated |
CVE-2023-4021 MISC MISC |
| wordpress -- wordpress |
The Photospace Responsive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'psres_button_size' parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. |
2023-10-20 |
not yet calculated |
CVE-2023-4271 MISC MISC MISC |
| wordpress -- wordpress |
The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 0.9.89. This allows authenticated attackers with administrative privileges to delete the contents of arbitrary directories on the server, which can be a critical issue in a shared environment. |
2023-10-20 |
not yet calculated |
CVE-2023-4274 MISC MISC MISC |
| wordpress -- wordpress |
The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the get_posts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. |
2023-10-20 |
not yet calculated |
CVE-2023-4386 MISC MISC |
| wordpress -- wordpress |
The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the get_products function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. |
2023-10-20 |
not yet calculated |
CVE-2023-4402 MISC MISC |
| wordpress -- wordpress |
The Auto Amazon Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-4482 MISC MISC |
| wordpress -- wordpress |
The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php file. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included. |
2023-10-20 |
not yet calculated |
CVE-2023-4488 MISC MISC |
| wordpress -- wordpress |
Cross-Site Request Forgery (CSRF) vulnerability in Qwerty23 Rocket Font plugin <= 1.2.3 versions. |
2023-10-21 |
not yet calculated |
CVE-2023-46067 MISC |
| wordpress -- wordpress |
Cross-Site Request Forgery (CSRF) vulnerability in PluginEver WC Serial Numbers plugin <= 1.6.3 versions. |
2023-10-21 |
not yet calculated |
CVE-2023-46078 MISC |
| wordpress -- wordpress |
The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
2023-10-21 |
not yet calculated |
CVE-2023-4635 MISC MISC |
| wordpress -- wordpress |
The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai_ajax function. This can allow unauthenticated attackers to extract sensitive data such as post titles and slugs (including those of protected posts along with their passwords), usernames, available roles, the plugin license key provided the remote debugging option is enabled. In the default state it is disabled. |
2023-10-19 |
not yet calculated |
CVE-2023-4645 MISC MISC MISC |
| wordpress -- wordpress |
The WP Customer Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. |
2023-10-20 |
not yet calculated |
CVE-2023-4648 MISC MISC |
| wordpress -- wordpress |
The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. This can allow unauthenticated attackers to extract sensitive data including installed plugins (present and active), active theme, various plugin settings, WordPress version, as well as some server settings such as memory limit, installation paths. |
2023-10-20 |
not yet calculated |
CVE-2023-4668 MISC MISC |
| wordpress -- wordpress |
The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcj_wp_option' shortcode in versions up to, and including, 7.1.0 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with subscriber-level capabilities or above, to retrieve arbitrary sensitive site options. |
2023-10-20 |
not yet calculated |
CVE-2023-4796 MISC MISC MISC |
| wordpress -- wordpress |
The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks. |
2023-10-16 |
not yet calculated |
CVE-2023-4798 MISC |
| wordpress -- wordpress |
A vulnerability exists which allows an authenticated attacker to access sensitive information on the AirWave Management Platform web-based management interface. Successful exploitation allows the attacker to gain access to some data that could be further exploited to laterally access devices managed and monitored by the AirWave server. |
2023-10-17 |
not yet calculated |
CVE-2023-4896 MISC |
| wordpress -- wordpress |
The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the iframe shortcode in versions up to, and including, 4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permission and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 4.6 and fully patched in version 4.7. |
2023-10-20 |
not yet calculated |
CVE-2023-4919 MISC MISC MISC MISC |
| wordpress -- wordpress |
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_save_options function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additionally, input sanitization and escaping is insufficient resulting in the possibility of malicious script injection. |
2023-10-20 |
not yet calculated |
CVE-2023-4920 MISC MISC MISC |
| wordpress -- wordpress |
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_delete function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2023-4923 MISC MISC MISC |
| wordpress -- wordpress |
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to missing capability checks on the woobe_bulkoperations_delete function. This makes it possible for authenticated attackers, with subscriber access or higher, to delete products. |
2023-10-20 |
not yet calculated |
CVE-2023-4924 MISC MISC MISC |
| wordpress -- wordpress |
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulk_delete_products function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2023-4926 MISC MISC MISC |
| wordpress -- wordpress |
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the create_profile function. This makes it possible for unauthenticated attackers to create profiles via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2023-4935 MISC MISC MISC |
