The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.
Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:
- High: vulnerabilities with a CVSS base score of 7.0–10.0
- Medium: vulnerabilities with a CVSS base score of 4.0–6.9
- Low: vulnerabilities with a CVSS base score of 0.0–3.9
Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis.
High Vulnerabilities
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| aenrich_technology — a+hrd | aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service. | 2023-04-27 | 9.8 | CVE-2023-20852 CONFIRM |
| aenrich_technology — a+hrd |
aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message process. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service. | 2023-04-27 | 9.8 | CVE-2023-20853 CONFIRM |
| online_eyewear_shop_project — online_eyewear_shop | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. This affects an unknown part of the file /admin/orders/update_status.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227229 was assigned to this vulnerability. | 2023-04-22 | 9.8 | CVE-2023-2244 MISC MISC MISC |
| online_pizza_ordering_system_project — online_pizza_ordering_system | A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/ajax.php?action=save_settings. The manipulation of the argument img leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227236. | 2023-04-23 | 9.8 | CVE-2023-2246 MISC MISC MISC |
| moxa — miineport_e1 |
Moxa MiiNePort E1 has a vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to perform arbitrary system operation or disrupt service. | 2023-04-27 | 9.8 | CVE-2023-28697 CONFIRM CONFIRM |
| powerjob — powerjob | PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution. | 2023-04-21 | 9.8 | CVE-2023-29924 MISC MISC |
| tenda — ac5_firmware | Tenda AC5 V15.03.06.28 is vulnerable to Buffer Overflow via the initWebs function. | 2023-04-24 | 9.8 | CVE-2023-30368 MISC |
| tenda — ac15_firmware | Tenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow. | 2023-04-24 | 9.8 | CVE-2023-30369 MISC |
| tenda — ac15_firmware | In Tenda AC15 V15.03.05.19, the function GetValue contains a stack-based buffer overflow vulnerability. | 2023-04-24 | 9.8 | CVE-2023-30370 MISC |
| tenda — ac15_firmware | In Tenda AC15 V15.03.05.19, the function “sub_ED14” contains a stack-based buffer overflow vulnerability. | 2023-04-24 | 9.8 | CVE-2023-30371 MISC |
| tenda — ac15_firmware | In Tenda AC15 V15.03.05.19, The function “xkjs_ver32” contains a stack-based buffer overflow vulnerability. | 2023-04-24 | 9.8 | CVE-2023-30372 MISC |
| tenda — ac15_firmware | In Tenda AC15 V15.03.05.19, the function “xian_pppoe_user” contains a stack-based buffer overflow vulnerability. | 2023-04-24 | 9.8 | CVE-2023-30373 MISC |
| tenda — ac15_firmware | In Tenda AC15 V15.03.05.19, the function “getIfIp” contains a stack-based buffer overflow vulnerability. | 2023-04-24 | 9.8 | CVE-2023-30375 MISC |
| tenda — ac15_firmware | In Tenda AC15 V15.03.05.19, the function “henan_pppoe_user” contains a stack-based buffer overflow vulnerability. | 2023-04-24 | 9.8 | CVE-2023-30376 MISC |
| tenda — ac15_firmware | In Tenda AC15 V15.03.05.19, the function “sub_8EE8” contains a stack-based buffer overflow vulnerability. | 2023-04-24 | 9.8 | CVE-2023-30378 MISC |
| gipsy_project — gipsy | Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run command on the host machine with sudoer permission. The `!ping` command when provided with an IP or hostname used to run a bash `ping <IP>` without verification that the IP or hostname was legitimate. This command was executed with root permissions and may lead to arbitrary command injection on the host server. Users are advised to upgrade. There are no known workarounds for this vulnerability. | 2023-04-21 | 9.8 | CVE-2023-30621 MISC MISC MISC |
| areteit — activity_reactions_for_buddypress | Cross-Site Request Forgery (CSRF) vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin <= 1.0.22 versions. | 2023-04-23 | 8.8 | CVE-2022-45074 MISC |
| krishaweb — add_multiple_marker | Cross-Site Request Forgery (CSRF) vulnerability in KrishaWeb Add Multiple Marker plugin <= 1.2 versions. | 2023-04-23 | 8.8 | CVE-2022-45080 MISC |
| kodcloud — kodexplorer | A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.50 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227000. | 2023-04-22 | 8.8 | CVE-2022-4944 MISC MISC MISC MISC MISC |
| php_execution_project — php_execution | Cross-Site Request Forgery (CSRF) vulnerability in Nicolas Zeh PHP Execution plugin <= 1.0.0 versions. | 2023-04-23 | 8.8 | CVE-2023-23879 MISC |
| sunnet — ctms |
SUNNET CTMS has vulnerability of path traversal within its file uploading function. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary directories to perform arbitrary system operation or disrupt service. | 2023-04-27 | 8.8 | CVE-2023-24836 CONFIRM |
| nvidia — bmc | NVIDIA DGX-1 BMC contains a vulnerability in the SPX REST API, where an attacker with the appropriate level of authorization can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure, and data tampering. | 2023-04-22 | 8.8 | CVE-2023-25507 MISC |
| piwigo — piwigo | SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint. | 2023-04-21 | 8.8 | CVE-2023-26876 MISC MISC MISC FULLDISC MISC |
| nvidia — sbios | NVIDIA DGX-1 contains a vulnerability in Ofbd in AMI SBIOS, where a preconditioned heap can allow a user with elevated privileges to cause an access beyond the end of a buffer, which may lead to code execution, escalation of privileges, denial of service and information disclosure. The scope of the impact of this vulnerability can extend to other components. | 2023-04-22 | 8.2 | CVE-2023-25506 MISC |
| microsoft — multiple_products |
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability | 2023-04-27 | 8.1 | CVE-2023-21712 MISC |
| nvidia — sbios | NVIDIA DGX-1 SBIOS contains a vulnerability in the Uncore PEI module, where authentication of the code executed by SSA is missing, which may lead to arbitrary code execution, denial of service, escalation of privileges assisted by a firmware implant, information disclosure assisted by a firmware implant, data tampering, and SecureBoot bypass. | 2023-04-22 | 7.8 | CVE-2023-0209 MISC |
| podofo_project — podofo | A vulnerability, which was classified as critical, was found in PoDoFo 0.10.0. Affected is the function readXRefStreamEntry of the file PdfXRefStreamParserObject.cpp. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is 535a786f124b739e3c857529cecc29e4eeb79778. It is recommended to apply a patch to fix this issue. VDB-227226 is the identifier assigned to this vulnerability. | 2023-04-22 | 7.8 | CVE-2023-2241 MISC MISC MISC MISC MISC |
| churchcrm — churchcrm | ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file. | 2023-04-25 | 7.8 | CVE-2023-25348 MISC MISC |
| nvidia — bmc | NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler of the AMI MegaRAC BMC , where an attacker with the appropriate level of authorization can cause a buffer overflow, which may lead to denial of service, information disclosure, or arbitrary code execution. | 2023-04-22 | 7.8 | CVE-2023-25505 MISC |
| nvidia — bmc | NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler, where an attacker with the appropriate level of authorization can upload and download arbitrary files under certain circumstances, which may lead to denial of service, escalation of privileges, information disclosure, and data tampering. | 2023-04-22 | 7.8 | CVE-2023-25508 MISC |
| nvidia — sbios | NVIDIA DGX-1 SBIOS contains a vulnerability in Bds, which may lead to code execution, denial of service, and escalation of privileges. | 2023-04-22 | 7.8 | CVE-2023-25509 MISC |
| mindsdb — mindsdb | mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extractall()` from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the vulnerability is called a TarSlip or a ZipSlip variant. An attacker may leverage this vulnerability to overwrite any local file which the server process has access to. There is no risk of file exposure with this vulnerability. This issue has been addressed in release `23.2.1.0 `. Users are advised to upgrade. There are no known workarounds for this vulnerability. | 2023-04-21 | 7.5 | CVE-2023-30620 MISC MISC MISC |
| encode — starlette | There MultipartParser usage in Encode’s Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service. | 2023-04-21 | 7.5 | CVE-2023-30798 MISC MISC MISC |
| ltos — ltos |
In LTOS versions prior to V7.06.013, the configuration file upload function would not correctly validate the input, which would allow an remote authenticated attacker with high privileges to execute arbitrary commands. | 2023-04-24 | 7.2 | CVE-2023-1731 MISC |
Medium Vulnerabilities
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| nvidia — bmc | NVIDIA DGX-2 contains a vulnerability in OFBD where a user with high privileges and a pre-conditioned heap can cause an access beyond a buffers end, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. | 2023-04-22 | 6.7 | CVE-2023-0200 MISC |
