US-CERT Vulnerability Summary for the Week of January 8, 2024

Bulletins provide weekly summaries of new vulnerabilities. Patch information is provided when available.

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.

Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

  • High: vulnerabilities with a CVSS base score of 7.0–10.0
  • Medium: vulnerabilities with a CVSS base score of 4.0–6.9
  • Low: vulnerabilities with a CVSS base score of 0.0–3.9

Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis. 

 

High Vulnerabilities

Primary
Vendor — Product
DescriptionPublishedCVSS ScoreSource & Patch Info
abocms — abo.cmsSQL Injection vulnerability in ABO.CMS v.5.9.3, allows remote attackers to execute arbitrary code via the d parameter in the Documents module.2024-01-069.8CVE-2023-46953
[email protected]
acme — ultra_mini_httpdA vulnerability was found in ACME Ultra Mini HTTPd 1.21. It has been classified as problematic. This affects an unknown part of the component HTTP GET Request Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-249819.2024-01-077.5CVE-2024-0263
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
advancedcustomfields — advanced_custom_fieldsExposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.2024-01-087.5CVE-2022-40696
[email protected]
alekseykurepin — pico_http_server_in_croute in main.c in Pico HTTP Server in C through f3b69a6 has an sprintf stack-based buffer overflow via a long URI, leading to remote code execution.2024-01-059.8CVE-2024-22087
[email protected]
altassian — bitbucket
 
An issue was discovered in savignano S/Notify before 2.0.1 for Bitbucket. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Bitbucket, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.2024-01-098.3CVE-2023-50931
[email protected]
altassian — jira
 
An issue was discovered in savignano S/Notify before 4.0.2 for Jira. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Jira, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.2024-01-098.3CVE-2023-50930
[email protected]
ami — megarac_sp-xAMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.2024-01-098.8CVE-2023-3043
[email protected]
ami — megarac_sp-xAMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.2024-01-098.8CVE-2023-37293
[email protected]
ami — megarac_sp-xAMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.2024-01-098.8CVE-2023-37294
[email protected]
ami — megarac_sp-xAMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.2024-01-098.8CVE-2023-37295
[email protected]
ami — megarac_sp-xAMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.2024-01-098.8CVE-2023-37296
[email protected]
ami — megarac_sp-xAMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.2024-01-098.8CVE-2023-37297
[email protected]
ami — megarac_sp-xAMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference by a local network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.2024-01-097.8CVE-2023-34332
[email protected]
ami — megarac_sp-xAMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference via a local network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.2024-01-097.8CVE-2023-34333
[email protected]
apache — axis** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF This issue affects Apache Axis: through 1.3. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06 applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.2024-01-067.2CVE-2023-51441
[email protected]
[email protected]
apollo13themes — apollo13_framework_extensionsCross-Site Request Forgery (CSRF) vulnerability in Apollo13Themes Apollo13 Framework Extensions.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.1.2024-01-058.8CVE-2023-51539
[email protected]
apple — macosThe issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing a file may lead to arbitrary code execution.2024-01-107.8CVE-2023-42826
[email protected]
apple — macosThe issue was addressed with improved bounds checks. This issue is fixed in macOS Sonoma 14. Processing a file may lead to a denial-of-service or potentially disclose memory contents.2024-01-107.1CVE-2023-42876
[email protected]
apple — macosThis issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to gain elevated privileges.2024-01-107.8CVE-2023-42933
[email protected]
atlassian — confluence
 
An issue was discovered in savignano S/Notify before 4.0.2 for Confluence. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Confluence, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.2024-01-098.3CVE-2023-50932
[email protected]
azure — ipam
 
Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers’ Azure environments as the Service Principal used is only assigned the Reader role at the root Management Group level. Until recently, the solution lacked the validation of the passed in authentication token which may result in attacker impersonating any privileged user to access data stored within the IPAM instance and subsequently from Azure, causing an elevation of privilege. This vulnerability has been patched in version 3.0.0.2024-01-109.1CVE-2024-21638
[email protected]
[email protected]
[email protected]
azuread — activedirectory_identitymodel_extensions_for_dotnetIdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller’s identity. Anyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Microsoft.IdentityModel trusts the `jku`claim by default for the `SignedHttpRequest`protocol. This raises the possibility to make any remote or local `HTTP GET` request. The vulnerability has been fixed in Microsoft.IdentityModel.Protocols.SignedHttpRequest. Users should update all their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher.2024-01-107.1CVE-2024-21643
[email protected]
[email protected]
[email protected]
[email protected]
backupbliss — cloneThe Clone WordPress plugin before 2.4.3 uses buffer files to store in-progress backup informations, which is stored at a publicly accessible, statically defined file path.2024-01-087.5CVE-2023-6750
[email protected]
basixonline — nex-formsCross-Site Request Forgery (CSRF) vulnerability in Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more.This issue affects NEX-Forms – Ultimate Form Builder – Contact forms and much more: from n/a through 8.5.2.2024-01-058.8CVE-2023-52120
[email protected]
blueastral — page_builder\Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder.This issue affects Page Builder: Live Composer: from n/a through 1.5.25.2024-01-087.2CVE-2023-52206
[email protected]
bosch — bcc101Network port 8899 open in WiFi firmware of BCC101/BCC102/BCC50 products, that allows an attacker to connect to the device via same WiFi network.2024-01-098.3CVE-2023-49722
[email protected]
briandgoad — ptypeconverterImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Brian D. Goad pTypeConverter.This issue affects pTypeConverter: from n/a through 0.2.8.1.2024-01-088.8CVE-2023-52201
[email protected]
buy-addons — bazoom_magnifierSQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privileges and gain sensitive information via BaproductzoommagnifierZoomModuleFrontController::run() method.2024-01-059.8CVE-2023-50027
[email protected]
byzoro — smart_s150_firmwareA vulnerability was found in Beijing Baichuo Smart S150 Management Platform up to 20240101. It has been rated as critical. Affected by this issue is some unknown functionality of the file /useratte/userattestation.php of the component HTTP POST Request Handler. The manipulation of the argument web_img leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249866 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-089.8CVE-2024-0300
[email protected]
[email protected]
[email protected]
canonical — snapdRace condition in snap-confine’s must_mkdir_and_open_with_perms()2024-01-087CVE-2022-3328
[email protected]
[email protected]
checkmk — checkmkInsufficient authentication flow in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows attacker to use locked credentials2024-01-128.8CVE-2023-31211
[email protected]
checkmk — checkmkPrivilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges2024-01-128.8CVE-2023-6735
[email protected]
checkmk — checkmkPrivilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges2024-01-128.8CVE-2023-6740
[email protected]
chendotjs — lotos_webserverLotos WebServer through 0.1.1 (commit 3eb36cc) has a use-after-free in buffer_avail() at buffer.h via a long URI, because realloc is mishandled.2024-01-059.8CVE-2024-22088
[email protected]
cleantalk — spam_protection\,_antispam\,_firewallCross-Site Request Forgery (CSRF) vulnerability in ?leanTalk – Anti-Spam Protection Spam protection, Anti-Spam, FireWall by CleanTalk.This issue affects Spam protection, Anti-Spam, FireWall by CleanTalk: from n/a through 6.20.2024-01-058.8CVE-2023-51535
[email protected]
clerk — javascriptClerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router. This vulnerability was patched in version 4.29.3.2024-01-129CVE-2024-22206
[email protected]
[email protected]
[email protected]
cloud_foundry — routing_releaseCloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack. An unauthenticated attacker can use this vulnerability to force route pruning and therefore degrade the service availability of the Cloud Foundry deployment.2024-01-127.5CVE-2023-34061
[email protected]
code-projects — dormitory_management_systemA vulnerability classified as critical was found in code-projects Dormitory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250579.2024-01-127.3CVE-2024-0474
[email protected]
[email protected]
[email protected]
code-projects — simple_online_hotel_reservation_systemA vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250126 is the identifier assigned to this vulnerability.2024-01-109.8CVE-2024-0359
[email protected]
[email protected]
[email protected]
constantcontact — constant_contact_formsExposure of Sensitive Information to an Unauthorized Actor vulnerability in Constant Contact Constant Contact Forms.This issue affects Constant Contact Forms: from n/a through 2.4.2.2024-01-087.5CVE-2023-52208
[email protected]
cozmoslabs — profile_builder_proImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Cozmoslabs Profile Builder Pro allows Reflected XSS.This issue affects Profile Builder Pro: from n/a through 3.10.0.2024-01-137.1CVE-2024-22142
[email protected]
dataiku — data_science_studioDataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass.2024-01-099.8CVE-2023-51717
[email protected]
[email protected]
dedecms — dedecmsA vulnerability classified as critical has been found in DeDeCMS up to 5.7.112. Affected is an unknown function of the file file_class.php of the component Backend. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249768. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-079.8CVE-2023-7212
[email protected]
[email protected]
[email protected]
demon1a — discord-reconDiscord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerable to remote code execution. An attacker is able to execute shell commands in the server without having an admin role. This vulnerability has been fixed in version 0.0.8.2024-01-098.8CVE-2024-21663
[email protected]
[email protected]
[email protected]
discourse — discourseDiscourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5.2024-01-128.6CVE-2023-48297
[email protected]
dtale –dtaleD-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery (SSRF), allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the `Load From the Web` input is turned off by default. The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.2024-01-057.5CVE-2024-21642
[email protected]
[email protected]
[email protected]
engineers_online_portal_project — engineers_online_portalA vulnerability, which was classified as problematic, was found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file change_password_teacher.php of the component Password Change. The manipulation leads to session expiration. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249816.2024-01-077.5CVE-2024-0260
[email protected]
[email protected]
[email protected]
evernote — evernoteAn issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments components.2024-01-099.8CVE-2023-50643
[email protected]
[email protected]
fastify — reply-fromfastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an header `ContentType: application/json ; charset=utf-8`. This can lead to bypass of security checks. This vulnerability has been patched in ‘@fastify/reply-from` version 9.6.0.2024-01-087.5CVE-2023-51701
[email protected]
[email protected]
fhs-opensource — iparkingA vulnerability classified as critical was found in fhs-opensource iparking 1.5.22.RELEASE. This vulnerability affects the function getData of the file src/main/java/com/xhb/pay/action/PayTempOrderAction.java. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249868.2024-01-089.8CVE-2024-0301
[email protected]
[email protected]
[email protected]
fhs-opensource — iparkingA vulnerability, which was classified as critical, has been found in fhs-opensource iparking 1.5.22.RELEASE. This issue affects some unknown processing of the file /vueLogin. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249869 was assigned to this vulnerability.2024-01-089.8CVE-2024-0302
[email protected]
[email protected]
[email protected]
fit2cloud — cloudexplorer_liteInsecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter.2024-01-067.8CVE-2023-50612
[email protected]
flycms_project — flycmsFlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/userconfig_updagte.2024-01-088.8CVE-2023-52072
[email protected]
flycms_project — flycmsFlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/config_footer_updagte.2024-01-088.8CVE-2023-52073
[email protected]
flycms_project — flycmsFlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component system/site/webconfig_updagte.2024-01-088.8CVE-2023-52074
[email protected]
fonttools — fonttoolsfontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.2024-01-107.5CVE-2023-45139
[email protected]
[email protected]
[email protected]
fortinet — fortiosAn improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS requests.2024-01-108.8CVE-2023-44250
[email protected]
fortinet — fortiportal
 
A improper access control in Fortinet FortiPortal version 7.0.0 through 7.0.6, Fortinet FortiPortal version 7.2.0 through 7.2.1 allows attacker to escalate its privilege via specifically crafted HTTP requests.2024-01-107.2CVE-2023-46712
[email protected]
framework – frameworkFlarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation. The vulnerability has been fixed and published as flarum/core v1.8.5. As a workaround, some extensions modifying the logout route can remedy this issue if their implementation is safe.2024-01-057.5CVE-2024-21641
[email protected]
[email protected]
[email protected]
ftpdmin_project — ftpdminA vulnerability has been found in Sentex FTPDMIN 0.96 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component RNFR Command Handler. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249817 was assigned to this vulnerability.2024-01-077.5CVE-2024-0261
[email protected]
[email protected]
[email protected]
[email protected]
gecka — terms_thumbnailsDeserialization of Untrusted Data vulnerability in Gecka Gecka Terms Thumbnails.This issue affects Gecka Terms Thumbnails: from n/a through 1.1.2024-01-088.8CVE-2023-52219
[email protected]
getawesomesupport — awesome_supportCross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin.This issue affects Awesome Support – WordPress HelpDesk & Support Plugin: from n/a through 6.1.5.2024-01-058.8CVE-2023-51538
[email protected]
gitlab — gitlabAn issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding changes to a previously approved merge request.2024-01-127.6CVE-2023-4812
[email protected]
[email protected]
gitlab — gitlabIncorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user.2024-01-127.3CVE-2023-5356
[email protected]
[email protected]
gitlab — gitlab
 
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.2024-01-1210CVE-2023-7028
[email protected]
[email protected]
gitpython-developers — gitpythonGitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.2024-01-117.8CVE-2024-22190
[email protected]
[email protected]
[email protected]
go-git — go-git
 
A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using “Plain” versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS  or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli.2024-01-129.8CVE-2023-49569
[email protected]
go-git — go-git
 
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli.2024-01-127.5CVE-2023-49568
[email protected]
goauthentik — authentikAuthentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with `response_mode=form_post`. This relatively user could use the described attacks to perform a privilege escalation. This vulnerability has been patched in versions 2023.10.6 and 2023.8.6.2024-01-117.6CVE-2024-21637
[email protected]
[email protected]
[email protected]
gofiber — templateThis package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious scripts in users’ browsers when visiting affected web pages. The vulnerability has been addressed, the template engine now defaults to having autoescape set to `true`, effectively mitigating the risk of XSS attacks.2024-01-119.3CVE-2024-22199
[email protected]
[email protected]
gpac — gpacStack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.2024-01-089.8CVE-2024-0321
[email protected]
[email protected]
gpac — gpacOut-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.2024-01-089.1CVE-2024-0322
[email protected]
[email protected]
gtkwave — gtkwaveAn integer overflow vulnerability exists in the FST_BL_GEOM parsing maxhandle functionality of GTKWave 3.3.115, when compiled as a 32-bit binary. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.2024-01-087.8CVE-2023-32650
[email protected]
gtkwave — gtkwaveAn improper array index validation vulnerability exists in the EVCD var len parsing functionality of GTKWave 3.3.115. A specially crafted .evcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.2024-01-087.8CVE-2023-34087
[email protected]
gtkwave — gtkwaveAn out-of-bounds write vulnerability exists in the LXT2 num_time_table_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.2024-01-087.8CVE-2023-34436
[email protected]
gtkwave — gtkwaveAn integer overflow vulnerability exists in the VZT longest_len value allocation functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.2024-01-087.8CVE-2023-35004
[email protected]
gtkwave — gtkwaveAn integer overflow vulnerability exists in the LXT2 lxt2_rd_trace value elements allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.2024-01-087.8CVE-2023-35057
[email protected]
gtkwave — gtkwaveAn integer overflow vulnerability exists in the fstReaderIterBlocks2 time_table tsec_nitems functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.2024-01-087.8CVE-2023-35128
[email protected]
gtkwave — gtkwaveMultiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the fstReaderVarint32 function.2024-01-087.8CVE-2023-35702
[email protected]
gtkwave — gtkwaveMultiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the fstReaderVarint64 function.2024-01-087.8CVE-2023-35703
[email protected]
gtkwave — gtkwaveMultiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the fstReaderVarint32WithSkip function.2024-01-087.8CVE-2023-35704
[email protected]
gtkwave — gtkwaveMultiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the decompression function `LZ4_decompress_safe_partial`.2024-01-087.8CVE-2023-35955
[email protected]
gtkwave — gtkwaveMultiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the decompression function `fastlz_decompress`.2024-01-087.8CVE-2023-35956
[email protected]
gtkwave — gtkwaveMultiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the decompression function `uncompress`.2024-01-087.8CVE-2023-35957
[email protected]
gtkwave — gtkwaveMultiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the copy function `fstFread`.2024-01-087.8CVE-2023-35958
[email protected]
gtkwave — gtkwaveMultiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns `.ghw` decompression.2024-01-087.8CVE-2023-35959
[email protected]
gtkwave — gtkwaveMultiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns legacy decompression in `vcd_main`.2024-01-087.8CVE-2023-35960
[email protected]
gtkwave — gtkwaveMultiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in `vcd_recorder_main`.2024-01-087.8CVE-2023-35961
[email protected]
gtkwave — gtkwaveMultiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in the `vcd2vzt` utility.2024-01-087.8CVE-2023-35962
[email protected]
gtkwave — gtkwaveMultiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in the `vcd2lxt2` utility.2024-01-087.8CVE-2023-35963
[email protected]
gtkwave — gtkwaveMultiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in the `vcd2lxt` utility.2024-01-087.8CVE-2023-35964
[email protected]
gtkwave — gtkwaveMultiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chain_table parsing functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the chain_table of `FST_BL_VCDATA` and `FST_BL_VCDATA_DYN_ALIAS` section types.2024-01-087.8CVE-2023-35969
[email protected]
gtkwave — gtkwaveMultiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chain_table parsing functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the chain_table of the `FST_BL_VCDATA_DYN_ALIAS2` section type.2024-01-087.8CVE-2023-35970
[email protected]
gtkwave — gtkwaveAn integer overflow vulnerability exists in the LXT2 zlib block allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.2024-01-087.8CVE-2023-35989
[email protected]
gtkwave — gtkwaveAn integer overflow vulnerability exists in the FST fstReaderIterBlocks2 vesc allocation functionality of GTKWave 3.3.115, when compiled as a 32-bit binary. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.2024-01-087.8CVE-2023-35992
[email protected]
gtkwave — gtkwaveMultiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta initialization part.2024-01-087.8CVE-2023-35994
[email protected]
gtkwave — gtkwaveMultiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta indexing when signal_lens is 1.2024-01-087.8CVE-2023-35995
[email protected]
gtkwave — gtkwaveMultiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta indexing when signal_lens is 0.2024-01-087.8CVE-2023-35996
[email protected]
gtkwave — gtkwaveMultiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta indexing when signal_lens is 2 or more.2024-01-087.8CVE-2023-35997
[email protected]
gtkwave — gtkwaveMultiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 fstWritex len functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the handling of `len` in `fstWritex` when parsing the time table.2024-01-087CVE-2023-36746
[email protected]
gtkwave — gtkwaveMultiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 fstWritex len functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the handling of `len` in `fstWritex` when `beg_time` does not match the start of the time table.2024-01-087CVE-2023-36747
[email protected]
gtkwave — gtkwaveAn out-of-bounds write vulnerability exists in the VZT LZMA_read_varint functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.2024-01-087.8CVE-2023-36861
[email protected]
gtkwave — gtkwaveAn integer overflow vulnerability exists in the fstReaderIterBlocks2 temp_signal_value_buf allocation functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.2024-01-087.8CVE-2023-36864
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the FST fstReaderIterBlocks2 chain_table allocation functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the allocation of the `chain_table` array.2024-01-087.8CVE-2023-36915
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the FST fstReaderIterBlocks2 chain_table allocation functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the allocation of the `chain_table_lengths` array.2024-01-087.8CVE-2023-36916
[email protected]
gtkwave — gtkwaveAn out-of-bounds write vulnerability exists in the VZT LZMA_Read dmem extraction functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.2024-01-087.8CVE-2023-37282
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the GUI’s legacy VCD parsing code.2024-01-087.8CVE-2023-37416
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the GUI’s interactive VCD parsing code.2024-01-087.8CVE-2023-37417
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2vzt conversion utility.2024-01-087.8CVE-2023-37418
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt2 conversion utility.2024-01-087.8CVE-2023-37419
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt conversion utility.2024-01-087.8CVE-2023-37420
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds read when triggered via the GUI’s default VCD parsing code.2024-01-087.8CVE-2023-37442
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds read when triggered via the GUI’s legacy VCD parsing code.2024-01-087.8CVE-2023-37443
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds read when triggered via the GUI’s interactive VCD parsing code.2024-01-087.8CVE-2023-37444
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2vzt conversion utility.2024-01-087.8CVE-2023-37445
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt2 conversion utility.2024-01-087.8CVE-2023-37446
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt conversion utility.2024-01-087.8CVE-2023-37447
[email protected]
gtkwave — gtkwaveMultiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the GUI’s recoder (default) VCD parsing code.2024-01-087.8CVE-2023-37573
[email protected]
gtkwave — gtkwaveMultiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the GUI’s legacy VCD parsing code.2024-01-087.8CVE-2023-37574
[email protected]
gtkwave — gtkwaveMultiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the GUI’s interactive VCD parsing code.2024-01-087.8CVE-2023-37575
[email protected]
gtkwave — gtkwaveMultiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2vzt conversion utility.2024-01-087.8CVE-2023-37576
[email protected]
gtkwave — gtkwaveMultiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2lxt2 conversion utility.2024-01-087.8CVE-2023-37577
[email protected]
gtkwave — gtkwaveMultiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2lxt conversion utility.2024-01-087.8CVE-2023-37578
[email protected]
gtkwave — gtkwaveMultiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2vzt conversion utility.2024-01-087.8CVE-2023-37921
[email protected]
gtkwave — gtkwaveMultiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2lxt2 conversion utility.2024-01-087.8CVE-2023-37922
[email protected]
gtkwave — gtkwaveMultiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2lxt conversion utility.2024-01-087.8CVE-2023-37923
[email protected]
gtkwave — gtkwaveA stack-based buffer overflow vulnerability exists in the LXT2 lxt2_rd_expand_integer_to_bits function of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.2024-01-087.8CVE-2023-38583
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `rows` array.2024-01-087.8CVE-2023-38618
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `msb` array.2024-01-087.8CVE-2023-38619
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `lsb` array.2024-01-087.8CVE-2023-38620
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `flags` array.2024-01-087.8CVE-2023-38621
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `len` array.2024-01-087.8CVE-2023-38622
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `vindex_offset` array.2024-01-087.8CVE-2023-38623
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_get_facname decompression functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the prefix copy loop.2024-01-087.8CVE-2023-38648
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_get_facname decompression functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the string copy loop.2024-01-087.8CVE-2023-38649
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode times parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is not zero.2024-01-087.8CVE-2023-38650
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode times parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is zero.2024-01-087.8CVE-2023-38651
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode dict parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is not zero.2024-01-087.8CVE-2023-38652
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode dict parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is zero.2024-01-087.8CVE-2023-38653
[email protected]
gtkwave — gtkwaveAn out-of-bounds write vulnerability exists in the LXT2 zlib block decompression functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.2024-01-087.8CVE-2023-38657
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when looping over `lt->numrealfacs`.2024-01-087.8CVE-2023-39234
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when looping over `lt->num_time_ticks`.2024-01-087.8CVE-2023-39235
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `rows` array.2024-01-087.8CVE-2023-39270
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `msb` array.2024-01-087.8CVE-2023-39271
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `lsb` array.2024-01-087.8CVE-2023-39272
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `flags` array.2024-01-087.8CVE-2023-39273
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `len` array.2024-01-087.8CVE-2023-39274
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `value` array.2024-01-087.8CVE-2023-39275
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the LXT2 num_dict_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `string_pointers` array.2024-01-087.8CVE-2023-39316
[email protected]
gtkwave — gtkwaveMultiple integer overflow vulnerabilities exist in the LXT2 num_dict_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `string_lens` array.2024-01-087.8CVE-2023-39317
[email protected]
gtkwave — gtkwaveMultiple integer underflow vulnerabilities exist in the LXT2 lxt2_rd_iter_radix shift operation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer underflow when performing the left shift operation.2024-01-087.8CVE-2023-39413
[email protected]
gtkwave — gtkwaveMultiple integer underflow vulnerabilities exist in the LXT2 lxt2_rd_iter_radix shift operation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer underflow when performing the right shift operation.2024-01-087.3CVE-2023-39414
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. A specially-crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the prefix copy loop.2024-01-087.8CVE-2023-39443
[email protected]
gtkwave — gtkwaveMultiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. A specially-crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the string copy loop.2024-01-087.8CVE-2023-39444
[email protected]
hancom — hcellBuffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability in Hancom HCell on Windows allows Overflow Buffers.This issue affects HCell: 12.0.0.893.2024-01-128.8CVE-2023-40250
[email protected]
haokekeji — yiqiniuA vulnerability, which was classified as critical, has been found in HaoKeKeJi YiQiNiu up to 3.1. Affected by this issue is the function http_post of the file /application/pay/controller/Api.php. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250652.2024-01-137.3CVE-2024-0510
[email protected]
[email protected]
[email protected]
[email protected]
hayyp — cherryhandle_request in http.c in cherry through 4b877df has an sscanf stack-based buffer overflow via a long URI, leading to remote code execution.2024-01-059.8CVE-2024-22086
[email protected]
hex_workshop — hex_workshopA denial service vulnerability has been found on  Hex Workshop affecting version 6.7, an attacker could send a command line file arguments and control the Structured Exception Handler (SEH) records resulting in a service shutdown.2024-01-117.3CVE-2024-0429
[email protected]
hyperledger — aries-cloudagent-python
 
Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation `document.proof` was not factored into the final `verified` value (`true`/`false`) on the presentation record. The flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own. This vulnerability has been present since version 0.7.0 and fixed in version 0.10.5.2024-01-119.9CVE-2024-21669
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
ibm — cics_transaction_gatewayIBM CICS Transaction Gateway 9.3 could allow a user to transfer or view files due to improper access controls. IBM X-Force ID: 270259.2024-01-088.1CVE-2023-47140
[email protected]
[email protected]
[email protected]
ibm — db2IBM Db2 for Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow a local user to escalate their privileges to the SYSTEM user using the MSI repair functionality. IBM X-Force ID: 270402.2024-01-077.8CVE-2023-47145
[email protected]
[email protected]
ibm — security_verify_access_applianceIBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254658.2024-01-118.4CVE-2023-31003
[email protected]
[email protected]
ibm — storage_fusion_hciIBM Storage Fusion HCI 2.1.0 through 2.6.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 275671.2024-01-089.8CVE-2023-50948
[email protected]
[email protected]
icegram — icegram_engageCross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building.This issue affects Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: from n/a through 3.1.18.2024-01-058.8CVE-2023-52119
[email protected]
inc2734 — mw_wp_form
 
The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the ‘_single_file_upload’ function in versions up to, and including, 5.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible.2024-01-119.8CVE-2023-6316
[email protected]
[email protected]
[email protected]
inis_project — inisA vulnerability was found in Inis up to 2.0.1. It has been rated as critical. This issue affects some unknown processing of the file app/api/controller/default/Proxy.php. The manipulation of the argument p_url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249875.2024-01-088.8CVE-2024-0308
[email protected]
[email protected]
[email protected]
irfanview — b3dIrfanView B3D PlugIns before version 4.56 has a B3d.dll!+27ef heap-based out-of-bounds write.2024-01-059.8CVE-2020-13878
[email protected]
irfanview — b3dIrfanView B3D PlugIns before version 4.56 has a B3d.dll!+214f heap-based out-of-bounds write.2024-01-059.8CVE-2020-13879
[email protected]
irfanview — b3dIrfanView B3D PlugIns before version 4.56 has a B3d.dll!+1cbf heap-based out-of-bounds write.2024-01-059.8CVE-2020-13880
[email protected]
ivanti — connect_secureA command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.2024-01-129.1CVE-2024-21887
[email protected]
ivanti — connect_secureAn authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.2024-01-128.2CVE-2023-46805
[email protected]
ivanti — endpoint_managerAn unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the internal network to execute arbitrary SQL queries and retrieve output without the need for authentication. Under specific circumstances, this may also lead to RCE on the core server.2024-01-098.8CVE-2023-39336
[email protected]
javik — randomizeImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Javik Randomize.This issue affects Randomize: from n/a through 1.4.3.2024-01-088.8CVE-2023-52204
[email protected]
juniper_networks — junos_osAn Improper Validation of Syntactic Correctness of Input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). If an attacker sends high rate of specific ICMP traffic to a device with VXLAN configured, this causes a deadlock of the PFE and results in the device becoming unresponsive. A manual restart will be required to recover the device. This issue only affects EX4100, EX4400, EX4600, QFX5000 Series devices. This issue affects: Juniper Networks Junos OS * 21.4R3 versions earlier than 21.4R3-S4; * 22.1R3 versions earlier than 22.1R3-S3; * 22.2R2 versions earlier than 22.2R3-S1; * 22.3 versions earlier than 22.3R2-S2, 22.3R3; * 22.4 versions earlier than 22.4R2; * 23.1 versions earlier than 23.1R2.2024-01-127.5CVE-2024-21595
[email protected]
[email protected]
juniper_networks — junos_osA Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). In a remote access VPN scenario, if a “tcp-encap-profile” is configured and a sequence of specific packets is received, a flowd crash and restart will be observed. This issue affects Juniper Networks Junos OS on SRX Series: * All versions earlier than 20.4R3-S8; * 21.2 versions earlier than 21.2R3-S6; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S3; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S1; * 22.4 versions earlier than 22.4R2-S2, 22.4R3.2024-01-127.5CVE-2024-21606
[email protected]
[email protected]
juniper_networks — junos_osA Missing Release of Memory after Effective Lifetime vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). In a Juniper Flow Monitoring (jflow) scenario route churn that causes BGP next hops to be updated will cause a slow memory leak and eventually a crash and restart of rpd. Thread level memory utilization for the areas where the leak occurs can be checked using the below command: user@host> show task memory detail | match so_in so_in6 28 32 344450 11022400 344760 11032320 so_in 8 16 1841629 29466064 1841734 29467744 This issue affects: Junos OS * 21.4 versions earlier than 21.4R3; * 22.1 versions earlier than 22.1R3; * 22.2 versions earlier than 22.2R3. Junos OS Evolved * 21.4-EVO versions earlier than 21.4R3-EVO; * 22.1-EVO versions earlier than 22.1R3-EVO; * 22.2-EVO versions earlier than 22.2R3-EVO. This issue does not affect: Juniper Networks Junos OS versions earlier than 21.4R1. Juniper Networks Junos OS Evolved versions earlier than 21.4R1.2024-01-127.5CVE-2024-21611
[email protected]
[email protected]
juniper_networks — junos_osAn Improper Check for Unusual or Exceptional Conditions vulnerability in Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to cause rpd to crash, leading to Denial of Service (DoS). On all Junos OS and Junos OS Evolved platforms, when NETCONF and gRPC are enabled, and a specific query is executed via Dynamic Rendering (DREND), rpd will crash and restart. Continuous execution of this specific query will cause a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS * 22.2 versions earlier than 22.2R2-S2, 22.2R3; * 22.3 versions earlier than 22.3R2, 22.3R3. Juniper Networks Junos OS Evolved * 22.2 versions earlier than 22.2R2-S2-EVO, 22.2R3-EVO; * 22.3 versions earlier than 22.3R2-EVO, 22.3R3-EVO. This issue does not affect Juniper Networks: Junos OS versions earlier than 22.2R1; Junos OS Evolved versions earlier than 22.2R1-EVO.2024-01-127.5CVE-2024-21614
[email protected]
[email protected]
juniper_networks — junos_osAn Improper Validation of Syntactic Correctness of Input vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service (DoS). On all Junos OS MX Series and SRX Series platforms, when SIP ALG is enabled, and a specific SIP packet is received and processed, NAT IP allocation fails for genuine traffic, which causes Denial of Service (DoS). Continuous receipt of this specific SIP ALG packet will cause a sustained DoS condition. NAT IP usage can be monitored by running the following command. user@srx> show security nat resource-usage source-pool <source_pool_name> Pool name: source_pool_name .. Address Factor-index Port-range Used Avail Total Usage X.X.X.X 0 Single Ports 50258 52342 62464 96% <<<<< – Alg Ports 0 2048 2048 0% This issue affects: Juniper Networks Junos OS on MX Series and SRX Series * All versions earlier than 21.2R3-S6; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S1; * 22.4 versions earlier than 22.4R2-S2, 22.4R3; * 23.2 versions earlier than 23.2R1-S1, 23.2R2.2024-01-127.5CVE-2024-21616
[email protected]
[email protected]
juniper_networks — junos_os
&#xA0;
An Out-of-bounds Write vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS), or Remote Code Execution (RCE) and obtain root privileges on the device. This issue is caused by use of an insecure function allowing an attacker to overwrite arbitrary memory. This issue affects Juniper Networks Junos OS SRX Series and EX Series: * Junos OS versions earlier than 20.4R3-S9; * Junos OS 21.2 versions earlier than 21.2R3-S7; * Junos OS 21.3 versions earlier than 21.3R3-S5; * Junos OS 21.4 versions earlier than 21.4R3-S5; * Junos OS 22.1 versions earlier than 22.1R3-S4; * Junos OS 22.2 versions earlier than 22.2R3-S3; * Junos OS 22.3 versions earlier than 22.3R3-S2; * Junos OS 22.4 versions earlier than 22.4R2-S2, 22.4R3.2024-01-129.8CVE-2024-21591
[email protected]
[email protected]
juniper_networks — junos_os_evolvedA NULL Pointer Dereference vulnerability in Juniper Networks Junos OS Evolved on ACX7024, ACX7100-32C and ACX7100-48L allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). If a specific IPv4 UDP packet is received and sent to the Routing Engine (RE) packetio crashes and restarts which causes a momentary traffic interruption. Continued receipt of such packets will lead to a sustained DoS. This issue does not happen with IPv6 packets. This issue affects Juniper Networks Junos OS Evolved on ACX7024, ACX7100-32C and ACX7100-48L: * 21.4-EVO versions earlier than 21.4R3-S6-EVO; * 22.1-EVO versions earlier than 22.1R3-S5-EVO; * 22.2-EVO versions earlier than 22.2R2-S1-EVO, 22.2R3-EVO; * 22.3-EVO versions earlier than 22.3R2-EVO. This issue does not affect Juniper Networks Junos OS Evolved versions earlier than 21.4R1-EVO.2024-01-127.5CVE-2024-21602
[email protected]
[email protected]
juniper_networks — junos_os_evolvedAn Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). If a high rate of specific valid packets are processed by the routing engine (RE) this will lead to a loss of connectivity of the RE with other components of the chassis and thereby a complete and persistent system outage. Please note that a carefully designed lo0 firewall filter will block or limit these packets which should prevent this issue from occurring. The following log messages can be seen when this issue occurs: <host> kernel: nf_conntrack: nf_conntrack: table full, dropping packet This issue affects Juniper Networks Junos OS Evolved: * All versions earlier than 20.4R3-S7-EVO; * 21.2R1-EVO and later versions; * 21.4-EVO versions earlier than 21.4R3-S5-EVO; * 22.1-EVO versions earlier than 22.1R3-S2-EVO; * 22.2-EVO versions earlier than 22.2R3-EVO; * 22.3-EVO versions earlier than 22.3R2-EVO; * 22.4-EVO versions earlier than 22.4R2-EVO.2024-01-127.5CVE-2024-21604
[email protected]
[email protected]
juniper_networks — junos_os_evolvedAn Improper Handling of Syntactically Invalid Structure vulnerability in Object Flooding Protocol (OFP) service of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). On all Junos OS Evolved platforms, when specific TCP packets are received on an open OFP port, the OFP crashes leading to a restart of Routine Engine (RE). Continuous receipt of these specific TCP packets will lead to a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS Evolved * All versions earlier than 21.2R3-S7-EVO; * 21.3 versions earlier than 21.3R3-S5-EVO ; * 21.4 versions earlier than 21.4R3-S5-EVO; * 22.1 versions earlier than 22.1R3-S4-EVO; * 22.2 versions earlier than 22.2R3-S3-EVO ; * 22.3 versions earlier than 22.3R3-EVO; * 22.4 versions earlier than 22.4R2-EVO, 22.4R3-EVO.2024-01-127.5CVE-2024-21612
[email protected]
[email protected]
juniper_networks — paragon_active_assuranceAn Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated network-based attacker to access reports without authenticating, potentially containing sensitive configuration information. A feature was introduced in version 3.1.0 of the Paragon Active Assurance Control Center which allows users to selectively share account data. By exploiting this vulnerability, it is possible to access reports without being logged in, resulting in the opportunity for malicious exfiltration of user data. Note that the Paragon Active Assurance Control Center SaaS offering is not affected by this issue. This issue affects Juniper Networks Paragon Active Assurance versions 3.1.0, 3.2.0, 3.2.2, 3.3.0, 3.3.1, 3.4.0. This issue does not affect Juniper Networks Paragon Active Assurance versions earlier than 3.1.0.2024-01-127.4CVE-2024-21589
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability was found in Kashipara Food Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file itemBillPdf.php. The manipulation of the argument printid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249848.2024-01-079.8CVE-2024-0287
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability classified as critical has been found in Kashipara Food Management System 1.0. This affects an unknown part of the file rawstock_used_damaged_submit.php. The manipulation of the argument product_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249849 was assigned to this vulnerability.2024-01-089.8CVE-2024-0288
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability classified as critical was found in Kashipara Food Management System 1.0. This vulnerability affects unknown code of the file stock_entry_submit.php. The manipulation of the argument itemype leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249850 is the identifier assigned to this vulnerability.2024-01-089.8CVE-2024-0289
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability, which was classified as critical, has been found in Kashipara Food Management System 1.0. This issue affects some unknown processing of the file stock_edit.php. The manipulation of the argument item_type leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249851.2024-01-089.8CVE-2024-0290
[email protected]
[email protected]
[email protected]
korenix — jetnet_seriesAn Improper Authentication vulnerability in Korenix JetNet TFTP allows abuse of this service.&#xA0;This issue affects JetNet devices older than firmware version 2024/01.2024-01-098.6CVE-2023-5376
[email protected]
[email protected]
[email protected]
[email protected]
korenix — jetnet_series
&#xA0;
An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables.&#xA0;This issue affects JetNet devices older than firmware version 2024/01.2024-01-099.8CVE-2023-5347
[email protected]
[email protected]
[email protected]
[email protected]
kutethemes — ovic_responsive_wpbakeryThe Ovic Responsive WPBakery WordPress plugin before 1.2.9 does not limit which options can be updated via some of its AJAX actions, which may allow attackers with a subscriber+ account to update blog options, such as ‘users_can_register’ and ‘default_role’. It also unserializes user input in the process, which may lead to Object Injection attacks.2024-01-088.8CVE-2023-5235
[email protected]
likeshop –&#xA0;likeshopA vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250120.2024-01-097.3CVE-2024-0352
[email protected]
[email protected]
[email protected]
linux — kernelAn out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an attacker to achieve out-of-bounds access.2024-01-127.8CVE-2023-6040
[email protected]
[email protected]
[email protected]
linux — linux_kernelIt was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.2024-01-087.8CVE-2022-2586
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
linux — linux_kernelio_uring UAF, Unix SCM garbage collection2024-01-087CVE-2022-2602
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
linux –&#xA0;kernelIt was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.2024-01-087.8CVE-2021-3600
[email protected]
[email protected]
[email protected]
linux –&#xA0;kernelIt was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0.2024-01-087.8CVE-2022-2588
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
lopalopa — dynamic_lab_management_systemA vulnerability was found in Kashipara Dynamic Lab Management System up to 1.0. It has been classified as critical. This affects an unknown part of the file /admin/admin_login_process.php. The manipulation of the argument admin_password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249873 was assigned to this vulnerability.2024-01-087.5CVE-2024-0306
[email protected]
[email protected]
[email protected]
lopalopa — dynamic_lab_management_systemA vulnerability was found in Kashipara Dynamic Lab Management System up to 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login_process.php. The manipulation of the argument password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249874 is the identifier assigned to this vulnerability.2024-01-087.5CVE-2024-0307
[email protected]
[email protected]
[email protected]
machothemes — strong_testimonialsCross-Site Request Forgery (CSRF) vulnerability in WPChill Strong Testimonials.This issue affects Strong Testimonials: from n/a through 3.1.10.2024-01-058.8CVE-2023-52123
[email protected]
manageengine — adselfservice_plusManageEngine ADSelfService Plus versions&#xA0;6401&#xA0;and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability.2024-01-118.8CVE-2024-0252
0fc0942c-577d-436f-ae8e-945763c79b02
mariosalexandrou — republish_old_postsCross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Republish Old Posts.This issue affects Republish Old Posts: from n/a through 1.21.2024-01-058.8CVE-2023-52145
[email protected]
mate-desktop — atril
&#xA0;
Atril is a simple multi-page document viewer. Atril is vulnerable to a critical Command Injection Vulnerability. This vulnerability gives the attacker immediate access to the target system when the target user opens a crafted document or clicks on a crafted link/URL using a maliciously crafted CBT document which is a TAR archive. A patch is available at commit ce41df6.2024-01-129.6CVE-2023-51698
[email protected]
[email protected]
meowapps — database_cleanerExposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Database Cleaner: Clean, Optimize & Repair.This issue affects Database Cleaner: Clean, Optimize & Repair: from n/a through 0.9.8.2024-01-087.5CVE-2023-51508
[email protected]
metagauss — profilegridMissing Authorization vulnerability in Profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profiles, Memberships, Groups and Communities: from n/a through 5.0.3.2024-01-088.8CVE-2022-36352
[email protected]
microchip — maxview_storage_managerIn default installations of Microchip maxView Storage Manager (for Adaptec Smart Storage Controllers) where Redfish server is configured for remote system management, unauthorized access can occur, with data modification and information disclosure. This affects 3.00.23484 through 4.14.00.26064 (except for the patched versions 3.07.23980 and 4.07.00.25339).2024-01-089.1CVE-2024-22216
[email protected]
microsoft — .net.NET Denial of Service Vulnerability2024-01-097.5CVE-2024-20672
[email protected]
microsoft — .net_8.0
&#xA0;
NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability2024-01-099.1CVE-2024-0057
[email protected]
microsoft — .net_framework.NET Framework Denial of Service Vulnerability2024-01-097.5CVE-2024-21312
[email protected]
microsoft — azure_storage_moverAzure Storage Mover Remote Code Execution Vulnerability2024-01-098CVE-2024-20676
[email protected]
microsoft — azure_uamqpAzure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.2024-01-099.8CVE-2024-21646
[email protected]
[email protected]