| wordpress -- wordpress |
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_apply_default_combination function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2023-4937 MISC MISC MISC |
| wordpress -- wordpress |
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_apply_default_combination function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products. |
2023-10-18 |
not yet calculated |
CVE-2023-4938 MISC MISC MISC |
| wordpress -- wordpress |
The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a weak authentication token for the /wp-json/salesmanago/v1/callbackApiV3 API endpoint which is simply a SHA1 hash of the site URL and client ID found in the page source of the website. This makes it possible for unauthenticated attackers to inject arbitrary content into the log files, and when combined with another vulnerability this could have significant consequences. |
2023-10-21 |
not yet calculated |
CVE-2023-4939 MISC MISC MISC |
| wordpress -- wordpress |
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_swap function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2023-4940 MISC MISC MISC |
| wordpress -- wordpress |
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_swap function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products. |
2023-10-20 |
not yet calculated |
CVE-2023-4941 MISC MISC MISC |
| wordpress -- wordpress |
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_visibility function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2023-4942 MISC MISC MISC |
| wordpress -- wordpress |
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_visibility function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products. |
2023-10-20 |
not yet calculated |
CVE-2023-4943 MISC MISC MISC |
| wordpress -- wordpress |
The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_ean_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above, to update EAN numbers for orders. |
2023-10-20 |
not yet calculated |
CVE-2023-4947 MISC MISC |
| wordpress -- wordpress |
The Poptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'poptin-form' shortcode in versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-4961 MISC MISC MISC |
| wordpress -- wordpress |
The WPLegalPages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wplegalpage' shortcode in versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with author-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-4968 MISC MISC MISC |
| wordpress -- wordpress |
The Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1. This is due to missing or incorrect nonce validation on functionality in the builder.php file. This makes it possible for unauthenticated attackers to change the stripe connect token via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2023-4975 MISC MISC MISC |
| wordpress -- wordpress |
The Horizontal scrolling announcement plugin for WordPress is vulnerable to SQL Injection via the plugin's [horizontal-scrolling] shortcode in versions up to, and including, 9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
2023-10-20 |
not yet calculated |
CVE-2023-4999 MISC MISC |
| wordpress -- wordpress |
The Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-5050 MISC MISC MISC |
| wordpress -- wordpress |
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that include social media authentication tokens and secrets as well as app passwords. |
2023-10-20 |
not yet calculated |
CVE-2023-5070 MISC MISC |
| wordpress -- wordpress |
The Sitekit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sitekit_iframe' shortcode in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-5071 MISC MISC MISC |
| wordpress -- wordpress |
The Copy Anything to Clipboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'copy' shortcode in versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-5086 MISC MISC MISC |
| wordpress -- wordpress |
The WP Mailto Links - Protect Email Addresses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wpml_mailto' shortcode in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 3.1.3 and fully patched in version 3.1.4. |
2023-10-20 |
not yet calculated |
CVE-2023-5109 MISC MISC |
| wordpress -- wordpress |
The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image file path parameter in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-5120 MISC MISC |
| wordpress -- wordpress |
The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings (the backup path parameter) in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. |
2023-10-20 |
not yet calculated |
CVE-2023-5121 MISC MISC |
| wordpress -- wordpress |
The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parseRemoteRequest function in versions up to, and including, 6.0.1. This makes it possible for unauthenticated attackers with knowledge of an existing WooCommerce Order ID to expose sensitive WooCommerce order information (e.g., Name, Address, Email Address, and other order metadata). |
2023-10-21 |
not yet calculated |
CVE-2023-5132 MISC MISC |
| wordpress -- wordpress |
The flowpaper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'flipbook' shortcode in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-5200 MISC MISC MISC |
| wordpress -- wordpress |
The ChatBot plugin for WordPress is vulnerable to SQL Injection via the $strid parameter in versions up to, and including, 4.8.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
2023-10-19 |
not yet calculated |
CVE-2023-5204 MISC MISC MISC |
| wordpress -- wordpress |