| nvidia — bmc | NVIDIA DGX-2 SBIOS contains a vulnerability in Bds, where a user with high privileges can cause a write beyond the bounds of an indexable resource, which may lead to code execution, denial of service, compromised integrity, and information disclosure. | 2023-04-22 | 6.7 | CVE-2023-0201 MISC |
| microweber — microweber | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4. | 2023-04-22 | 6.5 | CVE-2023-2239 CONFIRM MISC |
| churchcrm — churchcrm | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user’s password except for the user that is currently logged in. | 2023-04-25 | 6.5 | CVE-2023-26841 MISC MISC |
| cloverdx — cloverdx | CloverDX before 5.17.3 writes passwords to the audit log in certain situations, if the audit log is enabled and single sign-on is not employed. The fixed versions are 5.15.4, 5.16.2, 5.17.3, and 6.0.x. | 2023-04-24 | 6.5 | CVE-2023-31056 MISC |
| wpjam — wechat_robot | Reflected Cross-Site Scripting (XSS) vulnerability in Denis ???????? plugin <= 6.0.1 versions. | 2023-04-25 | 6.1 | CVE-2022-45837 MISC |
| user_meta_manager_project — user_meta_manager | Reflected Cross-Site Scripting (XSS) vulnerability in Jason Lau User Meta Manager plugin <= 3.4.9 versions. | 2023-04-23 | 6.1 | CVE-2023-22718 MISC |
| rarathemes — vryasage_marketing_performance | Reflected Cross-Site Scripting (XSS) vulnerability in VryaSage Marketing Performance plugin <= 2.0.0 versions. | 2023-04-23 | 6.1 | CVE-2023-24404 MISC |
| churchcrm — churchcrm | A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found. | 2023-04-25 | 6.1 | CVE-2023-25346 MISC MISC |
| microsoft — edge |
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | 2023-04-27 | 6.1 | CVE-2023-28261 MISC |
| microsoft — edge |
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability | 2023-04-27 | 6.1 | CVE-2023-28286 MISC |
| cesanta — mjs | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_ffi_cb_free at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (DoS). | 2023-04-24 | 5.5 | CVE-2023-29570 MISC MISC |
| 1app — 1app_business_forms | Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in 1app Technologies, Inc 1app Business Forms plugin <= 1.0.0 versions. | 2023-04-23 | 5.4 | CVE-2022-44631 MISC |
| blueglass — jobs_for_wordpress | Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in BlueGlass Jobs for WordPress plugin <= 2.5.11.2 versions. | 2023-04-23 | 5.4 | CVE-2022-44743 MISC |
| phpmyfaq — phpmyfaq | Cross-site Scripting (XSS) – Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | 2023-04-22 | 5.4 | CVE-2023-1875 MISC CONFIRM |
| devolutions — devolutions_server | Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and download diagnostic files via specific endpoints. | 2023-04-21 | 5.4 | CVE-2023-2118 MISC |
| theme_blvd_responsive_google_maps_project — theme_blvd_responsive_google_maps | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Jason Bobich Theme Blvd Responsive Google Maps plugin <= 1.0.2 versions. | 2023-04-23 | 5.4 | CVE-2023-22698 MISC |
| portfolio_slideshow_project — portfolio_slideshow | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in George Gecewicz Portfolio Slideshow plugin <= 1.13.0 versions. | 2023-04-23 | 5.4 | CVE-2023-23717 MISC |
| simple_pdf_viewer_project — simple_pdf_viewer | Auth. (contrinbutor+) Cross-Site Scripting (XSS) vulnerability in WebArea | Vera Nedvyzhenko Simple PDF Viewer plugin <= 1.9 versions. | 2023-04-23 | 5.4 | CVE-2023-23817 MISC |
| google_maps_v3_shortcode_project — google_maps_v3_shortcode | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Google Maps v3 Shortcode plugin <= 1.2.1 versions. | 2023-04-23 | 5.4 | CVE-2023-23827 MISC |
| ultimate_wp_query_search_filter_project — ultimate_wp_query_search_filter | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in TC Ultimate WP Query Search Filter plugin <= 1.0.10 versions. | 2023-04-23 | 5.4 | CVE-2023-23832 MISC |
| interactive_geo_maps_project — interactive_geo_maps | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Carlos Moreira Interactive Geo Maps plugin <= 1.5.8 versions. | 2023-04-25 | 5.4 | CVE-2023-23866 MISC |
| fullworksplugins — quick_paypal_payments | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions. | 2023-04-25 | 5.4 | CVE-2023-23889 MISC |
| churchcrm — churchcrm | A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These input fields are located in the “Title” Input Field in EventEditor.php. | 2023-04-25 | 5.4 | CVE-2023-25347 MISC MISC |
| churchcrm — churchcrm | A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. | 2023-04-25 | 5.4 | CVE-2023-26843 MISC MISC |
| machothemes — regina_lite | Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <= 2.0.7 versions. | 2023-04-25 | 5.4 | CVE-2023-27619 MISC |
| churchcrm — churchcrm | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator. | 2023-04-25 | 5.3 | CVE-2023-26840 MISC MISC |
| changingtec — motp |
ChangingTec MOTP system has a path traversal vulnerability. A remote attacker with administrator’s privilege can exploit this vulnerability to access arbitrary system files. | 2023-04-27 | 4.9 | CVE-2023-22901 CONFIRM |
| apptivo — apptivo_business_site_crm | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apptivo Apptivo Business Site CRM plugin <= 3.0.12 versions. | 2023-04-23 | 4.8 | CVE-2022-44582 MISC |
| codebangers — all_in_one_time_clock_lite | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Codebangers All in One Time Clock Lite plugin <= 1.3.320 versions. | 2023-04-23 | 4.8 | CVE-2022-44594 MISC |
| 0mk_shortener_project — 0mk_shortener | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Boris Kuzmanov 0mk Shortener plugin <= 0.2 versions. | 2023-04-23 | 4.8 | CVE-2022-45361 MISC |
| wp-olivecart_project — wp-olivecart | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Olive Design WP-OliveCart plugin <= 1.1.3 versions. | 2023-04-23 | 4.8 | CVE-2022-47435 MISC |
| fullworksplugins — quick_contact_form | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions. | 2023-04-25 | 4.8 | CVE-2022-47608 MISC |
| miniorange — wordpress_social_login_and_register_(discord,_google,_twitter,_linkedin) | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions. | 2023-04-25 | 4.8 | CVE-2023-23710 MISC |
| wordpress_custom_settings_project — wordpress_custom_settings | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Davinder Singh Custom Settings plugin <= 1.0 versions. | 2023-04-23 | 4.8 | CVE-2023-23806 MISC |
| sitemap_index_project — sitemap_index | Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Twardes Sitemap Index plugin <= 1.2.3 versions. | 2023-04-23 | 4.8 | CVE-2023-23816 MISC |
| tinymce_custom_styles_project — tinymce_custom_styles | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tim Reeves & David Stöckl TinyMCE Custom Styles plugin <= 1.1.2 versions. | 2023-04-25 | 4.8 | CVE-2023-23995 MISC |
| winwar — inline_tweet_sharer | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media Inline Tweet Sharer – Twitter Sharing Plugin plugin <= 2.5.3 versions. | 2023-04-25 | 4.8 | CVE-2023-24005 MISC |
| ai_contact_us_form_project — ai_contact_us_form | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Karishma Arora AI Contact Us Form plugin <= 1.0 versions. | 2023-04-23 | 4.8 | CVE-2023-24386 MISC |
| wpchill — cpo_content_types | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPChill CPO Content Types plugin <= 1.1.0 versions. | 2023-04-23 | 4.8 | CVE-2023-25451 MISC |
| smartlogix — wp-insert | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in namithjawahar Wp-Insert plugin <= 2.5.0 versions. | 2023-04-25 | 4.8 | CVE-2023-25461 MISC |
| podlove — podlove_subscribe_button | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Podlove Podlove Subscribe button plugin <= 1.3.7 versions. | 2023-04-25 | 4.8 | CVE-2023-25479 MISC |
| simple_yearly_archive_project — simple_yearly_archive | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Oliver Schlöbe Simple Yearly Archive plugin <= 2.1.8 versions. | 2023-04-25 | 4.8 | CVE-2023-25484 MISC |
| json-content-importer — json_content_importer | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bernhard Kux JSON Content Importer plugin <= 1.3.15 versions. | 2023-04-25 | 4.8 | CVE-2023-25485 MISC |
| archivist_-_custom_archive_templates_project — archivist_-_custom_archive_templates | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin <= 1.7.4 versions. | 2023-04-25 | 4.8 | CVE-2023-25490 MISC |
| digitalblue — click_to_call_or_chat_buttons | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DIGITALBLUE Click to Call or Chat Buttons plugin <= 1.4.0 versions. | 2023-04-25 | 4.8 | CVE-2023-25710 MISC |
| link_juice_keeper_project — link_juice_keeper | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in George Pattihis Link Juice Keeper plugin <= 2.0.2 versions. | 2023-04-25 | 4.8 | CVE-2023-25793 MISC |
| electric_studio_client_login_project — electric_studio_client_login | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in James Irving-Swift Electric Studio Client Login plugin <= 0.8.1 versions. | 2023-04-23 | 4.8 | CVE-2023-27425 MISC |