microsoft — microsoft_office_2019<p>A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint and Outlook for Windows and Mac. Versions of Office that had this feature enabled will no longer have access to it. This includes Office 2019, Office 2021, Office LTSC for Mac 2021, and Microsoft 365.</p> <p>3D models in Office documents that were previously inserted from a FBX file will continue to work as expected unless the Link to File option was chosen at insert time.</p> <p>This change is effective as of the January 9, 2024 security update.</p>2024-01-097.8CVE-2024-20677
[email protected]
microsoft — microsoft_sql_server_2022_(gdr)Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability2024-01-098.7CVE-2024-0056
[email protected]
microsoft — microsoft_visual_studio_2017_version_15.9_(includes_15.0_-_15.8)Visual Studio Elevation of Privilege Vulnerability2024-01-097.8CVE-2024-20656
[email protected]
microsoft — printer_metadata_troubleshooter_toolMicrosoft Printer Metadata Troubleshooter Tool Remote Code Execution Vulnerability2024-01-097.8CVE-2024-21325
[email protected]
microsoft — sharepoint_serverMicrosoft SharePoint Server Remote Code Execution Vulnerability2024-01-098.8CVE-2024-21318
[email protected]
microsoft — windows_10_1507Windows Kerberos Security Feature Bypass Vulnerability2024-01-098.8CVE-2024-20674
[email protected]
microsoft — windows_10_1507Microsoft Message Queuing Denial of Service Vulnerability2024-01-097.5CVE-2024-20661
[email protected]
microsoft — windows_10_1507Windows Cryptographic Services Remote Code Execution Vulnerability2024-01-097.8CVE-2024-20682
[email protected]
microsoft — windows_10_1507Win32k Elevation of Privilege Vulnerability2024-01-097.8CVE-2024-20683
[email protected]
microsoft — windows_10_1507Microsoft AllJoyn API Denial of Service Vulnerability2024-01-097.5CVE-2024-20687
[email protected]
microsoft — windows_10_1507Remote Desktop Client Remote Code Execution Vulnerability2024-01-097.5CVE-2024-21307
[email protected]
microsoft — windows_10_1809Windows Libarchive Remote Code Execution Vulnerability2024-01-097.3CVE-2024-20696
[email protected]
microsoft — windows_10_1809Windows Kernel Elevation of Privilege Vulnerability2024-01-097.8CVE-2024-20698
[email protected]
microsoft — windows_10_1809Windows Hyper-V Remote Code Execution Vulnerability2024-01-097.5CVE-2024-20700
[email protected]
microsoft — windows_10_1809Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability2024-01-097.8CVE-2024-21310
[email protected]
microsoft — windows_10_21h2Windows Subsystem for Linux Elevation of Privilege Vulnerability2024-01-097.8CVE-2024-20681
[email protected]
microsoft — windows_10_version_1809Microsoft ODBC Driver Remote Code Execution Vulnerability2024-01-098CVE-2024-20654
[email protected]
microsoft — windows_10_version_1809Windows HTML Platforms Security Feature Bypass Vulnerability2024-01-097.5CVE-2024-20652
[email protected]
microsoft — windows_10_version_1809Windows Group Policy Elevation of Privilege Vulnerability2024-01-097CVE-2024-20657
[email protected]
microsoft — windows_10_version_1809Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability2024-01-097.8CVE-2024-20658
[email protected]
microsoft — windows_11_21h2Windows Kernel-Mode Driver Elevation of Privilege Vulnerability2024-01-097.8CVE-2024-21309
[email protected]
microsoft — windows_11_22h2Windows Libarchive Remote Code Execution Vulnerability2024-01-097.3CVE-2024-20697
[email protected]
microsoft — windows_server_2022,23h2_edition_(server_core_installation)Microsoft Common Log File System Elevation of Privilege Vulnerability2024-01-097.8CVE-2024-20653
[email protected]
microsoft — windows_server_2022_23h2Win32k Elevation of Privilege Vulnerability2024-01-097.8CVE-2024-20686
[email protected]
motopress — getwid_-_gutenberg_blocksAny unauthenticated user may send e-mail from the site with any title or content to the admin2024-01-087.5CVE-2023-6042
[email protected]
mtrv — teachpressCross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4.2024-01-058.8CVE-2023-52129
[email protected]
ncast_project — ncastA vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249872.2024-01-087.5CVE-2024-0305
[email protected]
[email protected]
[email protected]
netscout — ngeniusoneAn issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted file.2024-01-099.8CVE-2023-26999
[email protected]
[email protected]
[email protected]
nginx-ui –&#xA0;nginx-uiNginx-UI is an online statistic for Server Indicators?? Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `”desc”` and `”id”` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.2024-01-117CVE-2024-22196
[email protected]
[email protected]
nginx-ui –&#xA0;nginx-uiNginx-ui is online statistics for Server Indicators?? Monitor CPU usage, memory usage, load average, and disk usage in real-time. The `Home > Preference` page exposes a small list of nginx settings such as `Nginx Access Log Path` and `Nginx Error Log Path`. However, the API also exposes `test_config_cmd`, `reload_cmd` and `restart_cmd`. While the UI doesn’t allow users to modify any of these settings, it is possible to do so by sending a request to the API. This issue may lead to authenticated Remote Code Execution, Privilege Escalation, and Information Disclosure. This issue has been patched in version 2.0.0.beta.9.2024-01-117.7CVE-2024-22197
[email protected]
[email protected]
nginx-ui –&#xA0;nginx-uiNginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings. The `Home > Preference` page exposes a list of system settings such as `Run Mode`, `Jwt Secret`, `Node Secret` and `Terminal Start Command`. While the UI doesn’t allow users to modify the `Terminal Start Command` setting, it is possible to do so by sending a request to the API. This issue may lead to authenticated remote code execution, privilege escalation, and information disclosure. This vulnerability has been patched in version 2.0.0.beta.9.2024-01-117.1CVE-2024-22198
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
ninjateam — fastdupExposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FastDup – Fastest WordPress Migration & Duplicator.This issue affects FastDup – Fastest WordPress Migration & Duplicator: from n/a through 2.1.7.2024-01-087.5CVE-2023-51406
[email protected]
nitropack — nitropackCross-Site Request Forgery (CSRF) vulnerability in NitroPack Inc. NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images.This issue affects NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images: from n/a through 1.10.2.2024-01-058.8CVE-2023-52121
[email protected]
nvidia — dgx_a100NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A successful exploit of this vulnerability may lead to denial of service.2024-01-127.5CVE-2023-31032
[email protected]
nvidia — dgx_a100NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may cause an SMI callout vulnerability that could be used to execute arbitrary code at the SMM level. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, and information disclosure.2024-01-127.5CVE-2023-31035
[email protected]
nvidia — dgx_a100
&#xA0;
NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause stack memory corruption by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.2024-01-129CVE-2023-31024
[email protected]
nvidia — dgx_a100
&#xA0;
NVIDIA DGX A100 baseboard management controller (BMC) contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.2024-01-129.3CVE-2023-31029
[email protected]
nvidia — dgx_a100
&#xA0;
NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.2024-01-129.3CVE-2023-31030
[email protected]
nvidia — triton_inference_serverNVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option –model-control explicit, an attacker may use the model load API to cause a relative path traversal. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.2024-01-127.5CVE-2023-31036
[email protected]
omron — cj-series/cs-series_cpu_modulesAn attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and write files form the PLC internal memory and memory card.2024-01-108.6CVE-2022-45794
[email protected]
[email protected]
onenav — onenavA vulnerability was found in OneNav up to 0.9.33. It has been classified as critical. This affects an unknown part of the file /index.php?c=api of the component API. The manipulation of the argument X-Token leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249765 was assigned to this vulnerability.2024-01-079.8CVE-2023-7210
[email protected]
[email protected]
[email protected]
[email protected]
online_food_ordering_system_project — online_food_ordering_systemA vulnerability classified as critical was found in CodeAstro Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /admin/ of the component Admin Panel. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249778 is the identifier assigned to this vulnerability.2024-01-059.8CVE-2024-0247
[email protected]
[email protected]
[email protected]
open-xchange — ox_app_suiteThe optional “LDAP contacts provider” could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized users could break confidentiality of information in the directory and potentially cause high load on the directory server, leading to denial of service. Encoding has been added for user-provided fragments that are used when constructing the LDAP query. No publicly available exploits are known.2024-01-089.6CVE-2023-29050
[email protected]
[email protected]
[email protected]
[email protected]
open-xchange — ox_app_suiteA component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known.2024-01-088.8CVE-2023-29048
[email protected]
[email protected]
[email protected]
[email protected]
open-xchange — ox_app_suiteUser-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default was not effective in this case. Unauthorized users could discover and modify application state, including objects related to other users and contexts. We now make sure that the switch to disable user-generated templates by default works as intended and will remove the feature in future generations of the product. No publicly available exploits are known.2024-01-088.1CVE-2023-29051
[email protected]
[email protected]
[email protected]
[email protected]
openvpn — connectOpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environment variable2024-01-087.8CVE-2023-7224
[email protected]
oretnom23 — clinic_queuing_systemA vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /LoginRegistration.php. The manipulation of the argument formToken leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249820.2024-01-079.8CVE-2024-0264
[email protected]
[email protected]
[email protected]
[email protected]
oretnom23 — clinic_queuing_systemA vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php of the component GET Parameter Handler. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249821 was assigned to this vulnerability.2024-01-078.8CVE-2024-0265
[email protected]
[email protected]
[email protected]
[email protected]
ovation — dynamic_content_for_elementorCross-Site Request Forgery (CSRF) vulnerability in Ovation S.R.L. Dynamic Content for Elementor.This issue affects Dynamic Content for Elementor: from n/a before 2.12.5.2024-01-058.8CVE-2023-52150
[email protected]
phome — empirecmsSQL injection vulnerability in EmpireCMS v7.5, allows remote attackers to execute arbitrary code and obtain sensitive information via the DoExecSql function.2024-01-097.2CVE-2023-50162
[email protected]
phpgurukul — dairy_farm_shop_management_systemA vulnerability, which was classified as critical, was found in PHPGurukul Dairy Farm Shop Management System up to 1.1. Affected is an unknown function of the file add-category.php. The manipulation of the argument category leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250122 is the identifier assigned to this vulnerability.2024-01-109.8CVE-2024-0355
[email protected]
[email protected]
[email protected]
phpgurukul — hospital_management_systemA vulnerability was found in PHPGurukul Hospital Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/edit-doctor-specialization.php. The manipulation of the argument doctorspecilization leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250127.2024-01-109.8CVE-2024-0360
[email protected]
[email protected]
[email protected]
phpgurukul — hospital_management_systemA vulnerability classified as critical has been found in PHPGurukul Hospital Management System 1.0. Affected is an unknown function of the file admin/contact.php. The manipulation of the argument mobnum leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250128.2024-01-109.8CVE-2024-0361
[email protected]
[email protected]
[email protected]
phpgurukul — hospital_management_systemA vulnerability classified as critical was found in PHPGurukul Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/change-password.php. The manipulation of the argument cpass leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-250129 was assigned to this vulnerability.2024-01-109.8CVE-2024-0362
[email protected]
[email protected]
[email protected]
phpgurukul — hospital_management_systemA vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file admin/patient-search.php. The manipulation of the argument searchdata leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250130 is the identifier assigned to this vulnerability.2024-01-109.8CVE-2024-0363
[email protected]
[email protected]
[email protected]
phpgurukul — hospital_management_systemA vulnerability, which was classified as critical, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file admin/query-details.php. The manipulation of the argument adminremark leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250131.2024-01-109.8CVE-2024-0364
[email protected]
[email protected]
[email protected]
presstigers — simple_job_boardCross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board.This issue affects Simple Job Board: from n/a through 2.10.6.2024-01-058.8CVE-2023-52122
[email protected]
prestashow — google_integratorBlind SQL Injection vulnerability in PrestaShow Google Integrator (PrestaShop addon) allows for data extraction and modification. This attack is possible via command insertion in one of the cookies.2024-01-089.1CVE-2023-6921
[email protected]
[email protected]
[email protected]
ptc — kepware_kepserverexAn uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM.2024-01-107.8CVE-2023-29445
[email protected]
[email protected]
[email protected]
puma — pumaPuma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.2024-01-087.5CVE-2024-21647
[email protected]
[email protected]
pyload — pyloadpyLoad 0.5.0 is vulnerable to Unrestricted File Upload.2024-01-088.8CVE-2023-47890
[email protected]
[email protected]
pyload — pyloadpyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.2024-01-087.5CVE-2024-21644
[email protected]
[email protected]
qnap — qcalagentAn OS command injection vulnerability has been reported to affect QcalAgent. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: QcalAgent 1.1.8 and later2024-01-058.8CVE-2023-41289
[email protected]
qnap — qtsAn OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later2024-01-057.2CVE-2023-39294
[email protected]
qnap — qtsA prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that have incompatible type, which may lead to a crash via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later2024-01-057.5CVE-2023-39296
[email protected]
qnap — qtsA buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later2024-01-057.2CVE-2023-45039
[email protected]
qnap — qtsA buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later2024-01-057.2CVE-2023-45040
[email protected]
qnap — qtsA buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later2024-01-057.2CVE-2023-45041
[email protected]
qnap — qtsA buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later2024-01-057.2CVE-2023-45042
[email protected]
qnap — qtsA buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later2024-01-057.2CVE-2023-45043
[email protected]
qnap — qtsA buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later2024-01-057.2CVE-2023-45044
[email protected]
qnap — qumagieA SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: QuMagie 2.2.1 and later2024-01-058.8CVE-2023-47219
[email protected]
qnap — qumagieAn OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: QuMagie 2.2.1 and later2024-01-058.8CVE-2023-47560
[email protected]
qnap — video_stationA SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 ( 2023/11/23 ) and later2024-01-058.8CVE-2023-41287
[email protected]
qnap — video_stationAn OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 ( 2023/11/23 ) and later2024-01-058.8CVE-2023-41288
[email protected]
redis — redisRedis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue has been patched in version 7.0.15 and 7.2.4.2024-01-108.1CVE-2023-41056
[email protected]
[email protected]
[email protected]
reputeinfosystems — armemberCross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup.This issue affects ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: n/a.2024-01-089.8CVE-2023-52200
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution (RCE) with root privileges on the device.2024-01-108.1CVE-2023-48243
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts.2024-01-108.1CVE-2023-48250
[email protected]

rexroth — nexo_cordless_nutrunner_nxa015s-36v

The vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account.2024-01-108.1CVE-2023-48251
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests.2024-01-108.8CVE-2023-48252
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request. By abusing this vulnerability it is possible to exfiltrate other users’ password hashes or update them with arbitrary values and access their accounts.2024-01-108.8CVE-2023-48253
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.2024-01-108.1CVE-2023-48262
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.2024-01-108.1CVE-2023-48263
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.2024-01-108.1CVE-2023-48264
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.2024-01-108.1CVE-2023-48265
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.2024-01-108.1CVE-2023-48266
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges on the device. The vulnerability can be exploited directly by authenticated users, via crafted HTTP requests, or indirectly by unauthenticated users, by accessing already-exported backup packages, or crafting an import package and inducing an authenticated victim into sending the HTTP upload request.2024-01-107.8CVE-2023-48257
[email protected]
sap — gui_connectorUnder certain conditions the Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge)&#xA0;- version 1.0, allows an attacker to access highly sensitive information which would otherwise be restricted causing high impact on confidentiality.2024-01-097.5CVE-2024-22125
[email protected]
[email protected]
sap — lt_replication_serverSAP LT Replication Server – version S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108, does not perform necessary authorization checks. This could allow an attacker with high privileges to perform unintended actions, resulting in escalation of privileges, which has High impact on confidentiality, integrity and availability of the system.2024-01-097.2CVE-2024-21735
[email protected]
[email protected]

sap_se — sap_application_interface_framework_(file_adapter)