The Add Custom Body Class plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_custom_body_class' value in versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-21 |
not yet calculated |
CVE-2023-5205 MISC MISC |
| wordpress -- wordpress |
The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 4.8.9. This makes it possible for authenticated attackers with subscriber privileges to delete arbitrary files on the server, which makes it possible to take over affected sites as well as others sharing the same hosting account. |
2023-10-19 |
not yet calculated |
CVE-2023-5212 MISC MISC MISC |
| wordpress -- wordpress |
The Magic Action Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.17.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-5231 MISC MISC |
| wordpress -- wordpress |
The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 via the qcld_openai_upload_pagetraining_file function. This allows subscriber-level attackers to append "<?php" to any existing file on the server resulting in potential DoS when appended to critical files such as wp-config.php. |
2023-10-19 |
not yet calculated |
CVE-2023-5241 MISC MISC MISC |
| wordpress -- wordpress |
The ChatBot plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.8.9 via the qcld_wb_chatbot_check_user function. This can allow unauthenticated attackers to extract sensitive data including confirmation as to whether a username exists on the site as well as order information for existing users. |
2023-10-19 |
not yet calculated |
CVE-2023-5254 MISC MISC MISC |
| wordpress -- wordpress |
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfe_form' shortcode in versions up to, and including, 0.8.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-5292 MISC MISC MISC MISC |
| wordpress -- wordpress |
The Podcast Subscribe Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'podcast_subscribe' shortcode in versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-5308 MISC MISC MISC |
| wordpress -- wordpress |
The iPanorama 360 - WordPress Virtual Tour Builder plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
2023-10-19 |
not yet calculated |
CVE-2023-5336 MISC MISC MISC |
| wordpress -- wordpress |
The Contact form Form For All plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-5337 MISC MISC |
| wordpress -- wordpress |
The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the show_es_logs function. This allows administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive information including those belonging to other sites, for example in shared hosting environments. |
2023-10-20 |
not yet calculated |
CVE-2023-5414 MISC MISC MISC |
| wordpress -- wordpress |
The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9. This makes it possible for unauthenticated attackers to perform some of those actions that were intended for higher privileged users. |
2023-10-20 |
not yet calculated |
CVE-2023-5533 MISC MISC |
| wordpress -- wordpress |
The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9. This is due to missing or incorrect nonce validation on the corresponding functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2023-5534 MISC MISC |
| wordpress -- wordpress |
The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-18 |
not yet calculated |
CVE-2023-5538 MISC MISC MISC MISC |
| wordpress -- wordpress |
The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 0.9.91 via Google Drive API secrets stored in plaintext in the publicly visible plugin source. This could allow unauthenticated attackers to impersonate the WPVivid Google Drive account via the API if they can trick a user into reauthenticating via another vulnerability or social engineering. |
2023-10-20 |
not yet calculated |
CVE-2023-5576 MISC MISC MISC |
| wordpress -- wordpress |
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
2023-10-20 |
not yet calculated |
CVE-2023-5602 MISC MISC |
| wordpress -- wordpress |
The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpsscode' shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-5613 MISC MISC MISC |
| wordpress -- wordpress |
The Theme Switcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'theme_switcha_list' shortcode in all versions up to, and including, 3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-5614 MISC MISC MISC |
| wordpress -- wordpress |
The Skype Legacy Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skype-status' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-5615 MISC MISC |
| wordpress -- wordpress |
The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 1.4.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-5618 MISC MISC |
| wordpress -- wordpress |
The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. |
2023-10-18 |
not yet calculated |
CVE-2023-5621 MISC MISC MISC |
| wordpress -- wordpress |
The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcj_image' shortcode in versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-19 |
not yet calculated |
CVE-2023-5638 MISC MISC MISC MISC |
| wordpress -- wordpress |
The Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tmfshortcode' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-19 |
not yet calculated |
CVE-2023-5639 MISC MISC MISC MISC |
| wordpress -- wordpress |
The AI ChatBot for WordPress is vulnerable to Directory Traversal in version 4.9.2 via the qcld_openai_upload_pagetraining_file function. This allows subscriber-level attackers to append "<?php" to any existing file on the server resulting in potential DoS when appended to critical files such as wp-config.php. This vulnerability is the same as CVE-2023-5241 but was reintroduced in version 4.9.2. |