| motor_racing_league_project — motor_racing_league | Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Ian Haycox Motor Racing League plugin <= 1.9.9 versions. | 2023-04-23 | 4.8 | CVE-2023-27614 MISC |
| nvidia — sbios | NVIDIA DGX-2 SBIOS contains a vulnerability where an attacker may modify the ServerSetup NVRAM variable at runtime by executing privileged code. A successful exploit of this vulnerability may lead to denial of service. | 2023-04-22 | 4.4 | CVE-2023-0207 MISC |
| churchcrm — churchcrm | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site. | 2023-04-25 | 4.3 | CVE-2023-26839 MISC MISC |
| microsoft — edge |
Microsoft Edge (Chromium-based) Spoofing Vulnerability | 2023-04-28 | 4.3 | CVE-2023-29334 MISC |
Low Vulnerabilities
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| There were no low vulnerabilities recorded this week. | ||||
Severity Not Yet Assigned
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| wordpress — wordpress |
A vulnerability was found in Kau-Boy Backend Localization Plugin up to 1.6.1 on WordPress. It has been rated as problematic. This issue affects some unknown processing of the file backend_localization.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.0 is able to address this issue. The name of the patch is 43dc96defd7944da12ff116476a6890acd7dd24b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-227231. | 2023-04-24 | not yet calculated | CVE-2012-10013 MISC MISC MISC MISC |
| wordpress — wordpress |
A vulnerability classified as problematic has been found in Kau-Boy Backend Localization Plugin 2.0 on WordPress. Affected is the function backend_localization_admin_settings/backend_localization_save_setting/backend_localization_login_form/localize_backend of the file backend_localization.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.1 is able to address this issue. The name of the patch is 36f457ee16dd114e510fd91a3ea9fbb3c1f87184. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227232. | 2023-04-24 | not yet calculated | CVE-2012-10014 MISC MISC MISC MISC |
| arc — arc |
ARC (aka ARC2) through 2011-12-01 allows blind SQL Injection in getTriplePatternSQL in ARC2_StoreSelectQueryHandler.php via comments in a SPARQL WHERE clause. | 2023-04-26 | not yet calculated | CVE-2012-5872 MISC |
| arc — arc |
ARC (aka ARC2) through 2011-12-01 allows reflected XSS via the end_point.php query parameter in an output=htmltab action. | 2023-04-26 | not yet calculated | CVE-2012-5873 MISC |
| hongcms — hongcms |
Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop. | 2023-04-28 | not yet calculated | CVE-2020-21643 MISC |
| boxbilling — boxbilling |
Cross Site Scripting (XSS) vulnerability in BoxBilling 4.19, 4.19.1, 4.20, and 4.21 allows remote attackers to run arbitrary code via the message field on the submit new ticket form. | 2023-04-28 | not yet calculated | CVE-2020-23647 MISC |
| yoyager — yoyager |
Insecure Permission vulnerability found in Yoyager v.1.4 and before allows a remote attacker to execute arbitrary code via a crafted .php file to the media component. | 2023-04-26 | not yet calculated | CVE-2020-36070 MISC |
| ibm — counter_fraud_management_for_safer_payments |
IBM Counter Fraud Management for Safer Payments 5.7.0.00 through 5.7.0.10, 6.0.0.00 through 6.0.0.07, 6.1.0.00 through 6.1.0.05, and 6.2.0.00 through 6.2.1.00 could allow an authenticated attacker under special circumstances to send multiple specially crafted API requests that could cause the application to crash. IBM X-Force ID: 188052. | 2023-04-28 | not yet calculated | CVE-2020-4729 MISC MISC |
| odoo — community/enterprise |
A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server. | 2023-04-25 | not yet calculated | CVE-2021-23166 MISC |
| odoo — community/enterprise |
Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to extract accounting information via crafted RPC packets. | 2023-04-25 | not yet calculated | CVE-2021-23176 MISC |
| odoo — community/enterprise |
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized payment method that belongs to another user, causing the victim’s payment method to be charged instead. | 2023-04-25 | not yet calculated | CVE-2021-23178 MISC |
| odoo — community/enterprise |
A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and modify database contents of other tenants, in a multi-tenant system. | 2023-04-25 | not yet calculated | CVE-2021-23186 MISC |
| odoo — community/enterprise |
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests. | 2023-04-25 | not yet calculated | CVE-2021-23203 MISC |
| odoo — community/enterprise |
Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents. | 2023-04-25 | not yet calculated | CVE-2021-26263 MISC |
| odoo — community/enterprise |
Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via a crafted link. | 2023-04-25 | not yet calculated | CVE-2021-26947 MISC |
| ribose — rnp |
Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm. | 2023-04-21 | not yet calculated | CVE-2021-33589 MISC MISC |
| odoo — community/enterprise |
Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the deactivated account and any permission it still holds, via crafted RPC requests. | 2023-04-25 | not yet calculated | CVE-2021-44460 MISC |
| odoo — community/enterprise |
Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting journal entries to inject arbitrary web script in the browser of a victim. | 2023-04-25 | not yet calculated | CVE-2021-44461 MISC |
| odoo — community/enterprise |
Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notifications and comments related to arbitrary business records in the system, via crafted RPC requests. | 2023-04-25 | not yet calculated | CVE-2021-44465 MISC |
| odoo — community/enterprise |
A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the server, including sensitive configuration files. | 2023-04-25 | not yet calculated | CVE-2021-44476 MISC |
| odoo — community/enterprise |
A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalation. | 2023-04-25 | not yet calculated | CVE-2021-44547 MISC |
| odoo — community/enterprise |
Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents. | 2023-04-25 | not yet calculated | CVE-2021-44775 MISC |
| odoo — community/enterprise |
Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via crafted uploaded file names. | 2023-04-25 | not yet calculated | CVE-2021-45071 MISC |
| odoo — community/enterprise |
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger the creation of demonstration data, including user accounts with known credentials. | 2023-04-25 | not yet calculated | CVE-2021-45111 MISC |
| pingid — pingid |
PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two people with the same username are provisioned onto the same machine at different times. | 2023-04-25 | not yet calculated | CVE-2022-23721 MISC |
| infopop_ultimate_bulletin_board — infopop_ultimate_bulletin_board |
Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature. | 2023-04-27 | not yet calculated | CVE-2022-25091 MISC MISC MISC MISC MISC |
| drupal — core |
Drupal core’s form API has a vulnerability where certain contributed or custom modules’ forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data. | 2023-04-26 | not yet calculated | CVE-2022-25273 CONFIRM |
| drupal — core |
Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual items of node and media content. This vulnerability only affects sites using Drupal’s revision system. | 2023-04-26 | not yet calculated | CVE-2022-25274 CONFIRM |
| drupal — core |
In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the “private” file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability. This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) $config[‘image.settings’][‘allow_insecure_derivatives’] or (Drupal 7) $conf[‘image_allow_insecure_derivatives’] to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing files or image styles after updating. | 2023-04-26 | not yet calculated | CVE-2022-25275 CONFIRM |
| drupal — core |
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities. | 2023-04-26 | not yet calculated | CVE-2022-25276 CONFIRM |
| drupal — core |
Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files’ filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core’s default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads. | 2023-04-26 | not yet calculated | CVE-2022-25277 CONFIRM |
| drupal — core |
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected. | 2023-04-26 | not yet calculated | CVE-2022-25278 CONFIRM |
| tooljet — tooljet |
Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request. | 2023-04-26 | not yet calculated | CVE-2022-27978 MISC MISC |
| tooljet — tooljet |
A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component. | 2023-04-26 | not yet calculated | CVE-2022-27979 MISC MISC |
| mybb — mybb |
In the Active Threads Plugin 1.3.0 for MyBB, the activethreads.php date parameter is vulnerable to XSS when setting a time period. | 2023-04-24 | not yet calculated | CVE-2022-28354 MISC MISC |
| nokia — onends |