In SAP Application Interface Framework File Adapter – version 702, a&#xA0;high privilege user can use a function module to traverse through various layers and execute OS commands directly. By this,&#xA0;such user can control&#xA0;the behavior of the application. This leads to considerable impact on confidentiality, integrity and availability.2024-01-098.4CVE-2024-21737
[email protected]
[email protected]
schneider_electric — easergy_studioA CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain higher privileges by providing a harmful serialized object.2024-01-097.8CVE-2023-7032
[email protected]
siemens — jt2goA vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V14.1 (All versions < V14.1.0.12), Teamcenter Visualization V14.2 (All versions < V14.2.0.9), Teamcenter Visualization V14.3 (All versions < V14.3.0.6). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted CGM files. This could allow an attacker to execute code in the context of the current process.2024-01-097.8CVE-2023-51439
[email protected]
siemens — jt2goA vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V14.1 (All versions < V14.1.0.12), Teamcenter Visualization V14.2 (All versions < V14.2.0.9), Teamcenter Visualization V14.3 (All versions < V14.3.0.6). The affected applications contain a stack overflow vulnerability while parsing specially crafted CGM files. This could allow an attacker to execute code in the context of the current process.2024-01-097.8CVE-2023-51745
[email protected]
siemens — jt2goA vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V14.1 (All versions < V14.1.0.12), Teamcenter Visualization V14.2 (All versions < V14.2.0.9), Teamcenter Visualization V14.3 (All versions < V14.3.0.6). The affected applications contain a stack overflow vulnerability while parsing specially crafted CGM files. This could allow an attacker to execute code in the context of the current process.2024-01-097.8CVE-2023-51746
[email protected]
siemens — simatic_cn_4100A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The “intermediate installation” system state of the affected application allows an attacker to add their own login credentials to the device. This allows an attacker to remotely login as root and take control of the device even after the affected device is fully set up.2024-01-099.8CVE-2023-49251
[email protected]
siemens — simatic_cn_4100A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The “intermediate installation” system state of the affected application uses default credential with admin privileges. An attacker could use the credentials to gain complete control of the affected device.2024-01-099.8CVE-2023-49621
[email protected]
siemens — simatic_cn_4100A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The affected application allows IP configuration change without authentication to the device. This could allow an attacker to cause denial of service condition.2024-01-097.5CVE-2023-49252
[email protected]
siemens — simatic_ipc1047e
&#xA0;
A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC647E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC847E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows). In default installations of maxView Storage Manager where Redfish&#xAE; server is configured for remote system management, a vulnerability has been identified that can provide unauthorized access.2F024-01-0910CVE-2023-51438
[email protected]
siemens — solid_edge_se2023A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.2024-01-097.8CVE-2023-49121
[email protected]
siemens — solid_edge_se2023A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.2024-01-097.8CVE-2023-49122
[email protected]
siemens — solid_edge_se2023A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.2024-01-097.8CVE-2023-49123
[email protected]
siemens — solid_edge_se2023A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.2024-01-097.8CVE-2023-49124
[email protected]
siemens — solid_edge_se2023A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.2024-01-097.8CVE-2023-49126
[email protected]
siemens — solid_edge_se2023A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.2024-01-097.8CVE-2023-49127
[email protected]
siemens — solid_edge_se2023A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted PAR file. This could allow an attacker to execute code in the context of the current process.2024-01-097.8CVE-2023-49128
[email protected]
siemens — solid_edge_se2023A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain a stack overflow vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.2024-01-097.8CVE-2023-49129
[email protected]
siemens — solid_edge_se2023A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.2024-01-097.8CVE-2023-49130
[email protected]
siemens — solid_edge_se2023A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.2024-01-097.8CVE-2023-49131
[email protected]
siemens — solid_edge_se2023A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.2024-01-097.8CVE-2023-49132
[email protected]
siemens — spectrum_power_7A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q4). The affected product’s sudo configuration permits the local administrative account to execute several entries as root user. This could allow an authenticated local attacker to inject arbitrary code and gain root access.2024-01-097.8CVE-2023-44120
[email protected]
smartersite — wp_compress_&#xE2;&#x20AC;&#x201C;_image_optimizer_[all-in-one]
&#xA0;
The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the css parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.2024-01-119.1CVE-2023-6699
[email protected]
[email protected]
smashballoon — custom_twitter_feedsCross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2.2024-01-058.8CVE-2023-52136
[email protected]
snapcreek — duplicatorThe Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server.2024-01-089.8CVE-2018-25095
[email protected]
studip — stud.ipStud.IP 5.x through 5.3.3 allows XSS with resultant upload of executable files, because upload_action and edit_action in Admin_SmileysController do not check the file extension. This leads to remote code execution with the privileges of the www-data user. The fixed versions are 5.3.4, 5.2.6, 5.1.7, and 5.0.9.2024-01-089CVE-2023-50982
[email protected]
[email protected]
[email protected]
stylishpricelist — stylish_price_listCross-Site Request Forgery (CSRF) vulnerability in Designful Stylish Price List – Price Table Builder & QR Code Restaurant Menu.This issue affects Stylish Price List – Price Table Builder & QR Code Restaurant Menu: from n/a through 7.0.17.2024-01-059.8CVE-2023-51673
[email protected]
subnet — powersystem_centerPowerSYSTEM Center versions 2020 Update 16 and prior contain a vulnerability that may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges.2024-01-087.8CVE-2023-6631
[email protected]
[email protected]
surajghosh — hospital_management_systemA vulnerability classified as critical was found in Kashipara Hospital Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file login.php of the component Parameter Handler. The manipulation of the argument email/password leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249823.2024-01-079.8CVE-2024-0267
[email protected]
[email protected]
[email protected]
surajghosh — hospital_management_systemA vulnerability, which was classified as critical, has been found in Kashipara Hospital Management System up to 1.0. Affected by this issue is some unknown functionality of the file registration.php. The manipulation of the argument name/email/pass/gender/age/city leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249824.2024-01-079.8CVE-2024-0268
[email protected]
[email protected]
[email protected]
svnlabs — html5_mp3_player_with_folder_feedburner_playlist_freeDeserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Folder Feedburner Playlist Free.This issue affects HTML5 MP3 Player with Folder Feedburner Playlist Free: from n/a through 2.8.0.2024-01-087.2CVE-2023-52202
[email protected]
svnlabs — html5_mp3_player_with_playlist_freeDeserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Playlist Free.This issue affects HTML5 MP3 Player with Playlist Free: from n/a through 3.0.0.2024-01-088.8CVE-2023-52207
[email protected]
svnlabs — html5_soundcloud_player_with_playlist_freeDeserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 SoundCloud Player with Playlist Free.This issue affects HTML5 SoundCloud Player with Playlist Free: from n/a through 2.8.0.2024-01-087.2CVE-2023-52205
[email protected]
taggbox — taggboxDeserialization of Untrusted Data vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics. This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1.2024-01-089.8CVE-2023-52225
[email protected]
taokeyun –&#xA0;taokeyunA vulnerability was found in Taokeyun up to 1.0.5. It has been classified as critical. Affected is the function login of the file application/index/controller/m/User.php of the component HTTP POST Request Handler. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250584.2024-01-137.3CVE-2024-0479
[email protected]
[email protected]
[email protected]
taokeyun –&#xA0;taokeyunA vulnerability was found in Taokeyun up to 1.0.5. It has been declared as critical. Affected by this vulnerability is the function index of the file application/index/controller/m/Drs.php of the component HTTP POST Request Handler. The manipulation of the argument cid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250585 was assigned to this vulnerability.2024-01-137.3CVE-2024-0480
[email protected]
[email protected]
[email protected]
[email protected]
tenda — a18_firmwareTenda A18 v15.13.07.09 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.2024-01-099.8CVE-2023-50585
[email protected]
tenda — ax12_firmwareBuffer Overflow vulnerability in Tenda AX12 V22.03.01.46, allows remote attackers to cause a denial of service (DoS) via list parameter in SetNetControlList function.2024-01-107.5CVE-2023-49427
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formSetIptv.2024-01-109.8CVE-2023-51952
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv.2024-01-109.8CVE-2023-51953
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formSetIptv.2024-01-109.8CVE-2023-51954
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formSetIptv.2024-01-109.8CVE-2023-51955
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formSetIptv2024-01-109.8CVE-2023-51956
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formGetIptv.2024-01-109.8CVE-2023-51957
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formGetIptv.2024-01-109.8CVE-2023-51958
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formGetIptv.2024-01-109.8CVE-2023-51959
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formGetIptv.2024-01-109.8CVE-2023-51960
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formGetIptv.2024-01-109.8CVE-2023-51961
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function setIptvInfo.2024-01-109.8CVE-2023-51962
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function setIptvInfo.2024-01-109.8CVE-2023-51963
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function setIptvInfo.2024-01-109.8CVE-2023-51964
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function setIptvInfo.2024-01-109.8CVE-2023-51965
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function setIptvInfo.2024-01-109.8CVE-2023-51966
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function getIptvInfo.2024-01-109.8CVE-2023-51967
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function getIptvInfo.2024-01-109.8CVE-2023-51968
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function getIptvInfo.2024-01-109.8CVE-2023-51969
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv.2024-01-109.8CVE-2023-51970
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function getIptvInfo.2024-01-109.8CVE-2023-51971
[email protected]
tenda — ax1803_firmwareTenda AX1803 v1.0.0.1 was discovered to contain a command injection vulnerability via the function fromAdvSetLanIp.2024-01-109.8CVE-2023-51972
[email protected]
tenda — i29_firmwareBuffer Overflow vulnerability in Tenda i29 versions 1.0 V1.0.0.5 and 1.0 V1.0.0.2, allows remote attackers to cause a denial of service (DoS) via the pingIp parameter in the pingSet function.2024-01-057.5CVE-2023-50991
[email protected]
themepunch — slider_revolutionThe Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution.2024-01-088.8CVE-2023-6528
[email protected]
thimpress — learnpress_&#xE2;&#x20AC;&#x201C;_wordpress_lms_plugin
&#xA0;
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.2024-01-119.8CVE-2023-6567
[email protected]
[email protected]
tianocore — edk2EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.2024-01-097CVE-2022-36763
[email protected]
tianocore — edk2EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.2024-01-097CVE-2022-36764
[email protected]
tianocore — edk2EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.2024-01-097CVE-2022-36765
[email protected]
tinowagner — jupyter_notebook_viewernbviewer-app (aka Jupyter Notebook Viewer) before 0.1.6 has the get-task-allow entitlement for release builds.2024-01-059.8CVE-2023-51277
[email protected]
[email protected]
[email protected]
[email protected]
totolink — lr1200gb_firmwareA vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected is the function setOpModeCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249858 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-089.8CVE-2024-0292
[email protected]
[email protected]
[email protected]
totolink — lr1200gb_firmwareA vulnerability classified as critical was found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected by this vulnerability is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249859. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-089.8CVE-2024-0293
[email protected]
[email protected]
[email protected]
totolink — lr1200gb_firmwareA vulnerability, which was classified as critical, has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected by this issue is the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249860. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-089.8CVE-2024-0294
[email protected]
[email protected]
[email protected]
totolink — lr1200gb_firmwareA vulnerability, which was classified as critical, was found in Totolink LR1200GB 9.1.0u.6619_B20230130. This affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249861 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-089.8CVE-2024-0295
[email protected]
[email protected]
[email protected]
totolink — lr1200gb_firmwareA vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been rated as critical. This issue affects the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249857 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-088.8CVE-2024-0291
[email protected]
[email protected]
[email protected]
totolink — n200re_firmwareA vulnerability has been found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This vulnerability affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument host_time leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249862 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-089.8CVE-2024-0296
[email protected]
[email protected]
[email protected]
totolink — n200re_firmwareA vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This issue affects the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249863. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-089.8CVE-2024-0297
[email protected]
[email protected]
[email protected]
totolink — n200re_firmwareA vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. Affected is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249864. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-089.8CVE-2024-0298
[email protected]
[email protected]
[email protected]
totolink — n200re_firmwareA vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been declared as critical. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249865 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-089.8CVE-2024-0299
[email protected]
[email protected]
[email protected]
totolink — n350rt_firmwareA vulnerability has been found in Totolink N350RT 9.3.5u.6139_B202012 and classified as critical. Affected by this vulnerability is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249853 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-099.8CVE-2023-7219
[email protected]
[email protected]
[email protected]
totolink — n350rt_firmwareA vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6139_B20201216. Affected by this vulnerability is the function main of the file /cgi-bin/cstecgi.cgi?action=login&flag=1 of the component HTTP POST Request Handler. The manipulation of the argument v33 leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249769 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-078.8CVE-2023-7213
[email protected]
[email protected]
[email protected]
totolink — n350rt_firmwareA vulnerability, which was classified as critical, has been found in Totolink N350RT 9.3.5u.6139_B20201216. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument v8 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249770 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-078.8CVE-2023-7214
[email protected]
[email protected]
[email protected]
totolink — n350rt_firmwareA vulnerability, which was classified as critical, was found in Totolink N350RT 9.3.5u.6139_B202012. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-249852. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-087.2CVE-2023-7218
[email protected]
[email protected]
[email protected]
totolink — nr1800x_firmwareA vulnerability was found in Totolink NR1800X 9.1.0u.6279_B20210910 and classified as critical. Affected by this issue is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249854 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-099.8CVE-2023-7220
[email protected]
[email protected]
[email protected]
totolink — t6_firmwareA vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. It has been classified as critical. This affects the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument v41 leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249855. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-099.8CVE-2023-7221
[email protected]
[email protected]
[email protected]
totolink — x2000r_firmwareA vulnerability classified as critical was found in Totolink X2000R_V2 2.0.0-B20230727.10434. This vulnerability affects the function formTmultiAP of the file /bin/boa. The manipulation leads to buffer overflow. VDB-249742 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-079.8CVE-2023-7208
[email protected]
[email protected]
[email protected]
totolink — x2000r_firmwareA vulnerability was found in Totolink X2000R 1.0.0-B20221212.1452. It has been declared as critical. This vulnerability affects the function formTmultiAP of the file /bin/boa of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249856. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-099.8CVE-2023-7222
[email protected]
[email protected]
[email protected]
tp-link — tapoTP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel.2024-01-097.5CVE-2023-27098
[email protected]
[email protected]
[email protected]
[email protected]
trellix — agentA buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause a Denial of Service (DoS), through exploiting a memory corruption issue in the TA service, which runs as root. This may also result in the disabling of event reporting to ePO, caused by failure to validate input from the file correctly.2024-01-097.8CVE-2024-0213
[email protected]
trellix — anti-malware_engineA symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local user to potentially gain an escalation of privileges. This was achieved by adding an entry to the registry under the Trellix ENS registry folder with a symbolic link to files that the user wouldn’t normally have permission to. After a scan, the Engine would follow the links and remove the files2024-01-097.1CVE-2024-0206
[email protected]
trendnet — tv-ip1314pi_firmwareAn issue was discovered in libremote_dbg.so on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Filtering of debug information is mishandled during use of popen. Consequently, an attacker can bypass validation and execute a shell command.2024-01-099.8CVE-2023-49235
[email protected]
[email protected]
trendnet — tv-ip1314pi_firmwareA stack-based buffer overflow was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices, leading to arbitrary command execution. This occurs because of lack of length validation during a sscanf of a user-entered scale field in the RTSP playback function of davinci.2024-01-099.8CVE-2023-49236
[email protected]
[email protected]
uniwayinfo — uw-302vp_firmwareA vulnerability was found in Uniway Router 2.0. It has been declared as critical. This vulnerability affects unknown code of the component Administrative Web Interface. The manipulation leads to reliance on ip address for authentication. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-249766 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-078.1CVE-2023-7211
[email protected]
[email protected]
[email protected]
uniwayinfo — uw-302vp_firmwareA vulnerability was found in Uniway Router up to 2.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boaform/device_reset.cgi of the component Device Reset Handler. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249758 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-077.5CVE-2023-7209
[email protected]
[email protected]
[email protected]
wallix — bastionWALLIX Bastion 7.x, 8.x, 9.x and 10.x and WALLIX Access Manager 3.x and 4.x have Incorrect Access Control which can lead to sensitive data exposure.2024-01-087.5CVE-2023-49961
[email protected]
wazuh — wazuhWazuh is a free and open source platform used for threat prevention, detection, and response. This bug introduced a stack overflow hazard that could allow a local privilege escalation. This vulnerability was patched in version 4.5.3.2024-01-127.4CVE-2023-42463
[email protected]
wiselyhub — js_help_deskUnrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.2024-01-059.8CVE-2022-46839
[email protected]
wordpress — wordpressAuthorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway. This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.1.2024-01-059.8CVE-2023-51502
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in UkrSolution Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce.This issue affects Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce: from n/a through 1.5.1.2024-01-089.8CVE-2023-52215
[email protected]
wordpress — wordpressDeserialization of Untrusted Data vulnerability in Anton Bond Woocommerce Tranzila Payment Gateway. This issue affects Woocommerce Tranzila Payment Gateway: from n/a through 1.0.8.2024-01-089.8CVE-2023-52218
[email protected]
wordpress — wordpressMissing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More.This issue affects Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More: from n/a through 2.1.5.2024-01-088.8CVE-2022-34344
[email protected]
wordpress — wordpressCross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Product Bundles for WooCommerce.This issue affects WPC Product Bundles for WooCommerce: from n/a through 7.3.1.2024-01-058.8CVE-2023-52127
[email protected]
wordpress — wordpressCross-Site Request Forgery (CSRF) vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard.This issue affects White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard: from n/a through 2.9.0.2024-01-058.8CVE-2023-52128
[email protected]
wordpress — wordpressImproper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Cool Plugins Events Shortcodes For The Events Calendar.This issue affects Events Shortcodes For The Events Calendar: from n/a through 2.3.1.2024-01-088.8CVE-2023-52142
[email protected]
wordpress — wordpressCross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.2.2.2024-01-088.8CVE-2023-52222
[email protected]
wordpress — wordpressThe WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.9. This is due to missing or incorrect nonce validation on the update_password_validate function. This makes it possible for unauthenticated attackers to reset a user’s password via a forged request granted they can trick the user into performing an action such as clicking on a link.2024-01-118.8CVE-2023-5448
[email protected]
[email protected]
wordpress — wordpressThe BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally, default settings will place an index.php and a .htaccess file into the chosen directory (unless already present) when the first backup job is run that are intended to prevent directory listing and file access. This means that an attacker could set the backup directory to the root of another site in a shared environment and thus disable that site.2024-01-118.7CVE-2023-5504
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution.2024-01-088.8CVE-2023-6140
[email protected]
wordpress — wordpressThe Piotnet Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the ‘piotnetforms_ajax_form_builder’ function in versions up to, and including, 1.0.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible.2024-01-118.1CVE-2023-6220
[email protected]
[email protected]
wordpress — wordpressThe LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due to the plugin making use of the call_user_func function with user input. This makes it possible for unauthenticated attackers to execute any public function with one parameter, which could result in remote code execution.2024-01-118.1CVE-2023-6634
[email protected]
[email protected]
wordpress — wordpressThe CommentTweets WordPress plugin through 0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks2024-01-088.8CVE-2023-6845
[email protected]
[email protected]
wordpress — wordpressThe Slick Social Share Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘dcssb_ajax_update’ function in versions up to, and including, 2.4.11. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily.2024-01-118.8CVE-2023-6878
[email protected]
[email protected]
wordpress — wordpressExposure of Sensitive Information to an Unauthorized Actor vulnerability in StudioWombat WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce.This issue affects WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce: from n/a through 1.4.3.2024-01-087.5CVE-2023-51408
[email protected]
wordpress — wordpressExposure of Sensitive Information to an Unauthorized Actor vulnerability in Naa986 WP Stripe Checkout.This issue affects WP Stripe Checkout: from n/a through 1.2.2.37.2024-01-057.5CVE-2023-52143
[email protected]
wordpress — wordpressExposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Swings Coupon Referral Program.This issue affects Coupon Referral Program: from n/a through 1.7.2.2024-01-087.5CVE-2023-52190
[email protected]
wordpress — wordpressThe Ni Purchase Order(PO) For WooCommerce WordPress plugin through 1.2.1 does not validate logo and signature image files uploaded in the settings, allowing high privileged user to upload arbitrary files to the web server, triggering an RCE vulnerability by uploading a web shell.2024-01-087.2CVE-2023-5957
[email protected]
wordpress — wordpressThe Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download the debug log without authorization and gain access to sensitive data2024-01-087.5CVE-2023-6383
[email protected]
wordpress — wordpressThe Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files.2024-01-087.5CVE-2023-6505
[email protected]
wordpress — wordpressThe Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the ‘upload_import_file’ function in versions up to, and including, 2.4.8. This makes it possible for authenticated attackers with shop manager-level capabilities or above, to upload arbitrary files on the affected site’s server which may make remote code execution possible.2024-01-117.2CVE-2023-6558
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the ‘gspb_save_files’ function in versions up to, and including, 7.6.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site’s server which may make remote code execution possible.2024-01-117.2CVE-2023-6636
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function publish_website in all versions up to, and including, 1.9.7. This makes it possible for unauthenticated attackers to enable and disable maintenance mode.2024-01-117.3CVE-2023-6751
[email protected]
[email protected]
wordpress — wordpressThe Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ arf_http_referrer_url’ parameter in all versions up to, and including, 1.5.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-117.2CVE-2023-6828
[email protected]
[email protected]
wordpress — wordpress
&#xA0;
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ivole_import_upload_csv AJAX action in all versions up to, and including, 5.38.9. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site’s server which may make remote code execution possible.2024-01-119.8CVE-2023-6979
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
wordpress — wordpress
&#xA0;
The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of the handle_downloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to download back-up files which can contain sensitive information such as user passwords, PII, database credentials, and much more.2024-01-117.5CVE-2023-6266
[email protected]
[email protected]
[email protected]
[email protected]
wow-company — floating_buttonCross-Site Request Forgery (CSRF) vulnerability in Wow-Company Floating Button.This issue affects Floating Button: from n/a through 6.0.2024-01-058.8CVE-2023-52149
[email protected]
wp-blogs-planetarium_project — wp-blogs-planetariumThe WP Blogs’ Planetarium WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack2024-01-088.8CVE-2023-6532
[email protected]
[email protected]
wpaffiliatemanager — affiliates_managerCross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.31.2024-01-058.8CVE-2023-52130
[email protected]
wpchill — download_monitorExposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7.60.2024-01-087.5CVE-2022-45354
[email protected]
wpexpertsio — post_smtp_&#xE2;&#x20AC;&#x201C;_the_#1_wordpress_smtp_plugin_with_advanced_email_logging_and_delivery_failure_notifications
&#xA0;
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover.2024-01-119.8CVE-2023-6875
[email protected]
[email protected]
[email protected]
[email protected]
wpjobportal — wp_job_portalCross-Site Request Forgery (CSRF) vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a through 2.0.6.2024-01-058.8CVE-2023-52184
[email protected]
wpmudev — defender_securityExposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender Security – Malware Scanner, Login Security & Firewall: from n/a through 4.1.0.2024-01-087.5CVE-2023-51490
[email protected]
wpzone — inline_image_upload_for_bbpressCross-Site Request Forgery (CSRF) vulnerability in WP Zone Inline Image Upload for BBPress.This issue affects Inline Image Upload for BBPress: from n/a through 1.1.18.2024-01-058.8CVE-2023-51668
[email protected]
wwbn — avideoA cross-site scripting (xss) vulnerability exists in the navbarMenuAndLogo.php user name functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.2024-01-108.5CVE-2023-48730
[email protected]
wwbn — avideoAn insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to an arbitrary user password recovery. An attacker can send an HTTP request to trigger this vulnerability.2024-01-108.8CVE-2023-49589
[email protected]
wwbn — avideo
&#xA0;
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.2024-01-109CVE-2023-47861
[email protected]
wwbn — avideo
&#xA0;
A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send a series of HTTP requests to trigger this vulnerability.2024-01-109.8CVE-2023-47862
[email protected]
wwbn — avideo
&#xA0;
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.2024-01-109.6CVE-2023-48728
[email protected]
wwbn — avideo
&#xA0;
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and brute force the salt offline, leading to forging a legitimate password recovery code for the admin user.2024-01-109.8CVE-2023-49599
[email protected]
wwbn — avideo
&#xA0;
An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.2024-01-107.5CVE-2023-49738
[email protected]
wwbn — avideo
&#xA0;
A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user credentials. An attacker can send a series of HTTP requests to trigger this vulnerability.2024-01-107.3CVE-2023-49810
[email protected]
xen — xenFor migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped when PV guests run, Xen and shadowed PV guests run directly the respective shadow page tables. For 64-bit PV guests this means running on the shadow of the guest root page table. In the course of dealing with shortage of memory in the shadow pool associated with a domain, shadows of page tables may be torn down. This tearing down may include the shadow root page table that the CPU in question is presently running on. While a precaution exists to supposedly prevent the tearing down of the underlying live page table, the time window covered by that precaution isn’t large enough.2024-01-057.8CVE-2023-34322
[email protected]
xen — xen[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] libfsimage contains parsing code for several filesystems, most of them based on grub-legacy code. libfsimage is used by pygrub to inspect guest disks. Pygrub runs as the same user as the toolstack (root in a priviledged domain). At least one issue has been reported to the Xen Security Team that allows an attacker to trigger a stack buffer overflow in libfsimage. After further analisys the Xen Security Team is no longer confident in the suitability of libfsimage when run against guest controlled input with super user priviledges. In order to not affect current deployments that rely on pygrub patches are provided in the resolution section of the advisory that allow running pygrub in deprivileged mode. CVE-2023-4949 refers to the original issue in the upstream grub project (“An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory corruption in grub’s XFS file system implementation.”) CVE-2023-34325 refers specifically to the vulnerabilities in Xen’s copy of libfsimage, which is decended from a very old version of grub.2024-01-057.8CVE-2023-34325
[email protected]
xen — xenThe caching invalidation guidelines from the AMD-Vi specification (48882-Rev 3.07-PUB-Oct 2022) is incorrect on some hardware, as devices will malfunction (see stale DMA mappings) if some fields of the DTE are updated but the IOMMU TLB is not flushed. Such stale DMA mappings can point to memory ranges not owned by the guest, thus allowing access to unindented memory regions.2024-01-057.8CVE-2023-34326
[email protected]
xwiki — xwikiXWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the “first name” or “last name” fields during user registration. This impacts all installations that have user registration enabled for guests. This vulnerability has been patched in XWiki 14.10.17, 15.5.3 and 15.8 RC1.2024-01-089.8CVE-2024-21650
[email protected]
[email protected]
[email protected]
xwiki — xwikiXWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback action is missing a right protection, a user can rollback to a previous version of the page to gain rights they don’t have anymore. The problem has been patched in XWiki 14.10.17, 15.5.3 and 15.8-rc-1 by ensuring that the rights are checked before performing the rollback.2024-01-098.8CVE-2024-21648
[email protected]
[email protected]
[email protected]
yevhenkotelnytskyi — js_\&_css_script_optimizerCross-Site Request Forgery (CSRF) vulnerability in Yevhen Kotelnytskyi JS & CSS Script Optimizer.This issue affects JS & CSS Script Optimizer: from n/a through 0.3.3.2024-01-088.8CVE-2023-52216
[email protected]
youke365 — youke_365A vulnerability, which was classified as critical, was found in Youke365 up to 1.5.3. Affected is an unknown function of the file /app/api/controller/caiji.php of the component Parameter Handler. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249870 is the identifier assigned to this vulnerability.2024-01-089.8CVE-2024-0303
[email protected]
[email protected]
[email protected]
youke365 — youke_365A vulnerability has been found in Youke365 up to 1.5.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/collect.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249871.2024-01-089.8CVE-2024-0304
[email protected]
[email protected]
[email protected]
zohocorp — manageengine_firewall_analyzerA directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.2024-01-088.6CVE-2023-47211
[email protected]
[email protected]
zoom_video_communications_inc. — zoom_desktop_client_for_windows/zoom_vdi_client_for_windows/zoom_sdks_for_windowsImproper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenticated user to conduct an escalation of privilege via local access.2024-01-128.8CVE-2023-49647
[email protected]