2023-10-20 |
not yet calculated |
CVE-2023-5646 MISC MISC MISC |
| wordpress -- wordpress |
The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in version 4.9.2. This makes it possible for authenticated attackers with subscriber privileges to delete arbitrary files on the server, which makes it possible to take over affected sites as well as others sharing the same hosting account. This vulnerability is the same as CVE-2023-5212 but was accidentally reintroduced in version 4.9.2. |
2023-10-20 |
not yet calculated |
CVE-2023-5647 MISC MISC |
| wordpress -- wordpress |
The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 4.9.2. This is due to missing or incorrect nonce validation on the corresponding functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This vulnerability is the same as CVE-2023-5534 but was reintroduced in version 4.9.2. |
2023-10-20 |
not yet calculated |
CVE-2023-5655 MISC MISC MISC |
| wordpress -- wordpress |
The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.9.2. This makes it possible for unauthenticated attackers to perform some of those actions that were intended for higher privileged users. This vulnerability is the same as CVE-2023-5533 but was reintroduced in version 4.9.2. |
2023-10-20 |
not yet calculated |
CVE-2023-5656 MISC MISC MISC |
| wordpress -- wordpress |
The WhatsApp Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'whatsapp' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
2023-10-20 |
not yet calculated |
CVE-2023-5668 MISC MISC |
| xnsoft_nconvert -- xnsoft_nconvert |
XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow. There is a User Mode Write AV via a crafted image file. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution. |
2023-10-18 |
not yet calculated |
CVE-2023-43250 MISC MISC MISC MISC |
| xnsoft_nconvert -- xnsoft_nconvert |
XNSoft Nconvert 7.136 has an Exception Handler Chain Corrupted via a crafted image file. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution. |
2023-10-19 |
not yet calculated |
CVE-2023-43251 MISC MISC MISC MISC |
| xnsoft_nconvert -- xnsoft_nconvert |
XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow via a crafted image file. |
2023-10-19 |
not yet calculated |
CVE-2023-43252 MISC MISC MISC MISC |
| xxl-rpc -- xxl-rpc |
XXL-RPC is a high performance, distributed RPC framework. With it, a TCP server can be set up using the Netty framework and the Hessian serialization mechanism. When such a configuration is used, attackers may be able to connect to the server and provide malicious serialized objects that, once deserialized, force it to execute arbitrary code. This can be abused to take control of the machine the server is running by way of remote code execution. This issue has not been fixed. |
2023-10-18 |
not yet calculated |
CVE-2023-45146 MISC |
| yamcs -- yamcs |
Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2). The vulnerability is in the storage functionality of the API and allows one to escape the base directory of the buckets, freely navigate system directories, and read arbitrary files. |
2023-10-19 |
not yet calculated |
CVE-2023-45277 MISC MISC |
| yamcs -- yamcs |
Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafted HTTP DELETE request. |
2023-10-19 |
not yet calculated |
CVE-2023-45278 MISC MISC |
| yamcs -- yamcs |
Yamcs 5.8.6 allows XSS (issue 1 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from the menu and navigating to the display. |
2023-10-19 |
not yet calculated |
CVE-2023-45279 MISC MISC |
| yamcs -- yamcs |
Yamcs 5.8.6 allows XSS (issue 2 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrary JavaScript. |
2023-10-19 |
not yet calculated |
CVE-2023-45280 MISC MISC |
| yamcs -- yamcs |
An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file. |
2023-10-19 |
not yet calculated |
CVE-2023-45281 MISC |
| ydb-go-sdk -- ydb-go-sdk |
ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object (implementation of interface Credentials it may leak into logs. This happens because this object could be serialized into an error message using fmt.Errorf("something went wrong (credentials: %q)", credentials) during connection to the YDB server. If such logging occurred, a malicious user with access to logs could read sensitive information (i.e., credentials) information and use it to get access to the database. ydb-go-sdk contains this problem in versions from v3.48.6 to v3.53.2. The fix for this problem has been released in version v3.53.3. Users are advised to upgrade. Users unable to upgrade should implement the fmt.Stringer interface in your custom credentials type with explicit stringify of object state. |
2023-10-19 |
not yet calculated |
CVE-2023-45825 MISC MISC MISC MISC |
| yealink -- sip-t19p-e2 |
An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to execute arbitrary code via a crafted request the ping function of the diagnostic component. |
2023-10-17 |
not yet calculated |
CVE-2023-43959 MISC MISC |
| zchunk -- zchunk |
zchunk before 1.3.2 has multiple integer overflows via malformed zchunk files to lib/comp/comp.c, lib/comp/zstd/zstd.c, lib/dl/multipart.c, or lib/header.c. |
2023-10-19 |
not yet calculated |
CVE-2023-46228 MISC MISC MISC |
| zzzcms -- zzzcms |
zzzcms v2.2.0 was discovered to contain an open redirect vulnerability. |
2023-10-18 |
not yet calculated |
CVE-2023-45909 MISC |