Nokia OneNDS 17r2 has Insecure Permissions vulnerability that allows for privilege escalation. | 2023-04-25 | not yet calculated | CVE-2022-31244 MISC MISC |
| hp — bios |
A potential security vulnerability has been identified in the system BIOS for certain HP PC products which may allow loss of integrity. HP is releasing firmware updates to mitigate the potential vulnerability. | 2023-04-28 | not yet calculated | CVE-2022-31643 MISC |
| docker_desktop_for_windows — docker_desktop_for_windows |
Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in the DataFolder parameter, a different vulnerability than CVE-2022-26659. | 2023-04-27 | not yet calculated | CVE-2022-31647 MISC MISC |
| docker_desktop_for_windows — docker_desktop_for_windows |
Docker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/create dockerBackendV2 API by controlling the DataFolder parameter for DockerDesktop.vhdx, a similar issue to CVE-2022-31647. | 2023-04-27 | not yet calculated | CVE-2022-34292 MISC MISC |
| ibm — cloud_pak_for_data |
IBM Cloud Pak for Data 4.5 and 4.6 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product’s environment. IBM X-Force ID: 232034. | 2023-04-26 | not yet calculated | CVE-2022-36769 MISC MISC |
| solarwinds_platform — solarwinds_platform |
The SolarWinds Platform was susceptible to the Command Injection Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform admin account to execute arbitrary commands. | 2023-04-21 | not yet calculated | CVE-2022-36963 MISC MISC |
| docker_desktop_for_windows — docker_desktop_for_windows |
Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontainers/start API by controlling the pidfile field inside the DaemonJSON field in the WindowsContainerStartRequest class. This can indirectly lead to privilege escalation. | 2023-04-27 | not yet calculated | CVE-2022-37326 MISC MISC |
| sage_300 — sage_300 |
On versions of Sage 300 2017 – 2022 (6.4.x – 6.9.x) which are setup in a “Windows Peer-to-Peer Network” or “Client Server Network” configuration, a low-privileged Sage 300 workstation user could abuse their access to the “SharedData” folder on the connected Sage 300 server to view and/or modify the credentials associated with Sage 300 users and SQL accounts to impersonate users and/or access the SQL database as a system administrator. With system administrator-level access to the Sage 300 MS SQL database it would be possible to create, update, and delete all records associated with the program and, depending on the configuration, execute code on the underlying database server. | 2023-04-28 | not yet calculated | CVE-2022-38583 MISC MISC |
| docker — desktop |
Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by controlling the data-root field inside the DaemonJSON field in the WindowsContainerStartRequest class. This allows exploiting a symlink vulnerability in ..dataRootnetworkfileslocal-kv.db because of a TOCTOU race condition. | 2023-04-27 | not yet calculated | CVE-2022-38730 MISC MISC |
| fighting_cock_information_system — fighting_cock_information_system |
An issue was discovered in Fighting Cock Information System 1.0, which uses default credentials, but does not force nor prompt the administrators to change the credentials. | 2023-04-26 | not yet calculated | CVE-2022-39989 MISC MISC MISC |
| laravel — laravel |
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the IlluminateAuthSessionGuard class when a user is found to not exist. | 2023-04-25 | not yet calculated | CVE-2022-40482 CONFIRM CONFIRM MISC MISC |
| pingidentity — multiple_products |
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA. | 2023-04-25 | not yet calculated | CVE-2022-40722 MISC MISC |
| pingidentity — radius |
The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations. | 2023-04-25 | not yet calculated | CVE-2022-40723 MISC |
| pingidentity — pingfederate |
The PingFederate Local Identity Profiles ‘/pf/idprofile.ping’ endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests. | 2023-04-25 | not yet calculated | CVE-2022-40724 MISC |
| pingidentity — desktop |
PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before the time-based lockout is activated. | 2023-04-25 | not yet calculated | CVE-2022-40725 MISC |
| sage — 300 |
The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key (“LandlordPassKey”) to encrypt and decrypt secrets stored in configuration files and in database tables. | 2023-04-28 | not yet calculated | CVE-2022-41397 MISC |
| sage — 300 |
The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information. | 2023-04-28 | not yet calculated | CVE-2022-41398 MISC |
| sage — 300 |
The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key (“PASS_KEY”) to encrypt and decrypt the database connection string for the PORTAL database found in the “dbconfig.xml”. This issue could allow attackers to obtain access to the SQL database. | 2023-04-28 | not yet calculated | CVE-2022-41399 MISC |
| sage — 300 |
Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in the shared data directory. This issue could allow attackers to decrypt user passwords and SQL connection strings. | 2023-04-28 | not yet calculated | CVE-2022-41400 MISC |
| wordpress — wordpress |
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Shareaholic Similar Posts plugin <= 3.1.6 versions. | 2023-04-24 | not yet calculated | CVE-2022-41612 MISC |
| ibm — spectrum_scale |
IBM Spectrum Scale Container Native Storage Access 5.1.2.1 through 5.1.6.0 contains an unspecified vulnerability that could allow a local user to obtain root privileges. IBM X-Force ID: 237810. | 2023-04-29 | not yet calculated | CVE-2022-41736 MISC MISC |
| ibm — spectrum_scale |
IBM Spectrum Scale (IBM Spectrum Scale Container Native Storage Access 5.1.2.1 through 5.1.6.0) could allow programs running inside the container to overcome isolation mechanism and gain additional capabilities or access sensitive information on the host. IBM X-Force ID: 237815. | 2023-04-26 | not yet calculated | CVE-2022-41739 MISC MISC |
| xen — x86 |
x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control. | 2023-04-25 | not yet calculated | CVE-2022-42335 MISC CONFIRM MLIST FEDORA |
| ibm — financial_transaction_manager |
IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 239707. | 2023-04-29 | not yet calculated | CVE-2022-43871 MISC MISC |
| ming — libming |
libming 0.4.8 0.4.8 is vulnerable to Buffer Overflow. In getInt() in decompile.c unknown type may lead to denial of service. This is a different vulnerability than CVE-2018-9132 and CVE-2018-20427. | 2023-04-26 | not yet calculated | CVE-2022-44232 MISC |
| wordpress — wordpress |
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Softaculous Loginizer plugin <= 1.7.5 versions. | 2023-04-24 | not yet calculated | CVE-2022-45084 MISC |
| pws_dashboard — pws_dashboard |
PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by injecting PHP code into settings.php. Attacks can use the PWS_printfile.php, PWS_frame_text.php, PWS_listfile.php, PWS_winter.php, and PWS_easyweathersetup.php endpoints. A contributing factor is a hardcoded login password of support, which is not documented. (This is not the same as the documented setup password, which is 12345.) The issue was fixed in late 2022. | 2023-04-25 | not yet calculated | CVE-2022-45291 MISC MISC |
| acronis — agent |
Denial of service due to unauthenticated API endpoint. The following products are affected: Acronis Agent (Windows, macOS, Linux) before build 30161. | 2023-04-26 | not yet calculated | CVE-2022-45456 MISC |
| visam — vbase |
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. | 2023-04-26 | not yet calculated | CVE-2022-45876 MISC MISC MISC |
| wordpress — wordpress |
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pakpobox alfred24 Click & Collect plugin <= 1.1.7 versions. | 2023-04-24 | not yet calculated | CVE-2022-47158 MISC |
| solarwinds — platform |
The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a valid system user account to escalate local privileges. | 2023-04-21 | not yet calculated | CVE-2022-47505 MISC MISC |
| solarwinds — platform |
The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML. | 2023-04-21 | not yet calculated | CVE-2022-47509 MISC MISC |
| wordpress — wordpress |
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Plugins Pro WP Super Popup plugin <= 1.1.2 versions. | 2023-04-24 | not yet calculated | CVE-2022-47598 MISC |
| nanoleaf — firmware |
Nanoleaf firmware v7.1.1 and below is missing an SSL certificate, allowing attackers to execute arbitrary code via a DHCP hijacking attack. | 2023-04-27 | not yet calculated | CVE-2022-47758 MISC MISC |
| Io.finnet — tss-lib |
An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session id, context, or random nonce in the generation of the challenge. This could allow a malicious user or an eavesdropper to replay a valid proof sent in the past. | 2023-04-21 | not yet calculated | CVE-2022-47930 MISC MISC |
| shopware — shopware |
Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI. | 2023-04-21 | not yet calculated | CVE-2022-48150 MISC |