Back to top

&#xA0;

Medium Vulnerabilities

Primary
Vendor — Product
DescriptionPublishedCVSS ScoreSource & Patch Info
&#xA0;react-native-mmkv–&#xA0;react-native-mmkvreact-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app’s thread model. This issue has been patched in version 2.11.0.2024-01-094.4CVE-2024-21668
[email protected]
[email protected]
[email protected]
acritum — femitter_serverA vulnerability, which was classified as problematic, was found in Acritum Femitter Server 1.04. Affected is an unknown function. The manipulation leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250446 is the identifier assigned to this vulnerability.2024-01-124.3CVE-2010-10011
[email protected]
[email protected]
[email protected]
adobe — substance3d_stagerAdobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-01-105.5CVE-2024-20714
[email protected]
adobe — substance3d_stagerAdobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-01-105.5CVE-2024-20715
[email protected]
adobe — substance_3d_stagerAdobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-01-105.5CVE-2024-20710
[email protected]
adobe — substance_3d_stagerAdobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-01-105.5CVE-2024-20711
[email protected]
adobe — substance_3d_stagerAdobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-01-105.5CVE-2024-20712
[email protected]
adobe — substance_3d_stagerAdobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.2024-01-105.5CVE-2024-20713
[email protected]
ajexperience — 404_solutionExposure of Sensitive Information to an Unauthorized Actor vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a through 2.33.0.2024-01-055.3CVE-2023-52146
[email protected]
apollo –&#xA0;apolloA vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. VDB-250430 is the identifier assigned to this vulnerability. NOTE: The maintainer explains that user data information like user id, name, and email are not sensitive.2024-01-124.3CVE-2022-4962
[email protected]
[email protected]
[email protected]
apple — macosThis issue was addressed with improved data protection. This issue is fixed in macOS Sonoma 14. An app may be able to access user-sensitive data.2024-01-105.5CVE-2023-40411
[email protected]
apple — macosA logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access removable volumes without user consent.2024-01-105.5CVE-2023-40430
[email protected]
apple — macosThis issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access sensitive user data.2024-01-105.5CVE-2023-41987
[email protected]
apple — macosA logic issue was addressed with improved checks This issue is fixed in macOS Sonoma 14. A camera extension may be able to access the camera view from apps other than the app for which it was granted permission.2024-01-105.5CVE-2023-41994
[email protected]
apple — macosThe issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access protected user data.2024-01-105.5CVE-2023-42929
[email protected]
appwrite — command_line_interfaceIn Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials.2024-01-095.5CVE-2023-50974
[email protected]
[email protected]
arm — valhall_gpu_kernel_driverUse After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver allows a&#xA0;local non-privileged user to make improper GPU processing operations to gain access to already freed memory. This issue affects Valhall GPU Kernel Driver: from r37p0 through r40p0.2024-01-085.5CVE-2023-5091
[email protected]
austin –&#xA0;austinA vulnerability was found in ZhongFuCheng3y Austin 1.0 and classified as critical. This issue affects the function getFile of the file com/java3y/austin/web/controller/MaterialController.java of the component Upload Material Menu. The manipulation leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250619.2024-01-135.5CVE-2024-0505
[email protected]
[email protected]
[email protected]
autelrobotics — evo_nano_drone_firmwareAutel EVO NANO drone flight control firmware version 1.6.5 is vulnerable to denial of service (DoS).2024-01-065.7CVE-2023-50121
[email protected]
ava — teaching_video_application_service_platformCross Site Scripting (XSS) vulnerability in AVA teaching video application service platform version 3.1, allows remote attackers to execute arbitrary code via a crafted script to ajax.aspx.2024-01-066.1CVE-2023-50609
[email protected]
blood_bank_&_donor_management –&#xA0;blood_bank_&_donor_managementA vulnerability has been found in Blood Bank & Donor Management 5.6 and classified as critical. This vulnerability affects unknown code of the file /admin/request-received-bydonar.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250564.2024-01-124.7CVE-2024-0459
[email protected]
[email protected]
[email protected]
campcodes — student_information_systemA vulnerability was found in Campcodes Student Information System 1.0. It has been classified as critical. Affected is an unknown function of the file /classes/Users.php?f=save. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250602 is the identifier assigned to this vulnerability.2024-01-136.3CVE-2024-0497
[email protected]
[email protected]
[email protected]
cformsii_project — cformsiiImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Oliver Seidel, Bastian Germann cformsII allows Stored XSS.This issue affects cformsII: from n/a through 15.0.5.2024-01-084.8CVE-2023-52203
[email protected]
chanzhaoyu — chatgpt_webA vulnerability, which was classified as problematic, has been found in Chanzhaoyu chatgpt-web 2.11.1. This issue affects some unknown processing. The manipulation of the argument Description with the input <image src onerror=prompt(document.domain)> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249779.2024-01-086.1CVE-2023-7215
[email protected]
[email protected]
[email protected]
chromiumembedded — cefCEF (Chromium Embedded Framework ) is a simple framework for embedding Chromium-based browsers in other applications. `CefLayeredWindowUpdaterOSR::OnAllocatedSharedMemory` does not check the size of the shared memory, which leads to out-of-bounds read outside the sandbox. This vulnerability was patched in commit 1f55d2e.2024-01-125.3CVE-2024-21639
[email protected]
[email protected]
chromiumembedded — cefChromium Embedded Framework (CEF) is a simple framework for embedding Chromium-based browsers in other applications.`CefVideoConsumerOSR::OnFrameCaptured` does not check `pixel_format` properly, which leads to out-of-bounds read out of the sandbox. This vulnerability was patched in commit 1f55d2e.2024-01-135.4CVE-2024-21640
[email protected]
[email protected]
code-projects — dormitory_management_systemA vulnerability classified as critical has been found in code-projects Dormitory Management System 1.0. Affected is an unknown function of the file comment.php. The manipulation of the argument com leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250578 is the identifier assigned to this vulnerability.2024-01-126.3CVE-2024-0473
[email protected]
[email protected]
[email protected]
code-projects — dormitory_management_systemA vulnerability, which was classified as critical, has been found in code-projects Dormitory Management System 1.0. Affected by this issue is some unknown functionality of the file modifyuser.php. The manipulation of the argument user_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250580.2024-01-136.3CVE-2024-0475
[email protected]
[email protected]
[email protected]
code-projects — employee_profile_management_systemA vulnerability, which was classified as critical, has been found in code-projects Employee Profile Management System 1.0. This issue affects some unknown processing of the file file_table.php. The manipulation of the argument per_id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250571.2024-01-125.5CVE-2024-0466
[email protected]
[email protected]
[email protected]
code-projects — faculty_management_systemA vulnerability was found in code-projects Faculty Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/pages/student-print.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250565 was assigned to this vulnerability.2024-01-126.3CVE-2024-0460
[email protected]
[email protected]
[email protected]
code-projects — fighting_c***_information_systemA vulnerability has been found in code-projects Fighting C*** Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/action/new-father.php. The manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250573 was assigned to this vulnerability.2024-01-126.3CVE-2024-0468
[email protected]
[email protected]
[email protected]
code-projects — fighting_c***_information_systemA vulnerability has been found in code-projects Fighting C*** Information System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/action/update-deworm.php. The manipulation of the argument usage_deworm leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250582 is the identifier assigned to this vulnerability.2024-01-136.3CVE-2024-0477
[email protected]
[email protected]
[email protected]
code-projects — fighting_c***_information_systemA vulnerability was found in code-projects Fighting C*** Information System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/pages/edit_chicken.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250583.2024-01-136.3CVE-2024-0478
[email protected]
[email protected]
[email protected]
code-projects — fighting_c***_information_systemA vulnerability, which was classified as critical, has been found in code-projects Fighting C*** Information System 1.0. This issue affects some unknown processing of the file admin/action/update_mother.php. The manipulation of the argument age_mother leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250589 was assigned to this vulnerability.2024-01-136.3CVE-2024-0484
[email protected]
[email protected]
[email protected]
code-projects — fighting_c***_information_systemA vulnerability, which was classified as critical, was found in code-projects Fighting C*** Information System 1.0. Affected is an unknown function of the file admin/pages/tables/add_con.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250590 is the identifier assigned to this vulnerability.2024-01-136.3CVE-2024-0485
[email protected]
[email protected]
[email protected]
code-projects — fighting_c***_information_systemA vulnerability has been found in code-projects Fighting C*** Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/action/add_con.php. The manipulation of the argument chicken leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250591.2024-01-136.3CVE-2024-0486
[email protected]
[email protected]
[email protected]
code-projects — fighting_c***_information_systemA vulnerability was found in code-projects Fighting C*** Information System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/action/delete-vaccine.php. The manipulation of the argument ref leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250592.2024-01-136.3CVE-2024-0487
[email protected]
[email protected]
[email protected]
code-projects — fighting_c***_information_systemA vulnerability was found in code-projects Fighting C*** Information System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/action/new-feed.php. The manipulation of the argument type_feed leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250593 was assigned to this vulnerability.2024-01-136.3CVE-2024-0488
[email protected]
[email protected]
[email protected]
code-projects — fighting_c***_information_systemA vulnerability was found in code-projects Fighting C*** Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/action/edit_chicken.php. The manipulation of the argument ref leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250594 is the identifier assigned to this vulnerability.2024-01-136.3CVE-2024-0489
[email protected]
[email protected]
[email protected]
code-projects — human_resource_integrated_systemA vulnerability was found in code-projects Human Resource Integrated System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file update_personal_info.php. The manipulation of the argument sex leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250574 is the identifier assigned to this vulnerability.2024-01-126.3CVE-2024-0469
[email protected]
[email protected]
[email protected]
code-projects — human_resource_integrated_systemA vulnerability was found in code-projects Human Resource Integrated System 1.0. It has been classified as critical. This affects an unknown part of the file /admin_route/inc_service_credits.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250575.2024-01-126.3CVE-2024-0470
[email protected]
[email protected]
[email protected]
code-projects — human_resource_integrated_systemA vulnerability was found in code-projects Human Resource Integrated System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin_route/dec_service_credits.php. The manipulation of the argument date leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250576.2024-01-126.3CVE-2024-0471
[email protected]
[email protected]
[email protected]
code-projects — online_faculty_clearanceA vulnerability was found in code-projects Online Faculty Clearance 1.0. It has been classified as critical. Affected is an unknown function of the file deactivate.php of the component HTTP POST Request Handler. The manipulation of the argument haydi leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250566 is the identifier assigned to this vulnerability.2024-01-126.3CVE-2024-0461
[email protected]
[email protected]
[email protected]
code-projects — online_faculty_clearanceA vulnerability was found in code-projects Online Faculty Clearance 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /production/designee_view_status.php of the component HTTP POST Request Handler. The manipulation of the argument haydi leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250567.2024-01-126.3CVE-2024-0462
[email protected]
[email protected]
[email protected]
code-projects — online_faculty_clearanceA vulnerability was found in code-projects Online Faculty Clearance 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /production/admin_view_info.php of the component HTTP POST Request Handler. The manipulation of the argument haydi leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250568.2024-01-126.3CVE-2024-0463
[email protected]
[email protected]
[email protected]
code-projects — online_faculty_clearanceA vulnerability classified as critical has been found in code-projects Online Faculty Clearance 1.0. This affects an unknown part of the file delete_faculty.php of the component HTTP GET Request Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250569 was assigned to this vulnerability.2024-01-126.3CVE-2024-0464
[email protected]
[email protected]
[email protected]
codecabin — wp_go_mapsThe WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.28 does not properly protect most of its REST API routes, which attackers can abuse to store malicious HTML/Javascript on the site.2024-01-086.1CVE-2023-6627
[email protected]
[email protected]
deshang — dscmsA vulnerability classified as problematic has been found in DeShang DSCMS up to 3.1.2/7.1. Affected is an unknown function of the file public/install.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250434 is the identifier assigned to this vulnerability.2024-01-115.3CVE-2024-0414
[email protected]
[email protected]
[email protected]
deshang — dskmsA vulnerability was found in DeShang DSKMS up to 3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file public/install.php. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250433 was assigned to this vulnerability.2024-01-115.3CVE-2024-0413
[email protected]
[email protected]
[email protected]
deshang — dsmallA vulnerability classified as critical was found in DeShang DSMall up to 6.1.0. Affected by this vulnerability is an unknown functionality of the file application/home/controller/TaobaoExport.php of the component Image URL Handler. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250435.2024-01-116.3CVE-2024-0415
[email protected]
[email protected]
[email protected]
deshang — dsmallA vulnerability was found in DeShang DSMall up to 6.1.0. It has been classified as problematic. This affects an unknown part of the file public/install.php of the component HTTP GET Request Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250431.2024-01-115.3CVE-2024-0411
[email protected]
[email protected]
[email protected]
deshang — dsmallA vulnerability, which was classified as critical, has been found in DeShang DSMall up to 5.0.3. Affected by this issue is some unknown functionality of the file application/home/controller/MemberAuth.php. The manipulation of the argument file_name leads to path traversal: ‘../filedir’. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250436.2024-01-115.4CVE-2024-0416
[email protected]
[email protected]
[email protected]
deshang — dsshopA vulnerability was found in DeShang DSShop up to 3.1.0. It has been declared as problematic. This vulnerability affects unknown code of the file public/install.php of the component HTTP GET Request Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250432.2024-01-115.3CVE-2024-0412
[email protected]
[email protected]
[email protected]
deshang — dsshopA vulnerability, which was classified as critical, was found in DeShang DSShop up to 2.1.5. This affects an unknown part of the file application/home/controller/MemberAuth.php. The manipulation of the argument member_info leads to path traversal: ‘../filedir’. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250437 was assigned to this vulnerability.2024-01-115.4CVE-2024-0417
[email protected]
[email protected]
[email protected]
discourse — discourseDiscourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4.2024-01-124.3CVE-2024-21655
[email protected]
dlink — r15_firmwareD-Link R15 before v1.08.02 was discovered to contain no firewall restrictions for IPv6 traffic. This allows attackers to arbitrarily access any services running on the device that may be inadvertently listening via IPv6.2024-01-105.3CVE-2023-41603
[email protected]
download-station –&#xA0;download-stationA vulnerability, which was classified as critical, has been found in unknown-o download-station up to 1.1.8. This issue affects some unknown processing of the file index.php. The manipulation of the argument f leads to path traversal: ‘../filedir’. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250121 was assigned to this vulnerability.2024-01-105.3CVE-2024-0354
[email protected]
[email protected]
[email protected]
dso2o –&#xA0;dso2oA vulnerability was found in DeShang DSO2O up to 4.1.0. It has been classified as critical. This affects an unknown part of the file /install/install.php. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250125 was assigned to this vulnerability.2024-01-105.3CVE-2024-0358
[email protected]
[email protected]
[email protected]
dzzoffice — dzzofficeSQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent parameters in the Network Disk backend module.2024-01-066.5CVE-2023-39853
[email protected]
easyxdm — easyxdmeasyXDM 2.5 allows XSS via the xdm_e parameter.2024-01-086.1CVE-2023-27739
[email protected]
elan — dell_inspironELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.2024-01-126CVE-2024-0454
36106deb-8e95-420b-a0a0-e70af5d245df
engineers_online_portal_project — engineers_online_portalA vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to sensitive cookie without secure attribute. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-250117 was assigned to this vulnerability.2024-01-095.3CVE-2024-0349
[email protected]
[email protected]
[email protected]
eva — evaA vulnerability was found in coderd-repos Eva 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the file /system/traceLog/page of the component HTTP POST Request Handler. The manipulation of the argument property leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250124.2024-01-105.5CVE-2024-0357
[email protected]
[email protected]
[email protected]
ewels — cpt_bootstrap_carouselImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Phil Ewels CPT Bootstrap Carousel allows Reflected XSS. This issue affects CPT Bootstrap Carousel: from n/a through 1.12.2024-01-086.1CVE-2023-52196
[email protected]
firefly-iii — firefly_iiiFirefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.2024-01-056.1CVE-2024-22075
[email protected]
fortinet — fortipamAn allocation of resources without limits or throttling vulnerability [CWE-770] in FortiPAM 1.0 all versions allows an authenticated attacker to perform a denial of service attack via sending crafted HTTP or HTTPS requests in a high frequency.2024-01-104.3CVE-2023-37934
[email protected]
fortinet — fortiportalAn&#xA0;Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, version 5.3.8 and below may allow a remote authenticated user with at least read-only permissions to access to other organization endpoints via crafted GET requests.2024-01-105.4CVE-2023-48783
[email protected]
fortinet — fortivoiceAn improper limitation of a pathname to a restricted directory (‘path traversal’) vulnerability [CWE-22] in FortiVoiceEntreprise version 7.0.0 and before 6.4.7 allows an authenticated attacker to read arbitrary files from the system via sending crafted HTTP or HTTPS requests2024-01-106.5CVE-2023-37932
[email protected]
foru — cmsA vulnerability, which was classified as critical, has been found in ForU CMS up to 2020-06-23. This issue affects some unknown processing of the file admin/cms_template.php. The manipulation of the argument t_name/t_path leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250445 was assigned to this vulnerability.2024-01-116.3CVE-2024-0426
[email protected]
[email protected]
[email protected]
foru — cmsA vulnerability classified as critical was found in ForU CMS up to 2020-06-23. This vulnerability affects unknown code of the file /admin/index.php?act=reset_admin_psw. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250444.2024-01-115.3CVE-2024-0425
[email protected]
[email protected]
[email protected]
get-simple — getsimplecmsA Cross Site Scripting (XSS) vulnerability in GetSimple CMS 3.3.16 exists when using Source Code Mode as a backend user to add articles via the /admin/edit.php page.2024-01-085.4CVE-2023-51246
[email protected]
[email protected]
gitlab — gitlabAn improper access control vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group.2024-01-126.6CVE-2023-6955
[email protected]
hamidrezasepehr — wp_custom_cursors_\|_wordpress_cursor_pluginThe WP Custom Cursors | WordPress Cursor Plugin WordPress plugin through 3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)2024-01-084.8CVE-2023-5911
[email protected]
huaxia — erpA vulnerability was found in Huaxia ERP up to 3.1. It has been rated as problematic. This issue affects some unknown processing of the file /user/getAllList. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-250595.2024-01-135.3CVE-2024-0490
[email protected]
[email protected]
[email protected]
huaxia — erpA vulnerability classified as problematic has been found in Huaxia ERP up to 3.1. Affected is an unknown function of the file src/main/java/com/jsh/erp/controller/UserController.java. The manipulation leads to weak password recovery. It is possible to launch the attack remotely. Upgrading to version 3.2 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-250596.2024-01-135.3CVE-2024-0491
[email protected]
[email protected]
[email protected]
i13websolution — email_subscription_popupThe Email Subscription Popup WordPress plugin before 1.2.20 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin2024-01-086.1CVE-2023-6555
[email protected]
ibm — aixIBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the pmsvcs kernel extension to cause a denial of service. IBM X-Force ID: 267967.2024-01-116.2CVE-2023-45169
[email protected]
[email protected]
ibm — aixIBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the kernel to cause a denial of service. IBM X-Force ID: 267969.2024-01-116.2CVE-2023-45171
[email protected]
[email protected]
ibm — aixIBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the NFS kernel extension to cause a denial of service. IBM X-Force ID: 267971.2024-01-116.2CVE-2023-45173
[email protected]
[email protected]
ibm — aixIBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel extension to cause a denial of service. IBM X-Force ID: 267973.2024-01-116.2CVE-2023-45175
[email protected]
[email protected]
ibm — security_verify_access_applianceIBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to obtain sensitive configuration information. IBM X-Force ID: 260584.2024-01-116.2CVE-2023-38267
[email protected]
[email protected]
ibm — security_verify_access_applianceIBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) temporarily stores sensitive information in files that could be accessed by a local user. IBM X-Force ID: 254653.2024-01-115.1CVE-2023-31001
[email protected]
[email protected]
icewarp — icewarpA vulnerability classified as problematic has been found in IceWarp 12.0.2.1/12.0.3.1. This affects an unknown part of the file /install/ of the component Utility Download Handler. The manipulation of the argument lang with the input 1%27″()%26%25<zzz><ScRiPt>alert(document.domain)</ScRiPt> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249759. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-056.1CVE-2024-0246
[email protected]
[email protected]
iframe_project — iframeImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in webvitaly iframe allows Stored XSS.This issue affects iframe: from n/a through 4.8.2024-01-055.4CVE-2023-52125
[email protected]
impactpixel — ads_invalid_click_protectionImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Impactpixel Ads Invalid Click Protection allows Stored XSS.This issue affects Ads Invalid Click Protection: from n/a through 1.0.2024-01-084.8CVE-2023-52197
[email protected]
infoblox — niosA stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the VLAN View Name field.2024-01-095.4CVE-2022-28975
[email protected]
[email protected]
inis — inisA vulnerability classified as critical has been found in Inis up to 2.0.1. Affected is an unknown function of the file /app/api/controller/default/Sqlite.php. The manipulation of the argument sql leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250110 is the identifier assigned to this vulnerability.2024-01-096.3CVE-2024-0342
[email protected]
[email protected]
[email protected]
isharer_and_upredsun — file_sharing_wizardA vulnerability has been found in iSharer and upRedSun File Sharing Wizard up to 1.5.0 and classified as problematic. This vulnerability affects unknown code of the component GET Request Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250438 is the identifier assigned to this vulnerability.2024-01-115.3CVE-2024-0418