| jetbrains — ktor |
In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible | 2023-04-24 | not yet calculated | CVE-2022-48476 MISC |
| jetbrains — hub |
In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing | 2023-04-24 | not yet calculated | CVE-2022-48477 MISC |
| jetbrains — toolbox |
In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible | 2023-04-28 | not yet calculated | CVE-2022-48481 MISC |
| linux — kernel |
The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall. The patch that added the support for the conditional mitigation via prctl (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit a664ec9158eeddd75121d39c9a0758016097fa96 | 2023-04-25 | not yet calculated | CVE-2023-0045 MISC |
| nvidia — gpu_display_driver |
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler which may lead to denial of service, escalation of privileges, information disclosure, and data tampering. | 2023-04-22 | not yet calculated | CVE-2023-0184 MISC |
| nvidia — gpu_display_driver |
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a NULL pointer dereference may lead to denial of service. | 2023-04-22 | not yet calculated | CVE-2023-0190 MISC |
| nvidia — gpu_display_driver |
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds write can lead to denial of service and data tampering. | 2023-04-22 | not yet calculated | CVE-2023-0199 MISC |
| nvidia — dgx_a100_sbios |
NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the GenericSio and LegacySmmSredir SMM APIs. A successful exploit of this vulnerability may lead to denial of service, escalation of privileges, and information disclosure. | 2023-04-22 | not yet calculated | CVE-2023-0202 MISC |
| nvidia — connectx |
NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service. | 2023-04-22 | not yet calculated | CVE-2023-0203 MISC |
| nvidia — connectx |
NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can cause improper handling of exceptional conditions, which may lead to denial of service. | 2023-04-22 | not yet calculated | CVE-2023-0204 MISC |
| nvidia — connectx |
NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service. | 2023-04-22 | not yet calculated | CVE-2023-0205 MISC |
| nvidia — dgx_a100_sbios |
NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the NVME SMM API. A successful exploit of this vulnerability may lead to denial of service, escalation of privileges, and information disclosure. | 2023-04-22 | not yet calculated | CVE-2023-0206 MISC |
| wordpress — wordpress |
The Weaver Xtreme Theme Support WordPress plugin before 6.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | 2023-04-24 | not yet calculated | CVE-2023-0276 MISC |
| wordpress — wordpress |
The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers. | 2023-04-24 | not yet calculated | CVE-2023-0388 MISC |
| wordpress — wordpress |
The Video Central for WordPress plugin through 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | 2023-04-24 | not yet calculated | CVE-2023-0418 MISC |
| wordpress — wordpress |
The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping in some parameters, allowing attackers to make a logged in admin put Stored Cross-Site Scripting payloads via CSRF | 2023-04-24 | not yet calculated | CVE-2023-0420 MISC |
| wordpress — wordpress |
The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks | 2023-04-24 | not yet calculated | CVE-2023-0424 MISC |
| linux — kernel |
A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the ‘rlim’ variable and can be used to leak the contents. We recommend upgrading past version 6.1.8 or commit 739790605705ddcf18f21782b9c99ad7d53a8c11 | 2023-04-26 | not yet calculated | CVE-2023-0458 MISC MISC |
| hypr — workforce_access |
Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on MacOS allows Privilege Escalation.This issue affects Workforce Access: from 6.12 before 8.1. | 2023-04-28 | not yet calculated | CVE-2023-0834 MISC |
| wordpress — wordpress |
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before outputting it back in the Shoutbox, leading to Stored Cross-Site Scripting which could be used against high privilege users such as admins. | 2023-04-24 | not yet calculated | CVE-2023-0899 MISC |
| wordpress — wordpress |
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. | 2023-04-24 | not yet calculated | CVE-2023-1020 MISC |
| wordpress — wordpress |
The WP FEvents Book WordPress plugin through 0.46 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Cross-Site Scripting attacks | 2023-04-24 | not yet calculated | CVE-2023-1126 MISC |
| wordpress — wordpress |
The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users. | 2023-04-24 | not yet calculated | CVE-2023-1129 MISC |
| wordpress — wordpress |
The Easy Forms for Mailchimp WordPress plugin before 6.8.8 does not sanitise and escape some parameters before outputting them back in the response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | 2023-04-24 | not yet calculated | CVE-2023-1324 MISC |
| grafana — grafana |
Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the “url_login” configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana. | 2023-04-26 | not yet calculated | CVE-2023-1387 MISC MISC |
| wordpress — wordpress |
The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours | 2023-04-24 | not yet calculated | CVE-2023-1414 MISC |
| wordpress — wordpress |
The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape a parameter before outputting it back in a response of an AJAX action, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | 2023-04-24 | not yet calculated | CVE-2023-1420 MISC |
| wordpress — wordpress |
The Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape various parameters before outputting them back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | 2023-04-24 | not yet calculated | CVE-2023-1435 MISC |
| hypr — keycloak_authenticator |
Improper Authentication vulnerability in HYPR Keycloak Authenticator Extension allows Authentication Abuse.This issue affects HYPR Keycloak Authenticator Extension: before 7.10.2, before 8.0.3. | 2023-04-28 | not yet calculated | CVE-2023-1477 MISC |
| hp — multiple_products |
Certain DesignJet and PageWide XL TAA compliant models may have risk of potential information disclosure if the hard disk drive is physically removed from the printer. | 2023-04-28 | not yet calculated | CVE-2023-1526 MISC |
| wordpress — wordpress |
The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such information to an arbitrary email address via a CSRF attack. | 2023-04-24 | not yet calculated | CVE-2023-1623 MISC |
| wordpress — wordpress |
The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcode_activate_snippets capability delete arbitrary log files on the server, including outside of the blog folders | 2023-04-24 | not yet calculated | CVE-2023-1624 MISC |
| gajshield — data_security_firewall |
This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default credentials which allows remote attacker to login as superuser by using default username/password via web-based management interface and/or exposed SSH port thereby enabling remote attackers to execute arbitrary commands with administrative/superuser privileges on the targeted systems. The vulnerability has been addressed by forcing the user to change their default password to a new non-default password. | 2023-04-27 | not yet calculated | CVE-2023-1778 MISC |
| canonical — cloud_init |
Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege. | 2023-04-26 | not yet calculated | CVE-2023-1786 MISC MISC MISC |
| sidekiq — sidekiq |
Cross-site Scripting (XSS) – Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8. | 2023-04-21 | not yet calculated | CVE-2023-1892 MISC CONFIRM |
| illumina — universal_copy_service | Instruments with Illumina Universal Copy Service v1.x and v2.x contain an unnecessary privileges vulnerability. An unauthenticated malicious actor could upload and execute code remotely at the operating system level, which could allow an attacker to change settings, configurations, software, or access sensitive data on the affected product. | 2023-04-28 | not yet calculated | CVE-2023-1966 MISC MISC |
| keysight — n8844a_data_analytics_web_service |
Keysight N8844A Data Analytics Web Service deserializes untrusted data without sufficiently verifying the resulting data will be valid. | 2023-04-27 | not yet calculated | CVE-2023-1967 MISC |
| illumina — universal_copy_service |
Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications. | 2023-04-28 | not yet calculated | CVE-2023-1968 MISC MISC |
| linux — kernel |
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons, which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target injection against which STIBP protects. | 2023-04-21 | not yet calculated | CVE-2023-1998 MISC MISC MISC |
| linux — kernel |
A race condition was found in the Linux kernel’s RxRPC network protocol, within the processing of RxRPC bundles. This issue results from the lack of proper locking when performing operations on an object. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel. | 2023-04-24 | not yet calculated | CVE-2023-2006 MISC MISC MISC |
| linux — dpt_I2O_controller_driver |
The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. | 2023-04-24 | not yet calculated | CVE-2023-2007 MISC |
| linux — kernel |
A flaw was found in the Linux kernel’s netdevsim device driver, within the scheduling of events. This issue results from the improper management of a reference count. This may allow an attacker to create a denial of service condition on the system. | 2023-04-24 | not yet calculated | CVE-2023-2019 MISC MISC MISC |
| vmware — multiple_products |
VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine. | 2023-04-25 | not yet calculated | CVE-2023-20869 MISC |
| vmware — multiple_products |
VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine. | 2023-04-25 | not yet calculated | CVE-2023-20870 MISC |
| vmware — fusion |
VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host operating system can elevate privileges to gain root access to the host operating system. | 2023-04-25 | not yet calculated | CVE-2023-20871 MISC |
| vmware — multiple_products |
VMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device emulation. | 2023-04-25 | not yet calculated | CVE-2023-20872 MISC |
| dassault — delmia_apriso |
A reflected Cross-site Scripting (XSS) Vulnerability in DELMIA Apriso Release 2017 through Release 2022 allows an attacker to execute arbitrary script code. | 2023-04-21 | not yet calculated | CVE-2023-2139 MISC |
| dassault systèmes — delmia_apriso |
A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022 could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application. | 2023-04-21 | not yet calculated | CVE-2023-2140 MISC |
| dassault systèmes — delmia_apriso |
An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution. | 2023-04-21 | not yet calculated | CVE-2023-2141 MISC |
| dassault systèmes — delmia_apriso |
Code Dx versions prior to 2023.4.2 are vulnerable to user impersonation attack where a malicious actor is able to gain access to another user’s account by crafting a custom “Remember Me” token. This is possible due to the use of a hard-coded cipher which was used when generating the token. A malicious actor who creates this token can supply it to a separate Code Dx system, provided they know the username they want to impersonate, and impersonate the user. Score 6.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C | 2023-04-27 | not yet calculated | CVE-2023-2158 MISC |
| synopsys — code_dx |
Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3. | 2023-04-21 | not yet calculated | CVE-2023-2202 MISC CONFIRM |
| rosariosis — rosariosis |
A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file faqs.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226969 was assigned to this vulnerability. | 2023-04-21 | not yet calculated | CVE-2023-2204 MISC MISC MISC |
| campcodes — retro_basketball_shoes_online_store |
A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /function/login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-226970 is the identifier assigned to this vulnerability. | 2023-04-21 | not yet calculated | CVE-2023-2205 MISC MISC MISC |
| campcodes — retro_basketball_shoes_online_store |
A vulnerability classified as critical has been found in Campcodes Retro Basketball Shoes Online Store 1.0. This affects an unknown part of the file contactus.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226971. | 2023-04-21 | not yet calculated | CVE-2023-2206 MISC MISC MISC |
| campcodes — retro_basketball_shoes_online_store |
A vulnerability classified as critical was found in Campcodes Retro Basketball Shoes Online Store 1.0. This vulnerability affects unknown code of the file contactus1.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226972. | 2023-04-21 | not yet calculated | CVE-2023-2207 MISC MISC MISC |
| campcodes — retro_basketball_shoes_online_store |
A vulnerability, which was classified as critical, has been found in Campcodes Retro Basketball Shoes Online Store 1.0. This issue affects some unknown processing of the file details.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226973 was assigned to this vulnerability. | 2023-04-21 | not yet calculated | CVE-2023-2208 MISC MISC MISC |
| campcodes — retro_basketball_shoes_online_store |
A vulnerability, which was classified as critical, was found in Campcodes Coffee Shop POS System 1.0. Affected is an unknown function of the file /admin/sales/view_details.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226974 is the identifier assigned to this vulnerability. | 2023-04-21 | not yet calculated | CVE-2023-2209 MISC MISC MISC |
| campcodes — coffee_shop_pos_system |
A vulnerability has been found in Campcodes Coffee Shop POS System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/categories/view_category.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226975. | 2023-04-21 | not yet calculated | CVE-2023-2210 MISC MISC MISC |
| campcodes — coffee_shop_pos_system |
A vulnerability was found in Campcodes Coffee Shop POS System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/categories/manage_category.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226976. | 2023-04-21 | not yet calculated | CVE-2023-2211 MISC MISC MISC |
| campcodes — coffee_shop_pos_system |
A vulnerability was found in Campcodes Coffee Shop POS System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/products/view_product.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226977 was assigned to this vulnerability. | 2023-04-21 | not yet calculated | CVE-2023-2212 MISC MISC MISC |
| campcodes — coffee_shop_pos_system |
A vulnerability was found in Campcodes Coffee Shop POS System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/products/manage_product.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-226978 is the identifier assigned to this vulnerability. | 2023-04-21 | not yet calculated | CVE-2023-2213 MISC MISC MISC |
| campcodes — coffee_shop_pos_system |
A vulnerability was found in Campcodes Coffee Shop POS System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/sales/manage_sale.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226979. | 2023-04-21 | not yet calculated | CVE-2023-2214 MISC MISC MISC |
| campcodes — coffee_shop_pos_system |
A vulnerability classified as critical has been found in Campcodes Coffee Shop POS System 1.0. Affected is an unknown function of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226980. | 2023-04-21 | not yet calculated | CVE-2023-2215 MISC MISC MISC |
| campcodes — coffee_shop_pos_system |
A vulnerability classified as problematic was found in Campcodes Coffee Shop POS System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php. The manipulation of the argument firstname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226981 was assigned to this vulnerability. | 2023-04-21 | not yet calculated | CVE-2023-2216 MISC MISC MISC |
| sourcecodester — task_reminder_system |
A vulnerability, which was classified as critical, was found in SourceCodester Task Reminder System 1.0. This affects an unknown part of the file /admin/reminders/manage_reminder.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226983. | 2023-04-21 | not yet calculated | CVE-2023-2217 MISC MISC MISC |
| sourcecodester — task_reminder_system |
A vulnerability has been found in SourceCodester Task Reminder System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226984. | 2023-04-21 | not yet calculated | CVE-2023-2218 MISC MISC MISC |
| sourcecodester — task_reminder_system |
A vulnerability was found in SourceCodester Task Reminder System 1.0 and classified as problematic. This issue affects some unknown processing of the file /classes/Users.php. The manipulation of the argument id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226985 was assigned to this vulnerability. | 2023-04-21 | not yet calculated | CVE-2023-2219 MISC MISC MISC |
| dream_technology — mica |
A vulnerability was found in Dream Technology mica up to 3.0.5. It has been classified as problematic. Affected is an unknown function of the component Form Object Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-226986 is the identifier assigned to this vulnerability. | 2023-04-21 | not yet calculated | CVE-2023-2220 MISC MISC MISC |
| rapid7 — velociraptor |
Due to insufficient validation in the PE and OLE parsers in Rapid7’s Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during parsing of maliciously malformed files. For this attack to succeed, the attacker needs to be able to introduce malicious files to the system at the same time that Velociraptor attempts to collect any artifacts that attempt to parse PE files, Authenticode signatures, or OLE files. After crashing, the Velociraptor service will restart and it will still be possible to collect other artifacts. | 2023-04-21 | not yet calculated | CVE-2023-2226 MISC |
| modoboa — modoboa |
Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. | 2023-04-21 | not yet calculated | CVE-2023-2227 MISC CONFIRM |