[email protected]
[email protected]
[email protected]
[email protected]
jasper — httpdxA vulnerability was found in Jasper httpdx up to 1.5.4 and classified as problematic. This issue affects some unknown processing of the component HTTP POST Request Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250439.2024-01-115.3CVE-2024-0419
[email protected]
[email protected]
[email protected]
[email protected]
jetbrains — youtrackIn JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible2024-01-095.4CVE-2024-22370
[email protected]
juniper_networks — junos_osAn Improper Check for Unusual or Exceptional Conditions vulnerability in Juniper DHCP Daemon (jdhcpd) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause the jdhcpd to consume all the CPU cycles resulting in a Denial of Service (DoS). On Junos OS devices with forward-snooped-client configured, if an attacker sends a specific DHCP packet to a non-configured interface, this will cause an infinite loop. The DHCP process will have to be restarted to recover the service. This issue affects: Juniper Networks Junos OS * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S2; * 22.4 versions earlier than 22.4R2-S2, 22.4R3; * 23.2 versions earlier than 23.2R2.2024-01-126.5CVE-2023-36842
[email protected]
[email protected]
juniper_networks — junos_osAn Improper Handling of Exceptional Conditions vulnerability in the broadband edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an attacker directly connected to the vulnerable system who repeatedly flaps DHCP subscriber sessions to cause a slow memory leak, ultimately leading to a Denial of Service (DoS). Memory can only be recovered by manually restarting bbe-smgd. This issue only occurs if BFD liveness detection for DHCP subscribers is enabled. Systems without BFD liveness detection enabled are not vulnerable to this issue. Indication of the issue can be observed by periodically executing the ‘show system processes extensive’ command, which will indicate an increase in memory allocation for bbe-smgd. A small amount of memory is leaked every time a DHCP subscriber logs in, which will become visible over time, ultimately leading to memory starvation. user@junos> show system processes extensive | match bbe-smgd 13071 root 24 0 415M 201M select 0 0:41 7.28% bbe-smgd{bbe-smgd} 13071 root 20 0 415M 201M select 1 0:04 0.00% bbe-smgd{bbe-smgd} … user@junos> show system processes extensive | match bbe-smgd 13071 root 20 0 420M 208M select 0 4:33 0.10% bbe-smgd{bbe-smgd} 13071 root 20 0 420M 208M select 0 0:12 0.00% bbe-smgd{bbe-smgd} … This issue affects Juniper Networks Junos OS on MX Series: * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S2; * 22.4 versions earlier than 22.4R2-S2, 22.4R3; * 23.2 versions earlier than 23.2R1-S1, 23.2R2.2024-01-126.5CVE-2024-21587
[email protected]
[email protected]
juniper_networks — junos_osA Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). If an MX Series device receives PTP packets on an MPC3E that doesn’t support PTP this causes a memory leak which will result in unpredictable behavior and ultimately in an MPC crash and restart. To monitor for this issue, please use the following FPC vty level commands: show heap shows an increase in “LAN buffer” utilization and show clksync ptp nbr-upd-info shows non-zero “Pending PFEs” counter. This issue affects Juniper Networks Junos OS on MX Series with MPC3E: * All versions earlier than 20.4R3-S3; * 21.1 versions earlier than 21.1R3-S4; * 21.2 versions earlier than 21.2R3; * 21.3 versions earlier than 21.3R2-S1, 21.3R3; * 21.4 versions earlier than 21.4R2; * 22.1 versions earlier than 22.1R2.2024-01-126.5CVE-2024-21599
[email protected]
[email protected]
juniper_networks — junos_osAn Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on PTX Series allows a unauthenticated, adjacent attacker to cause a Denial of Service (DoS). When MPLS packets are meant to be sent to a flexible tunnel interface (FTI) and if the FTI tunnel is down, these will hit the reject NH, due to which the packets get sent to the CPU and cause a host path wedge condition. This will cause the FPC to hang and requires a manual restart to recover. Please note that this issue specifically affects PTX1000, PTX3000, PTX5000 with FPC3, PTX10002-60C, and PTX10008/16 with LC110x. Other PTX Series devices and Line Cards (LC) are not affected. The following log message can be seen when the issue occurs: Cmerror Op Set: Host Loopback: HOST LOOPBACK WEDGE DETECTED IN PATH ID <id> (URI: /fpc/<fpc>/pfe/<pfe>/cm/<cm>/Host_Loopback/<cm>/HOST_LOOPBACK_MAKE_CMERROR_ID[<id>]) This issue affects Juniper Networks Junos OS: * All versions earlier than 20.4R3-S8; * 21.1 versions earlier than 21.1R3-S4; * 21.2 versions earlier than 21.2R3-S6; * 21.3 versions earlier than 21.3R3-S3; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R2-S2, 22.1R3; * 22.2 versions earlier than 22.2R2-S1, 22.2R3.2024-01-126.5CVE-2024-21600
[email protected]
[email protected]
juniper_networks — junos_osAn Improper Check for Unusual or Exceptional Conditions vulnerability in the kernel of Juniper Network Junos OS on MX Series allows a network based attacker with low privileges to cause a denial of service. If a scaled configuration for Source class usage (SCU) / destination class usage (DCU) (more than 10 route classes) is present and the SCU/DCU statistics are gathered by executing specific SNMP requests or CLI commands, a ‘vmcore’ for the RE kernel will be seen which leads to a device restart. Continued exploitation of this issue will lead to a sustained DoS. This issue only affects MX Series devices with MPC10, MPC11 or LC9600, and MX304. No other MX Series devices are affected. This issue affects Juniper Networks Junos OS: * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S6; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3; * 22.1 versions earlier than 22.1R3; * 22.2 versions earlier than 22.2R2; * 22.3 versions earlier than 22.3R2.2024-01-126.5CVE-2024-21603
[email protected]
[email protected]
juniper_networks — junos_osAn Incomplete Cleanup vulnerability in Nonstop active routing (NSR) component of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause memory leak leading to Denial of Service (DoS). On all Junos OS platforms, when NSR is enabled, a BGP flap will cause memory leak. A manual reboot of the system will restore the services. The memory usage can be monitored using the below commands. user@host> show chassis routing-engine no-forwarding user@host> show system memory | no-more This issue affects: Juniper Networks Junos OS * 21.2 versions earlier than 21.2R3-S5; * 21.3 versions earlier than 21.3R3-S4; * 21.4 versions earlier than 21.4R3-S4; * 22.1 versions earlier than 22.1R3-S2; * 22.2 versions earlier than 22.2R3-S2; * 22.3 versions earlier than 22.3R2-S1, 22.3R3; * 22.4 versions earlier than 22.4R1-S2, 22.4R2. This issue does not affect Junos OS versions earlier than 20.4R3-S7.2024-01-126.5CVE-2024-21617
[email protected]
[email protected]
juniper_networks — junos_osA Heap-based Buffer Overflow vulnerability in the Network Services Daemon (NSD) of Juniper Networks Junos OS allows authenticated, low privileged, local attacker to cause a Denial of Service (DoS). On an SRX 5000 Series device, when executing a specific command repeatedly, memory is corrupted, which leads to a Flow Processing Daemon (flowd) crash. The NSD process has to be restarted to restore services. If this issue occurs, it can be checked with the following command: user@host> request security policies check The following log message can also be observed: Error: policies are out of sync for PFE node<number>.fpc<number>.pic<number>. This issue affects: Juniper Networks Junos OS on SRX 5000 Series * All versions earlier than 20.4R3-S6; * 21.1 versions earlier than 21.1R3-S5; * 21.2 versions earlier than 21.2R3-S4; * 21.3 versions earlier than 21.3R3-S3; * 21.4 versions earlier than 21.4R3-S3; * 22.1 versions earlier than 22.1R3-S1; * 22.2 versions earlier than 22.2R3; * 22.3 versions earlier than 22.3R2.2024-01-125.5CVE-2024-21594
[email protected]
[email protected]
juniper_networks — junos_osAn Exposure of Resource to Wrong Sphere vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the intended access restrictions. In an Abstracted Fabric (AF) scenario if routing-instances (RI) are configured, specific valid traffic destined to the device can bypass the configured lo0 firewall filters as it’s received in the wrong RI context. This issue affects Juniper Networks Junos OS on MX Series: * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S3; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3; * 22.2 versions earlier than 22.2R3; * 22.3 versions earlier than 22.3R2.2024-01-125.3CVE-2024-21597
[email protected]
[email protected]
juniper_networks — junos_osA Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) vulnerability in the Flow-processing Daemon (flowd) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (Dos). On SRX Series devices when two different threads try to simultaneously process a queue which is used for TCP events flowd will crash. One of these threads can not be triggered externally, so the exploitation of this race condition is outside the attackers direct control. Continued exploitation of this issue will lead to a sustained DoS. This issue affects Juniper Networks Junos OS: * 21.2 versions earlier than 21.2R3-S5; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S4; * 22.1 versions earlier than 22.1R3-S3; * 22.2 versions earlier than 22.2R3-S1; * 22.3 versions earlier than 22.3R2-S2, 22.3R3; * 22.4 versions earlier than 22.4R2-S1, 22.4R3. This issue does not affect Juniper Networks Junos OS versions earlier than 21.2R1.2024-01-125.9CVE-2024-21601
[email protected]
[email protected]
juniper_networks — junos_osAn Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on MX Series and EX9200 Series allows an unauthenticated, network-based attacker to cause partial impact to the integrity of the device. If the “tcp-reset” option is added to the “reject” action in an IPv6 filter which matches on “payload-protocol”, packets are permitted instead of rejected. This happens because the payload-protocol match criteria is not supported in the kernel filter causing it to accept all packets without taking any other action. As a fix the payload-protocol match will be treated the same as a “next-header” match to avoid this filter bypass. This issue doesn’t affect IPv4 firewall filters. This issue affects Juniper Networks Junos OS on MX Series and EX9200 Series: * All versions earlier than 20.4R3-S7; * 21.1 versions earlier than 21.1R3-S5; * 21.2 versions earlier than 21.2R3-S5; * 21.3 versions earlier than 21.3R3-S4; * 21.4 versions earlier than 21.4R3-S4; * 22.1 versions earlier than 22.1R3-S2; * 22.2 versions earlier than 22.2R3-S2; * 22.3 versions earlier than 22.3R2-S2, 22.3R3; * 22.4 versions earlier than 22.4R1-S2, 22.4R2-S2, 22.4R3.2024-01-125.3CVE-2024-21607
[email protected]
[email protected]
juniper_networks — junos_os/junos_os_evolvedA Missing Release of Memory after Effective Lifetime vulnerability in Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause an rpd crash, leading to Denial of Service (DoS). On all Junos OS and Junos OS Evolved platforms, when traffic engineering is enabled for OSPF or ISIS, and a link flaps, a patroot memory leak is observed. This memory leak, over time, will lead to an rpd crash and restart. The memory usage can be monitored using the below command. user@host> show task memory detail | match patroot This issue affects: Juniper Networks Junos OS * All versions earlier than 21.2R3-S3; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S3; * 22.1 versions earlier than 22.1R3; * 22.2 versions earlier than 22.2R3. Juniper Networks Junos OS Evolved * All versions earlier than 21.3R3-S5-EVO; * 21.4 versions earlier than 21.4R3-EVO; * 22.1 versions earlier than 22.1R3-EVO; * 22.2 versions earlier than 22.2R3-EVO.2024-01-126.5CVE-2024-21613
[email protected]
[email protected]
juniper_networks — junos_os/junos_os_evolvedAn Improper Handling of Exceptional Conditions vulnerability in BGP session processing of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker, using specific timing outside the attacker’s control, to flap BGP sessions and cause the routing protocol daemon (rpd) process to crash and restart, leading to a Denial of Service (DoS) condition. Continued BGP session flapping will create a sustained Denial of Service (DoS) condition. This issue only affects routers configured with non-stop routing (NSR) enabled. Graceful Restart (GR) helper mode, enabled by default, is also required for this issue to be exploitable. When the BGP session flaps on the NSR-enabled router, the device enters GR-helper/LLGR-helper mode due to the peer having negotiated GR/LLGR-restarter capability and the backup BGP requests for replication of the GR/LLGR-helper session, master BGP schedules, and initiates replication of GR/LLGR stale routes to the backup BGP. In this state, if the BGP session with the BGP peer comes up again, unsolicited replication is initiated for the peer without cleaning up the ongoing GR/LLGR-helper mode replication. This parallel two instances of replication for the same peer leads to the assert if the BGP session flaps again. This issue affects: Juniper Networks Junos OS * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S1; * 22.4 versions earlier than 22.4R2-S2, 22.4R3; * 23.2 versions earlier than 23.2R1-S1, 23.2R2. Juniper Networks Junos OS Evolved * All versions earlier than 21.3R3-S5-EVO; * 21.4 versions earlier than 21.4R3-S5-EVO; * 22.1 versions earlier than 22.1R3-S4-EVO; * 22.2 versions earlier than 22.2R3-S3-EVO; * 22.3 versions earlier than 22.3R3-S1-EVO; * 22.4 versions earlier than 22.4R2-S2-EVO, 22.4R3-EVO; * 23.2 versions earlier than 23.2R1-S1-EVO, 23.2R2-EVO.2024-01-125.9CVE-2024-21585
[email protected]
[email protected]
[email protected]
juniper_networks — junos_os/junos_os_evolvedA Heap-based Buffer Overflow vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS). If an attacker sends a specific BGP UPDATE message to the device, this will cause a memory overwrite and therefore an RPD crash and restart in the backup Routing Engine (RE). Continued receipt of these packets will cause a sustained Denial of Service (DoS) condition in the backup RE. The primary RE is not impacted by this issue and there is no impact on traffic. This issue only affects devices with NSR enabled. This issue requires an attacker to have an established BGP session to a system affected by the issue. This issue affects both eBGP and iBGP implementations. This issue affects: Juniper Networks Junos OS * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S2; * 22.3 versions earlier than 22.3R3-S1; * 22.4 versions earlier than 22.4R2-S2, 22.4R3; * 23.1 versions earlier than 23.1R2; * 23.2 versions earlier than 23.2R1-S2, 23.2R2. Juniper Networks Junos OS Evolved * All versions earlier than 21.3R3-S5-EVO; * 21.4-EVO versions earlier than 21.4R3-S5-EVO; * 22.1-EVO versions earlier than 22.1R3-S4-EVO; * 22.2-EVO versions earlier than 22.2R3-S2-EVO; * 22.3-EVO versions later than 22.3R1-EVO; * 22.4-EVO versions earlier than 22.4R2-S2-EVO, 22.4R3-EVO; * 23.1-EVO versions earlier than 23.1R2-EVO; * 23.2-EVO versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO.2024-01-125.3CVE-2024-21596
[email protected]
[email protected]
juzaweb — cmsjuzaweb <= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated.2024-01-094.9CVE-2023-46906
[email protected]
[email protected]
jwx — jwxjwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification. This vulnerability has been patched in version 2.0.19.2024-01-094.3CVE-2024-21664
[email protected]
[email protected]
[email protected]
kashipara — billing_softwareA vulnerability classified as critical was found in Kashipara Billing Software 1.0. Affected by this vulnerability is an unknown functionality of the file buyer_detail_submit.php of the component HTTP POST Request Handler. The manipulation of the argument gstn_no leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250597 was assigned to this vulnerability.2024-01-136.3CVE-2024-0492
[email protected]
[email protected]
[email protected]
kashipara — billing_softwareA vulnerability, which was classified as critical, has been found in Kashipara Billing Software 1.0. Affected by this issue is some unknown functionality of the file submit_delivery_list.php of the component HTTP POST Request Handler. The manipulation of the argument customer_details leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250598 is the identifier assigned to this vulnerability.2024-01-136.3CVE-2024-0493
[email protected]
[email protected]
[email protected]
kashipara — billing_softwareA vulnerability, which was classified as critical, was found in Kashipara Billing Software 1.0. This affects an unknown part of the file material_bill.php of the component HTTP POST Request Handler. The manipulation of the argument itemtypeid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250599.2024-01-136.3CVE-2024-0494
[email protected]
[email protected]
[email protected]
kashipara — billing_softwareA vulnerability has been found in Kashipara Billing Software 1.0 and classified as critical. This vulnerability affects unknown code of the file party_submit.php of the component HTTP POST Request Handler. The manipulation of the argument party_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250600.2024-01-136.3CVE-2024-0495
[email protected]
[email protected]
[email protected]
kashipara — billing_softwareA vulnerability was found in Kashipara Billing Software 1.0 and classified as critical. This issue affects some unknown processing of the file item_list_edit.php of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250601 was assigned to this vulnerability.2024-01-136.3CVE-2024-0496
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability, which was classified as critical, was found in Kashipara Food Management System up to 1.0. This affects an unknown part of the file item_list_submit.php. The manipulation of the argument item_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249825 was assigned to this vulnerability.2024-01-076.5CVE-2024-0270
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability has been found in Kashipara Food Management System up to 1.0 and classified as critical. This vulnerability affects unknown code of the file addmaterial_edit.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249826 is the identifier assigned to this vulnerability.2024-01-076.5CVE-2024-0271
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability was found in Kashipara Food Management System up to 1.0 and classified as critical. This issue affects some unknown processing of the file addmaterialsubmit.php. The manipulation of the argument material_name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249827.2024-01-076.5CVE-2024-0272
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability was found in Kashipara Food Management System up to 1.0. It has been classified as critical. Affected is an unknown function of the file addwaste_entry.php. The manipulation of the argument item_name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249828.2024-01-076.5CVE-2024-0273
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability was found in Kashipara Food Management System up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file billAjax.php. The manipulation of the argument item_name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249829 was assigned to this vulnerability.2024-01-076.5CVE-2024-0274
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability was found in Kashipara Food Management System up to 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file item_edit_submit.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249830 is the identifier assigned to this vulnerability.2024-01-076.5CVE-2024-0275
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability classified as critical has been found in Kashipara Food Management System up to 1.0. This affects an unknown part of the file rawstock_used_damaged_smt.php. The manipulation of the argument product_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249831.2024-01-076.5CVE-2024-0276
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability classified as critical was found in Kashipara Food Management System up to 1.0. This vulnerability affects unknown code of the file party_submit.php. The manipulation of the argument party_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249832.2024-01-076.5CVE-2024-0277
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability, which was classified as critical, has been found in Kashipara Food Management System up to 1.0. This issue affects some unknown processing of the file partylist_edit_submit.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249833 was assigned to this vulnerability.2024-01-076.5CVE-2024-0278
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability, which was classified as critical, was found in Kashipara Food Management System up to 1.0. Affected is an unknown function of the file item_list_edit.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249834 is the identifier assigned to this vulnerability.2024-01-076.5CVE-2024-0279
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability has been found in Kashipara Food Management System up to 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file item_type_submit.php. The manipulation of the argument type_name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249835.2024-01-076.5CVE-2024-0280
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability was found in Kashipara Food Management System up to 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file loginCheck.php. The manipulation of the argument password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249836.2024-01-076.5CVE-2024-0281
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability was found in Kashipara Food Management System up to 1.0. It has been classified as problematic. This affects an unknown part of the file addmaterialsubmit.php. The manipulation of the argument tin leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249837 was assigned to this vulnerability.2024-01-076.1CVE-2024-0282
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability was found in Kashipara Food Management System up to 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file party_details.php. The manipulation of the argument party_name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249838 is the identifier assigned to this vulnerability.2024-01-076.1CVE-2024-0283
[email protected]
[email protected]
[email protected]
kashipara — food_management_systemA vulnerability was found in Kashipara Food Management System up to 1.0. It has been rated as problematic. This issue affects some unknown processing of the file party_submit.php. The manipulation of the argument party_address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249839.2024-01-076.1CVE-2024-0284
[email protected]
[email protected]
[email protected]
kofax — captureThe application is vulnerable to Stored Cross-Site Scripting (XSS) in the endpoint /sofer/DocumentService.asc/SaveAnnotation, where input data transmitted via the POST method in the parameters author and text are not adequately sanitized and validated. This allows for the injection of malicious JavaScript code. The vulnerability was identified in the function for adding new annotations while editing document content. Reporters inform that the vulnerability has been removed in software versions above 11.1.x. Previous versions may also be vulnerable, but this has not been confirmed.2024-01-115.4CVE-2023-5118
[email protected]
[email protected]
lif-platforms — lif-auth-serverLif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `get_pfp` and `get_banner` routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is correct. This could allow an attacker access to files they shouldn’t have access to. This issue has been patched in version 1.4.0.2024-01-124.2CVE-2023-49801
[email protected]
[email protected]
linux — kernelIt was discovered that when exec’ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free.2024-01-085.3CVE-2022-2585
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
linux –&#xA0;kernelThe Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067.2024-01-085.5CVE-2023-1032
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
linux –&#xA0;kernelClosing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable. Note that 32-bit Arm-guests are not affected, as the 32-bit Linux kernel on Arm doesn’t use queued-RW-locks, which are required to trigger the issue (on Arm32 a waiting writer doesn’t block further readers to get the lock).2024-01-054.9CVE-2023-34324
[email protected]
[email protected]
[email protected]
linux –&#xA0;kernelA vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.2024-01-094.4CVE-2024-0340
[email protected]
[email protected]
[email protected]
linux –&#xA0;kernel
&#xA0;
A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error.2024-01-125.5CVE-2024-0443
[email protected]
[email protected]
[email protected]
[email protected]
mailmunch — constant_contact_forms_by_mailmunchImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in MailMunch Constant Contact Forms by MailMunch allows Stored XSS.This issue affects Constant Contact Forms by MailMunch: from n/a through 2.0.11.2024-01-136.5CVE-2024-22137
[email protected]
mapster — mapster_wp_mapsImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Mapster Technology Inc. Mapster WP Maps allows Stored XSS.This issue affects Mapster WP Maps: from n/a through 1.2.38.2024-01-085.4CVE-2024-21744
[email protected]
meetyoucrop — big-whaleA vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file /auth/user/all.api of the component Admin Module. The manipulation of the argument id leads to improper ownership management. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250232.2024-01-116.3CVE-2023-7226
[email protected]
[email protected]
[email protected]
michielvaneerd — private_google_calendarsImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Michiel van Eerd Private Google Calendars allows Stored XSS.This issue affects Private Google Calendars: from n/a through 20231125.2024-01-085.4CVE-2023-52198
[email protected]
microsoft — .net_6.0Microsoft Identity Denial of service vulnerability2024-01-096.8CVE-2024-21319
[email protected]
microsoft — microsoft_edge_(chromium-based)Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability2024-01-116.3CVE-2024-20675
[email protected]

microsoft — microsoft_edge_(chromium-based)

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability2024-01-115.2CVE-2024-21337
[email protected]
microsoft — windows_10_1507Microsoft Message Queuing Information Disclosure Vulnerability2024-01-096.5CVE-2024-20660
[email protected]
microsoft — windows_10_1507Windows Message Queuing Client (MSMQC) Information Disclosure2024-01-096.5CVE-2024-20663
[email protected]
microsoft — windows_10_1507Microsoft Message Queuing Information Disclosure Vulnerability2024-01-096.5CVE-2024-20664
[email protected]
microsoft — windows_10_1507BitLocker Security Feature Bypass Vulnerability2024-01-096.6CVE-2024-20666
[email protected]
microsoft — windows_10_1507Windows Message Queuing Client (MSMQC) Information Disclosure2024-01-096.5CVE-2024-20680
[email protected]
microsoft — windows_10_1507Microsoft Message Queuing Information Disclosure Vulnerability2024-01-096.5CVE-2024-21314
[email protected]
microsoft — windows_10_1507Windows Themes Spoofing Vulnerability2024-01-096.5CVE-2024-21320
[email protected]
microsoft — windows_10_1507Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability2024-01-095.7CVE-2024-20692
[email protected]
microsoft — windows_10_1507Windows Cryptographic Services Information Disclosure Vulnerability2024-01-095.5CVE-2024-21311
[email protected]
microsoft — windows_10_1507Windows TCP/IP Information Disclosure Vulnerability2024-01-095.3CVE-2024-21313
[email protected]
microsoft — windows_10_1507Windows Themes Information Disclosure Vulnerability2024-01-094.7CVE-2024-20691
[email protected]
microsoft — windows_10_1607Windows Server Key Distribution Service Security Feature Bypass2024-01-096.1CVE-2024-21316
[email protected]
microsoft — windows_10_1607Windows CoreMessaging Information Disclosure Vulnerability2024-01-095.5CVE-2024-20694
[email protected]
microsoft — windows_10_1809Windows Nearby Sharing Spoofing Vulnerability2024-01-096.5CVE-2024-20690
[email protected]
microsoft — windows_10_1809Windows Hyper-V Denial of Service Vulnerability2024-01-095.5CVE-2024-20699
[email protected]
microsoft — windows_10_1809Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability2024-01-094.4CVE-2024-21305
[email protected]
microsoft — windows_10_21h2Microsoft Bluetooth Driver Spoofing Vulnerability2024-01-095.7CVE-2024-21306
[email protected]
microsoft — windows_server_2008Windows Online Certificate Status Protocol (OCSP) Information Disclosure Vulnerability2024-01-094.9CVE-2024-20662
[email protected]
microsoft — windows_server_2019Microsoft Online Certificate Status Protocol (OCSP) Remote Code Execution Vulnerability2024-01-096.6CVE-2024-20655
[email protected]
mojofywp — wp_affiliate_disclosureImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in MojofyWP WP Affiliate Disclosure allows Stored XSS.This issue affects WP Affiliate Disclosure: from n/a through 1.2.7.2024-01-055.4CVE-2023-52178
[email protected]
mongodb_inc — mongodb_c_driverWhen calling bson_utf8_validate&#xA0;on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.2024-01-125.3CVE-2023-0437
[email protected]
netapp — ontap_9ONTAP versions 9.4 and higher are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information to unprivileged attackers when the object-store profiler command is being run by an administrative user.2024-01-124.8CVE-2024-21982
[email protected]
netscout — ngeniusoneCross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the name parameter of the Profile and Exclusion List page(s).2024-01-096.1CVE-2023-27000
[email protected]
[email protected]
[email protected]
netscout — ngeniusoneCross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the creator parameter of the Alert Configuration page.2024-01-095.4CVE-2023-26998
[email protected]
[email protected]
[email protected]
nvidia — dgx_a100NVIDIA DGX A100 BMC contains a vulnerability where an attacker may cause an LDAP user injection. A successful exploit of this vulnerability may lead to information disclosure.2024-01-126.5CVE-2023-31025
[email protected]
nvidia — dgx_a100NVIDIA DGX A100 BMC contains a vulnerability where a user may cause a missing authentication issue for a critical function by an adjacent network . A successful exploit of this vulnerability may lead to escalation of privileges, code execution, denial of service, information disclosure, and data tampering.2024-01-126.8CVE-2023-31033
[email protected]
nvidia — dgx_a100NVIDIA DGX A100 SBIOS contains a vulnerability where a local attacker can cause input validation checks to be bypassed by causing an integer overflow. A successful exploit of this vulnerability may lead to denial of service, information disclosure, and data tampering.2024-01-126.6CVE-2023-31034
[email protected]
nvidia — dgx_a100NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a heap-based buffer overflow by local access. A successful exploit of this vulnerability may lead to code execution, denial of service, information disclosure, and data tampering.2024-01-124.2CVE-2023-31031
[email protected]
omron — sysmac_studio[PROBLEMTYPE] in [VENDOR] [PRODUCT] [VERSION] on [PLATFORMS] allows [ATTACKER] to [IMPACT].2024-01-105.5CVE-2022-45793
[email protected]
[email protected]
[email protected]
online_job_portal — online_job_portalA vulnerability was found in Online Job Portal 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Admin/News.php of the component Create News Page. The manipulation of the argument News with the input </title><scRipt>alert(0x00C57D)</scRipt> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249818 is the identifier assigned to this vulnerability.2024-01-074.8CVE-2024-0262
[email protected]
[email protected]
[email protected]
open-xchange — ox_app_suiteThe “upsell” widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised account, or gain temporary access to a legitimate account, could inject script code to gain persistent code execution capabilities under a trusted domain. User input for this widget is now sanitized to avoid malicious content the be processed. No publicly available exploits are known.2024-01-086.1CVE-2023-29049
[email protected]
[email protected]
[email protected]
[email protected]
open-xchange — ox_app_suiteUsers were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.2024-01-085.4CVE-2023-29052
[email protected]
[email protected]
[email protected]
[email protected]
open-xchange — ox_app_suiteUser-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.2024-01-085.4CVE-2023-41710
[email protected]
[email protected]
[email protected]
[email protected]
openedx — edx-platformOpen edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f.2024-01-136.4CVE-2024-22209
[email protected]
[email protected]
[email protected]
pallets — jinjaJinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.2024-01-115.4CVE-2024-22195
[email protected]
[email protected]
phpgurukul — hospital_management_systemA vulnerability, which was classified as problematic, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file index.php#contact_us of the component Contact Form. The manipulation of the argument Name/Email/Message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249843.2024-01-076.1CVE-2024-0286
[email protected]
[email protected]
[email protected]
pimcore — customer-data-frameworkThe Customer Management Framework (CMF) for Pimcore adds functionality for customer data management, segmentation, personalization and marketing automation. An authenticated and unauthorized user can access the list of potential duplicate users and see their data. Permissions are enforced when reaching the `/admin/customermanagementframework/duplicates/list` endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. Unauthorized user(s) can access PII data from customers. This vulnerability has been patched in version 4.0.6.2024-01-116.5CVE-2024-21666
[email protected]
[email protected]
[email protected]
pimcore — customer-data-frameworkpimcore/customer-data-framework is the Customer Management Framework for management of customer data within Pimcore. An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure. Permissions are not enforced when reaching the `/admin/customermanagementframework/gdpr-data/search-data-objects` endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. An unauthorized user can access PII data from customers. This vulnerability has been patched in version 4.0.6.2024-01-116.5CVE-2024-21667
[email protected]
[email protected]
[email protected]
pimcore — ecommerce-framework-bundleecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has been patched in version 1.0.10.2024-01-114.3CVE-2024-21665
[email protected]
[email protected]
[email protected]
[email protected]
preh_gmbh — mib3_infotainment_unitThe Real-Time Streaming Protocol implementation in the MIB3 infotainment incorrectly handles requests to /logs URI, when the id parameter equals to zero. This issue allows an attacker connected to the in-vehicle Wi-Fi network to cause denial-of-service of the infotainment system, when the certain preconditions are met. Vulnerability discovered on Škoda Superb III (3V3) – 2.0 TDI manufactured in 2022.2024-01-125.3CVE-2023-28898
[email protected]
preh_gmbh — mib3_infotainment_unitThe secret value used for access to critical UDS services of the MIB3 infotainment is hardcoded in the firmware. Vulnerability discovered on Škoda Superb III (3V3) – 2.0 TDI manufactured in 2022.2024-01-124CVE-2023-28897
[email protected]
project_worlds — lawyer_management_systemA vulnerability was found in Project Worlds Lawyer Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file searchLawyer.php. The manipulation of the argument experience leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250603.2024-01-136.3CVE-2024-0498
[email protected]
[email protected]
[email protected]
proofpoint — proofpoint_enterprise_protectionProofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.2024-01-095.3CVE-2023-5770
[email protected]
ptc — kepware_kepserverexAn uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution.2024-01-106.3CVE-2023-29444
[email protected]
[email protected]
ptc — kepware_kepserverexAn insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication.2024-01-105.7CVE-2023-29447
[email protected]
[email protected]
[email protected]
ptc — kepware_kepserverexAn improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline.&#xA0;2024-01-104.7CVE-2023-29446
[email protected]
[email protected]
[email protected]
pycryptodome — pycryptodomePyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.2024-01-055.9CVE-2023-52323
[email protected]
[email protected]
pyload — pyloadpyLoad is the free and open-source Download Manager written in pure Python. A log injection vulnerability was identified in `pyload` allowing any unauthenticated actor to inject arbitrary messages into the logs gathered by `pyload`. Forged or otherwise, corrupted log files can be used to cover an attacker’s tracks or even to implicate another party in the commission of a malicious act. This vulnerability has been patched in version 0.5.0b3.dev77.2024-01-085.3CVE-2024-21645
[email protected]
[email protected]
qnap — qumagieA cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: QuMagie 2.2.1 and later2024-01-055.4CVE-2023-47559
[email protected]
qualys — policy_complianceQualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data2024-01-096.5CVE-2023-6147
[email protected]
qualys — policy_complianceQualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access and access to configure or edit jobs to utilize the plugin to configure a potential rouge endpoint via which&#xA0;it was possible to control response for certain request which could be injected with XSS payloads leading to XSS&#xA0;while processing the response data2024-01-095.4CVE-2023-6148
[email protected]
qualys — web_application_screeningQualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data2024-01-096.5CVE-2023-6149
[email protected]
quic-go — quic-goquic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large number of PATH_CHALLENGE frames. The receiver is supposed to respond to each PATH_CHALLENGE frame with a PATH_RESPONSE frame. The attacker can prevent the receiver from sending out (the vast majority of) these PATH_RESPONSE frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer’s RTT estimate. This vulnerability has been patched in versions 0.37.7, 0.38.2 and 0.39.4.2024-01-106.4CVE-2023-49295
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
red_hat — multiple_productsA Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.2024-01-106.5CVE-2023-5455
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
red_hat — multiple_productsA flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.2024-01-096.5CVE-2023-6476
[email protected]
[email protected]
red_hat — multiple_productsA flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a malicious authenticated VNC client to crash QEMU and trigger a denial of service.2024-01-126.5CVE-2023-6683
[email protected]
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.2024-01-106.5CVE-2023-48242
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.2024-01-106.5CVE-2023-48245
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.2024-01-106.5CVE-2023-48246
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to steal session cookies of other active users.2024-01-106.5CVE-2023-48249
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned log.2024-01-106.3CVE-2023-48255
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.2024-01-105.3CVE-2023-48244
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.2024-01-105.3CVE-2023-48247
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows an authenticated remote attacker to upload a malicious file to the SD card containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned file.2024-01-105.5CVE-2023-48248
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.2024-01-105.3CVE-2023-48254
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted URL or HTTP request.2024-01-105.3CVE-2023-48256
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’s session.2024-01-105.5CVE-2023-48258
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.2024-01-105.3CVE-2023-48259
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.2024-01-105.3CVE-2023-48260
[email protected]
rexroth — nexo_cordless_nutrunner_nxa015s-36vThe vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.2024-01-105.3CVE-2023-48261
[email protected]
rubygems — rubygemsRubygems.org is the Ruby community’s gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.2024-01-124.8CVE-2024-21654
[email protected]
[email protected]
sap — marketingSAP Marketing (Contacts App) – version 160, allows an attacker with low privileges to trick a user to open malicious page which could lead to a very convincing phishing attack with low impact on confidentiality and integrity of the application.2024-01-095.4CVE-2024-21734
[email protected]
[email protected]
sap — netweaver_application_server_abapSAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.&#xA0;An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation.2024-01-095.4CVE-2024-21738
[email protected]
[email protected]
sap_se — sap_netweaver_(internet_communication_manager)Under certain conditions,&#xA0;Internet Communication Manager (ICM) or&#xA0;SAP Web Dispatcher – versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WEBDISP 7.53, WEBDISP 7.54, could&#xA0;allow an attacker to access information which would otherwise be restricted causing high impact on confidentiality.2024-01-094.1CVE-2024-22124
[email protected]
[email protected]
sap_se — sap_s/4hana_finance_(advanced_payment_management)SAP S/4HANA Finance for (Advanced Payment Management) – versions SAPSCORE 128, S4CORE 107, does not perform necessary authorization checks. A function import could be triggered allowing the attacker to create in-house bank accounts leading to low impact on the confidentiality of the application.2024-01-096.4CVE-2024-21736
[email protected]
[email protected]
siemens — cp-8031_master_moduleA vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.20), CP-8050 MASTER MODULE (All versions < CPCI85 V05.20). The network configuration service of affected devices contains a flaw in the conversion of ipv4 addresses that could lead to an uninitialized variable being used in succeeding validation steps. By uploading specially crafted network configuration, an authenticated remote attacker could be able to inject commands that are executed on the device with root privileges during device startup.2024-01-096.6CVE-2023-42797
[email protected]
siemens — jt2goA vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V14.1 (All versions < V14.1.0.12), Teamcenter Visualization V14.2 (All versions < V14.2.0.9), Teamcenter Visualization V14.3 (All versions < V14.3.0.6). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.2024-01-095.5CVE-2023-51744
[email protected]
sourcecodester — engineers_online_portalA vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been classified as problematic. Affected is an unknown function of the component File Upload Handler. The manipulation leads to resource consumption. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250116.2024-01-096.5CVE-2024-0348
[email protected]
[email protected]
[email protected]
sourcecodester — engineers_online_portalA vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-250118 is the identifier assigned to this vulnerability.2024-01-096.5CVE-2024-0350
[email protected]
[email protected]
[email protected]
sourcecodester — house_rental_management_systemA vulnerability was found in SourceCodester House Rental Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file manage_user.php of the component Edit User. The manipulation of the argument id/name/username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250610 is the identifier assigned to this vulnerability.2024-01-134.7CVE-2024-0502
[email protected]
[email protected]
[email protected]
sourcecodester — simple_house_rental_systemA vulnerability classified as problematic was found in CodeAstro Simple House Rental System 5.6. Affected by this vulnerability is an unknown functionality of the component Login Panel. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250111.2024-01-096.1CVE-2024-0343
[email protected]
[email protected]
[email protected]
sourcecodester — student_attendance_systemA vulnerability, which was classified as critical, was found in SourceCodester Student Attendance System 1.0. Affected is an unknown function of the file attendance_report.php. The manipulation of the argument class_id leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250230 is the identifier assigned to this vulnerability.2024-01-106.3CVE-2024-0389
[email protected]
[email protected]
[email protected]
soxft — timemailA vulnerability, which was classified as critical, has been found in soxft TimeMail up to 1.1. Affected by this issue is some unknown functionality of the file check.php. The manipulation of the argument c leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250112.2024-01-095.5CVE-2024-0344
[email protected]
[email protected]
[email protected]
splunk — splunk_enterprise_security_(es)In Splunk Enterprise Security (ES) versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service (DoS). The malformed investigation prevents the generation and rendering of the Investigations manager until it is deleted.<br>The vulnerability requires an authenticated session and access to create an Investigation. It only affects the availability of the Investigations manager, but without the manager, the Investigations functionality becomes unusable for most users.2024-01-096.5CVE-2024-22165
[email protected]
[email protected]
splunk — splunk_enterprise_security_(es)In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigation. The attachment endpoint does not properly limit the size of the request which lets an attacker cause the Investigation to become inaccessible.2024-01-094.3CVE-2024-22164
[email protected]
[email protected]
ssm_shiro_blog –&#xA0;ssm_shiro_blogA vulnerability has been found in Mandelo ssm_shiro_blog 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file updateRoles of the component Backend. The manipulation leads to improper access controls. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250123.2024-01-104.3CVE-2024-0356