| modoboa — modoboa |
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0. | 2023-04-21 | not yet calculated | CVE-2023-2228 CONFIRM MISC |
| maxtech — max_g866ac |
A vulnerability, which was classified as critical, was found in MAXTECH MAX-G866ac 0.4.1_TBRO_20160314. This affects an unknown part of the component Remote Management. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227001 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-21 | not yet calculated | CVE-2023-2231 MISC MISC MISC |
| microweber — microweber |
Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4. | 2023-04-22 | not yet calculated | CVE-2023-2240 CONFIRM MISC |
| sourcecodester — online_computer_and_laptop_store |
A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component GET Parameter Handler. The manipulation of the argument c/s leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227227. | 2023-04-22 | not yet calculated | CVE-2023-2242 MISC MISC MISC |
| sourcecodester — complaint_management_system |
A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file users/registration.php of the component POST Parameter Handler. The manipulation of the argument fullname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227228. | 2023-04-22 | not yet calculated | CVE-2023-2243 MISC MISC MISC |
| hansuncms — hansuncms |
A vulnerability was found in hansunCMS 1.4.3. It has been declared as critical. This vulnerability affects unknown code of the file /ueditor/net/controller.ashx?action=catchimage. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227230 is the identifier assigned to this vulnerability. | 2023-04-22 | not yet calculated | CVE-2023-2245 MISC MISC MISC |
| hansuncms — hansuncms |
A flaw was found in the Open Cluster Management (OCM) when a user have access to the worker nodes which has the cluster-manager-registration-controller or cluster-manager deployments. A malicious user can take advantage of this and bind the cluster-admin to any service account or using the service account to list all secrets for all kubernetes namespaces, leading into a cluster-level privilege escalation. | 2023-04-24 | not yet calculated | CVE-2023-2250 MISC |
| eemeli — eemeli_yaml |
Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-4. | 2023-04-24 | not yet calculated | CVE-2023-2251 MISC CONFIRM |
| devolutions — workspace_desktop |
Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented “Force Login” security feature. This vulnerability occurs only if “Force Login” feature is enabled on the Hub Business instance and that an attacker has access to a locked Workspace desktop application configured with a Hub Business space. | 2023-04-24 | not yet calculated | CVE-2023-2257 MISC |
| cern — white_rabbit_switch |
Within White Rabbit Switch it’s possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP community strings. | 2023-04-24 | not yet calculated | CVE-2023-22577 MISC MISC |
| alf.io — alfio_event |
Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304. | 2023-04-24 | not yet calculated | CVE-2023-2258 CONFIRM MISC |
| cern — white_rabbit_switch |
White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application (the default installation makes the webserver run as the root user). | 2023-04-24 | not yet calculated | CVE-2023-22581 MISC MISC |
| alf.io — alfio_event |
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304. | 2023-04-24 | not yet calculated | CVE-2023-2259 CONFIRM MISC |
| alf.io — alfio_event |
Improper Authorization of Index Containing Sensitive Information in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304. | 2023-04-24 | not yet calculated | CVE-2023-2260 MISC CONFIRM |
| apache_software_foundation — apache_jena |
There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query. | 2023-04-25 | not yet calculated | CVE-2023-22665 MISC |
| trinitronic — nice_paypal_button_lite |
Cross-Site Request Forgery (CSRF) vulnerability in TriniTronic Nice PayPal Button Lite plugin <= 1.3.5 versions. | 2023-04-23 | not yet calculated | CVE-2023-22686 MISC |
| linux — kernel |
A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component. | 2023-04-25 | not yet calculated | CVE-2023-2269 MISC |
| silverstripe — silverstripe_framework |
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue. | 2023-04-26 | not yet calculated | CVE-2023-22728 MISC MISC |
| silverstripe — silverstripe_framework |
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, an attacker can display a link to a third party website on a login screen by convincing a legitimate content author to follow a specially crafted link. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue. | 2023-04-26 | not yet calculated | CVE-2023-22729 MISC MISC |
| rapid7 — insight_agent |
Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This can result in a Path Traversal vulnerability and allow an attacker to write arbitrary files. This issue is remediated in version 3.3.0 via safe guards that reject inputs that attempt to do path traversal. | 2023-04-26 | not yet calculated | CVE-2023-2273 MISC |
| mattermost — mattermost |
When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team. | 2023-04-25 | not yet calculated | CVE-2023-2281 MISC |
| devolutions — remote_desktop_manager |
Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticated user to bypass administrator-enforced Web Login restrictions and gain access to entries via an unexpected vector. | 2023-04-25 | not yet calculated | CVE-2023-2282 MISC |
| postgresql — zoho_manageengine_multiple_products |
Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permissions from that of a low-privileged user to an Administrative user. | 2023-04-26 | not yet calculated | CVE-2023-2291 MISC |
| zyxel — usg_flex_series_firmware |
A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker to modify device configuration data, resulting in denial-of-service (DoS) conditions on an affected device. | 2023-04-24 | not yet calculated | CVE-2023-22913 CONFIRM |
| zyxel — usg_flex_series_firmware |
A path traversal vulnerability in the “account_print.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker with administrator privileges to execute unauthorized OS commands in the “tmp” directory by uploading a crafted file if the hotspot function were enabled. | 2023-04-24 | not yet calculated | CVE-2023-22914 CONFIRM |
| zyxel — usg_flex_series_firmware |
A buffer overflow vulnerability in the “fbwifi_forward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.30 through 5.35, USG20(W)-VPN firmware versions 4.30 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote unauthenticated attacker to cause DoS conditions by sending a crafted HTTP request if the Facebook WiFi function were enabled on an affected device. | 2023-04-24 | not yet calculated | CVE-2023-22915 CONFIRM |
| zyxel — atp_series_firmware |
The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware versions 5.10 through 5.35, USG20(W)-VPN firmware versions 5.10 through 5.35, and VPN series firmware versions 5.00 through 5.35, which fails to properly sanitize user input. A remote unauthenticated attacker could leverage the vulnerability to modify device configuration data, resulting in DoS conditions on an affected device if the attacker could trick an authorized administrator to switch the management mode to the cloud mode. | 2023-04-24 | not yet calculated | CVE-2023-22916 CONFIRM |
| zyxel — atp_series_firmware |
A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through 5.32, USG20(W)-VPN firmware versions 5.10 through 5.32, and VPN series firmware versions 5.00 through 5.35, which could allow a remote unauthenticated attacker to cause a core dump with a request error message on a vulnerable device by uploading a crafted configuration file. | 2023-04-24 | not yet calculated | CVE-2023-22917 CONFIRM |
| zyxel — atp_series_firmware |
A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, VPN series firmware versions 4.30 through 5.35, NWA110AX firmware version 6.50(ABTG.2) and earlier versions, WAC500 firmware version 6.50(ABVS.0) and earlier versions, and WAX510D firmware version 6.50(ABTF.2) and earlier versions, which could allow a remote authenticated attacker to retrieve encrypted information of the administrator on an affected device. | 2023-04-24 | not yet calculated | CVE-2023-22918 CONFIRM |
| sourcecodester — purchase_order_management_system |
A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been classified as problematic. This affects an unknown part of the file classes/Master.php?f=save_item. The manipulation of the argument description with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227463. | 2023-04-25 | not yet calculated | CVE-2023-2293 MISC MISC MISC |
| ucms — ucms |
A vulnerability was found in UCMS 1.6.0. It has been classified as problematic. This affects an unknown part of the file saddpost.php of the component Column Configuration. The manipulation of the argument strorder leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227481 was assigned to this vulnerability. | 2023-04-26 | not yet calculated | CVE-2023-2294 MISC MISC MISC |