[email protected]
[email protected]
[email protected]
sumanbhattarai — send_users_emailExposure of Sensitive Information to an Unauthorized Actor vulnerability in Suman Bhattarai Send Users Email.This issue affects Send Users Email: from n/a through 1.4.3.2024-01-055.3CVE-2023-52126
[email protected]
synopsys — devise-two-factorDevise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm’s (TOTP) inherent entropy limitations, it’s possible for an attacker to bypass the 2FA mechanism through brute-force attacks.2024-01-115CVE-2024-0227
[email protected]
synopsys — seekerSynopsys Seeker versions prior to 2023.12.0 are vulnerable to a stored cross-site scripting vulnerability through a specially crafted payload.2024-01-095.4CVE-2024-0226
[email protected]
taokeyun –&#xA0;taokeyunA vulnerability was found in Taokeyun up to 1.0.5. It has been rated as critical. Affected by this issue is the function shopGoods of the file application/index/controller/app/store/Goods.php of the component HTTP POST Request Handler. The manipulation of the argument keyword leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250586 is the identifier assigned to this vulnerability.2024-01-136.3CVE-2024-0481
[email protected]
[email protected]
[email protected]
taokeyun –&#xA0;taokeyunA vulnerability classified as critical has been found in Taokeyun up to 1.0.5. This affects the function index of the file application/index/controller/app/Video.php of the component HTTP POST Request Handler. The manipulation of the argument cid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250587.2024-01-136.3CVE-2024-0482
[email protected]
[email protected]
[email protected]
taokeyun –&#xA0;taokeyunA vulnerability classified as critical was found in Taokeyun up to 1.0.5. This vulnerability affects the function index of the file application/index/controller/app/Task.php of the component HTTP POST Request Handler. The manipulation of the argument cid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250588.2024-01-136.3CVE-2024-0483
[email protected]
[email protected]
[email protected]
tasmoadmin — tasmoadminLack of “current” GET parameter validation during the action of changing a language leads to an open redirect vulnerability.2024-01-086.1CVE-2023-6552
[email protected]
[email protected]
[email protected]
themeisle — rss_aggregator_by_feedzyThe RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check when updating settings in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with author-level access or above to change the plugin’s settings including proxy settings, which are also exposed to authors.2024-01-065.4CVE-2023-6798
[email protected]
[email protected]
themeisle — rss_aggregator_by_feedzyThe RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-065.4CVE-2023-6801
[email protected]
[email protected]
themeum — wp_crowdfundingThe WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin2024-01-086.1CVE-2023-6161
[email protected]
topazevolution — antifraudThe wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process Light) process via an IOCTL (which will be named at a later time).2024-01-086.5CVE-2023-52271
[email protected]
[email protected]
totolink — t6_firmwareA vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923. This affects an unknown part of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249867. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2024-01-096.5CVE-2023-7223
[email protected]
[email protected]
[email protected]
trellix — trellix_endpoint_security_(ens)_web_controlA content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy configuration.2024-01-106.1CVE-2024-0310
[email protected]
uncannyowl — uncanny_automatorExposure of Sensitive Information to an Unauthorized Actor vulnerability in Uncanny Automator, Uncanny Owl Uncanny Automator – Automate everything with the #1 no-code automation and integration plugin.This issue affects Uncanny Automator – Automate everything with the #1 no-code automation and integration plugin: from n/a through 5.1.0.2.2024-01-055.3CVE-2023-52151
[email protected]
vehicle_booking_system –&#xA0;vehicle_booking_systemA vulnerability, which was classified as problematic, was found in CodeAstro Vehicle Booking System 1.0. This affects an unknown part of the file usr/usr-register.php of the component User Registration. The manipulation of the argument Full_Name/Last_Name/Address with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250113 was assigned to this vulnerability.2024-01-094.3CVE-2024-0345
[email protected]
[email protected]
[email protected]
videowhisper — rate_star_reviewImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in VideoWhisper Rate Star Review – AJAX Reviews for Content, with Star Ratings allows Reflected XSS.This issue affects Rate Star Review – AJAX Reviews for Content, with Star Ratings: from n/a through 1.5.1.2024-01-086.1CVE-2023-52213
[email protected]
weitong — mallA vulnerability was found in Weitong Mall 1.0.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file platform-shop\src\main\resources\com\platform\dao\OrderDao.xml. The manipulation of the argument sidx/order leads to sql injection. The associated identifier of this vulnerability is VDB-250243.2024-01-125.5CVE-2022-4961
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘esi’ shortcode in versions up to, and including, 5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-116.4CVE-2023-4372
[email protected]
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘wcfm_stores’ shortcode in versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-116.4CVE-2023-4960
[email protected]
[email protected]
[email protected]
[email protected]
wordpress — wordpressCross-Site Request Forgery (CSRF) vulnerability in Doofinder Doofinder WP & WooCommerce Search. This issue affects Doofinder WP & WooCommerce Search: from n/a through 2.0.33.2024-01-056.5CVE-2023-51678
[email protected]
wordpress — wordpressThe Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks.2024-01-086.5CVE-2023-6139
[email protected]
wordpress — wordpressThe EventON – WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evo_eventpost_update_meta function in all versions up to, and including, 4.5.4 (for Pro) and 2.2.7 (for free). This makes it possible for unauthenticated attackers to update and remove arbitrary post metadata. Note that certain parameters may allow for content injection.2024-01-106.5CVE-2023-6158
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe EventON – WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (for Pro) & 2.2.7 (for Free). This is due to missing or incorrect nonce validation on the evo_eventpost_update_meta function. This makes it possible for unauthenticated attackers to update arbitrary post metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.2024-01-116.5CVE-2023-6242
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe EventON – WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (Pro) & 2.2.8 (Free). This is due to missing or incorrect nonce validation on the save_virtual_event_settings function. This makes it possible for unauthenticated attackers to modify virtual event settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.2024-01-116.5CVE-2023-6244
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities.2024-01-086.1CVE-2023-6529
[email protected]
wordpress — wordpressThe Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the featured image alt text in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-116.4CVE-2023-6561
[email protected]
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of arbitrary files on the server including wp-config.php, which can contain sensitive information.2024-01-116.6CVE-2023-6583
[email protected]
[email protected]
wordpress — wordpressThe Happy Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via DOM in all versions up to and including 3.9.1.1 (versions up to 2.9.1.1 in Happy Addons for Elementor Pro) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.2024-01-116.1CVE-2023-6632
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe CAOS | Host Google Analytics Locally plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘update_settings’ function in versions up to, and including, 4.7.14. This makes it possible for unauthenticated attackers to update plugin settings.2024-01-116.5CVE-2023-6637
[email protected]
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe GTG Product Feed for Shopping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘update_settings’ function in versions up to, and including, 1.2.4. This makes it possible for unauthenticated attackers to update plugin settings.2024-01-116.5CVE-2023-6638
[email protected]
[email protected]
wordpress — wordpressThe Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions up to, and including, 2.2.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-116.4CVE-2023-6645
[email protected]
[email protected]
wordpress — wordpressThe Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ive’ shortcode in versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on ‘width’ and ‘height’ user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-116.4CVE-2023-6684
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Ready Function’ field in all versions up to, and including, 1.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-116.4CVE-2023-6776
[email protected]
[email protected]
wordpress — wordpressThe Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s custom fields in all versions up to, and including, 2.10.26 due to insufficient input sanitization and output escaping on user supplied values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-116.4CVE-2023-6781
[email protected]
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcode(s) in all versions up to, and including, 1.0.92 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-116.4CVE-2023-6782
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated users to inject arbitrary HTML code into form fields. When the form data is viewed by an administrator in the Entries View Page, the injected HTML code is rendered, potentially leading to admin area defacement or redirection to malicious websites.2024-01-096.5CVE-2023-6830
[email protected]
[email protected]
wordpress — wordpressThe Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘environment_mode’ parameter in all versions up to, and including, 4.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.2024-01-116.1CVE-2023-6882
[email protected]
[email protected]
wordpress — wordpressThe Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcode(s) in all versions up to, and including, 2.25.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-116.4CVE-2023-6934
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe Oxygen Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom field in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Version 4.8.1 of the Oxygen Builder plugin for WordPress addresses this vulnerability by implementing an optional filter to provide output escaping for dynamic data. Please see https://oxygenbuilder.com/documentation/other/security/#filtering-dynamic-data for more details.2024-01-116.4CVE-2023-6938
[email protected]
[email protected]
wordpress — wordpressThe Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s extend_builder_render_js shortcode in all versions up to, and including, 1.0.239 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-116.4CVE-2023-6988
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘catlist’ shortcode in all versions up to, and including, 0.89.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-116.5CVE-2023-6994
[email protected]
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s eeb_mailto shortcode in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-116.4CVE-2023-7070
[email protected]
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table of Contents block in all versions up to, and including, 4.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-116.4CVE-2023-7071
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe Advanced Woo Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search parameter in all versions up to, and including, 2.96 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This only affects sites when the Dynamic Content for Elementor plugin is also installed.2024-01-136.1CVE-2024-0251
[email protected]
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_disconnect function. This makes it possible for unauthenticated attackers to deactivate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.2024-01-115.4CVE-2023-4247
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_stripe_disconnect_connect_stripe_account function. This makes it possible for unauthenticated attackers to deactivate the plugin’s stripe integration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.2024-01-115.4CVE-2023-4248
[email protected]
[email protected]
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in ShapedPlugin LLC WP Tabs – Responsive Tabs Plugin for WordPress allows Stored XSS.This issue affects WP Tabs – Responsive Tabs Plugin for WordPress: from n/a through 2.2.0.2024-01-055.4CVE-2023-52124
[email protected]
wordpress — wordpressThe Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks.2024-01-085.4CVE-2023-6141
[email protected]
wordpress — wordpressThe Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 2.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose sensitive information or perform unauthorized actions, such as saving advanced plugin settings.2024-01-115.4CVE-2023-6369
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via the card_famne_export_settings function. This makes it possible for unauthenticated attackers to obtain plugin settings.2024-01-115.3CVE-2023-6496
[email protected]
[email protected]
wordpress — wordpressThe FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via currency options in all versions up to, and including, 1.4.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-115.4CVE-2023-6556
[email protected]
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.3 via the ekit_widgetarea_content function. This makes it possible for unauthenticated attackers to obtain contents of posts in draft, private or pending review status that should not be visible to the general public. This applies to posts created with Elementor only.2024-01-115.3CVE-2023-6582
[email protected]
[email protected]
[email protected]
[email protected]
wordpress — wordpressImproper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Laybuy Laybuy Payment Extension for WooCommerce allows Stored XSS.This issue affects Laybuy Payment Extension for WooCommerce: from n/a through 5.3.9.2024-01-085.4CVE-2024-21745
[email protected]
wordpress — wordpressThe GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_remote_install_handler function. This makes it possible for unauthenticated attackers to install and activate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.2024-01-114.3CVE-2023-4246
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe Chatbot for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 2.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.2024-01-114.4CVE-2023-5691
[email protected]
[email protected]
wordpress — wordpressThe LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing validation on the ‘userID’ user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the details of another user’s course progress.2024-01-114.3CVE-2023-6223
[email protected]
[email protected]
wordpress — wordpressThe Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.2024-01-114.4CVE-2023-6446
[email protected]
[email protected]
wordpress — wordpressThe Depicter Slider – Responsive Image Slider, Video Slider & Post Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the ‘save’ function. This makes it possible for unauthenticated attackers to modify the plugin’s settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2023-51491 appears to be a duplicate of this issue.2024-01-054.3CVE-2023-6493
[email protected]
[email protected]
wordpress — wordpressThe User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wppb_toolbox_usermeta_handler function in all versions up to, and including, 3.10.7. This makes it possible for authenticated attackers, with contributor-level access and above, to expose sensitive information within user metadata.2024-01-114.3CVE-2023-6504
[email protected]
[email protected]
wordpress — wordpressThe WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the send_backup_codes_email due to missing validation on a user controlled key. This makes it possible for subscriber-level attackers to email arbitrary users on the site.2024-01-114.3CVE-2023-6506
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the send_backup_codes_email function. This makes it possible for unauthenticated attackers to send emails with arbitrary content to registered users via a forged request granted they can trick a site administrator or other registered user into performing an action such as clicking on a link. While a nonce check is present, it is only executed if a nonce is set. By omitting a nonce from the request, the check can be bypassed.2024-01-114.3CVE-2023-6520
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Administrators can give button creation privileges to users with lower levels (contributor+) which would allow those lower-privileged users to carry out attacks.2024-01-094.8CVE-2023-6594
[email protected]
[email protected]
wordpress — wordpressThe Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcode(s) in all versions up to, and including, 1.24.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.2024-01-114.9CVE-2023-6624
[email protected]
[email protected]
wordpress — wordpressThe Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any post type, referencing the post by id and the meta by key.2024-01-114.3CVE-2023-6630
[email protected]
[email protected]
wordpress — wordpressThe Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all versions up to, and including, 4.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploiting this vulnerability requires the attacker to know the ID of an attachment uploaded by the user they are attacking.2024-01-114.7CVE-2023-6737
[email protected]
[email protected]
wordpress — wordpressThe Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the ‘envira_gallery_insert_images’ function in all versions up to, and including, 1.8.7.1. This makes it possible for authenticated attackers, with contributor access and above, to modify galleries on other users’ posts.2024-01-114.3CVE-2023-6742
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name field label and description field label parameter in all versions up to 6.7 (inclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this only affects multi-site installations and installations where unfiltered_html has been disabled. However, in the formidable settings admins can extend form creation, deletion and other management permissions to other user types, which makes it possible for this vulnerability to be exploited by lower level user types as long as they have been granted the proper permissions.2024-01-094.4CVE-2023-6842
[email protected]
[email protected]
wordpress — wordpressThe Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions, such as modifying the plugin’s Facebook and Instagram access tokens and updating group IDs.2024-01-114.3CVE-2023-6883
[email protected]
[email protected]
wordpress — wordpressThe Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in versions up to, and including, 1.8.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. It can also be exploited with a contributor-level permission with a page builder plugin.2024-01-114.4CVE-2023-6924
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
wordpress — wordpressThe LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the insert_template function in all versions up to, and including, 2.6.8. This makes it possible for authenticated attackers, with