| wordpress — wordpress |
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (wppb_front_end_password_recovery). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-0814, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability. | 2023-04-27 | not yet calculated | CVE-2023-2297 MISC MISC MISC MISC |
| builderio — qwik |
Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0. | 2023-04-26 | not yet calculated | CVE-2023-2307 MISC CONFIRM |
| pimcore — pimcore |
Cross-site Scripting (XSS) – Stored in GitHub repository pimcore/pimcore prior to 10.5.21. | 2023-04-27 | not yet calculated | CVE-2023-2322 MISC CONFIRM |
| pimcore — pimcore |
Cross-site Scripting (XSS) – Stored in GitHub repository pimcore/pimcore prior to 10.5.21. | 2023-04-27 | not yet calculated | CVE-2023-2323 CONFIRM MISC |
| pimcore — pimcore |
Cross-site Scripting (XSS) – Stored in GitHub repository pimcore/pimcore prior to 10.5.21. | 2023-04-27 | not yet calculated | CVE-2023-2327 MISC CONFIRM |
| pimcore — pimcore |
Cross-site Scripting (XSS) – Generic in GitHub repository pimcore/pimcore prior to 10.5.21. | 2023-04-27 | not yet calculated | CVE-2023-2328 CONFIRM MISC |
| pimcore — pimcore |
Unquoted service Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows application will allows to insert arbitrary code into the service. This issue affects Surelock Windows : from 2.3.12 through 2.40.0. | 2023-04-27 | not yet calculated | CVE-2023-2331 MISC |
| pimcore — pimcore |
Plaintext Password in Registry vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve Admin user credentials This issue affects surelock windows: from 2.3.12 through 2.40.0. | 2023-04-27 | not yet calculated | CVE-2023-2335 MISC |
| pimcore — pimcore |
Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21. | 2023-04-27 | not yet calculated | CVE-2023-2336 MISC CONFIRM |
| pimcore — pimcore |
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21. | 2023-04-27 | not yet calculated | CVE-2023-2338 CONFIRM MISC |
| pimcore — pimcore |
Cross-site Scripting (XSS) – Reflected in GitHub repository pimcore/pimcore prior to 10.5.21. | 2023-04-27 | not yet calculated | CVE-2023-2339 CONFIRM MISC |
| pimcore — pimcore |
Cross-site Scripting (XSS) – Stored in GitHub repository pimcore/pimcore prior to 10.5.21. | 2023-04-27 | not yet calculated | CVE-2023-2340 MISC CONFIRM |
| pimcore — pimcore |
Cross-site Scripting (XSS) – Generic in GitHub repository pimcore/pimcore prior to 10.5.21. | 2023-04-27 | not yet calculated | CVE-2023-2341 MISC CONFIRM |
| pimcore — pimcore |
Cross-site Scripting (XSS) – Reflected in GitHub repository pimcore/pimcore prior to 10.5.21. | 2023-04-27 | not yet calculated | CVE-2023-2342 CONFIRM MISC |
| pimcore — pimcore |
Cross-site Scripting (XSS) – DOM in GitHub repository pimcore/pimcore prior to 10.5.21. | 2023-04-27 | not yet calculated | CVE-2023-2343 MISC CONFIRM |
| sourcecodester — service_provider_management_system |
A vulnerability has been found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=save_service of the component HTTP POST Request Handler. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227587. | 2023-04-27 | not yet calculated | CVE-2023-2344 MISC MISC MISC |
| sourcecodester — service_provider_management_system |
A vulnerability was found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_inquiry. The manipulation leads to improper authorization. The attack may be launched remotely. The identifier of this vulnerability is VDB-227588. | 2023-04-27 | not yet calculated | CVE-2023-2345 MISC MISC |
| sourcecodester — service_provider_management_system |
A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227589 was assigned to this vulnerability. | 2023-04-27 | not yet calculated | CVE-2023-2346 MISC MISC MISC |
| sourcecodester — service_provider_management_system |
A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/services/manage_service.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227590 is the identifier assigned to this vulnerability. | 2023-04-27 | not yet calculated | CVE-2023-2347 MISC MISC MISC |
| sourcecodester — service_provider_management_system |
A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227591. | 2023-04-27 | not yet calculated | CVE-2023-2348 MISC MISC MISC |
| sourcecodester — service_provider_management_system |
A vulnerability classified as problematic has been found in SourceCodester Service Provider Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument page leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227592. | 2023-04-27 | not yet calculated | CVE-2023-2349 MISC MISC MISC |
| sourcecodester — service_provider_management_system |
A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227593 was assigned to this vulnerability. | 2023-04-27 | not yet calculated | CVE-2023-2350 MISC MISC MISC |
| acronis — snap_deploy |
Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3900. | 2023-04-27 | not yet calculated | CVE-2023-2355 MISC |
| mlflow — mlflow |
Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1. | 2023-04-28 | not yet calculated | CVE-2023-2356 MISC CONFIRM |
| acronis — cyber_infrastructure |
Sensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.2.0-135. | 2023-04-28 | not yet calculated | CVE-2023-2360 MISC |
| pimcore — pimcore |
Cross-site Scripting (XSS) – Stored in GitHub repository pimcore/pimcore prior to 10.5.21. | 2023-04-28 | not yet calculated | CVE-2023-2361 CONFIRM MISC |
| sourcecodester — resort_reservation_system |
A vulnerability, which was classified as critical, has been found in SourceCodester Resort Reservation System 1.0. This issue affects some unknown processing of the file view_room.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227639. | 2023-04-28 | not yet calculated | CVE-2023-2363 MISC MISC MISC |
| sourcecodester — resort_reservation_system |
A vulnerability, which was classified as problematic, was found in SourceCodester Resort Reservation System 1.0. Affected is an unknown function of the file registration.php. The manipulation of the argument fullname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227640. | 2023-04-28 | not yet calculated | CVE-2023-2364 MISC MISC MISC |
| sourcecodester — faculty_evaluation_system |
A vulnerability has been found in SourceCodester Faculty Evaluation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file ajax.php?action=delete_subject. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227641 was assigned to this vulnerability. | 2023-04-28 | not yet calculated | CVE-2023-2365 MISC MISC MISC |
| sourcecodester — faculty_evaluation_system |
A vulnerability was found in SourceCodester Faculty Evaluation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file ajax.php?action=delete_class. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227642 is the identifier assigned to this vulnerability. | 2023-04-28 | not yet calculated | CVE-2023-2366 MISC MISC MISC |
| sourcecodester — faculty_evaluation_system |
A vulnerability was found in SourceCodester Faculty Evaluation System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/manage_academic.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227643. | 2023-04-28 | not yet calculated | CVE-2023-2367 MISC MISC MISC |
| sourcecodester — faculty_evaluation_system |
A vulnerability was found in SourceCodester Faculty Evaluation System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file index.php?page=manage_questionnaire. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227644. | 2023-04-28 | not yet calculated | CVE-2023-2368 MISC MISC MISC |
| sourcecodester — faculty_evaluation_system | A vulnerability was found in SourceCodester Faculty Evaluation System 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/manage_restriction.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227645 was assigned to this vulnerability. | 2023-04-28 | not yet calculated | CVE-2023-2369 MISC MISC MISC |
| sourcecodester — online_dj_management_ system |
A vulnerability classified as critical has been found in SourceCodester Online DJ Management System 1.0. Affected is an unknown function of the file admin/events/manage_event.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-227646 is the identifier assigned to this vulnerability. | 2023-04-28 | not yet calculated | CVE-2023-2370 MISC MISC MISC |
| sourcecodester — online_dj_management_system |
A vulnerability classified as critical was found in SourceCodester Online DJ Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/inquiries/view_details.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227647. | 2023-04-28 | not yet calculated | CVE-2023-2371 MISC MISC MISC |
| uniquiti — edgerouter_x |
A vulnerability, which was classified as problematic, has been found in SourceCodester Online DJ Management System 1.0. Affected by this issue is some unknown functionality of the file classes/Master.php?f=save_event. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227648. | 2023-04-28 | not yet calculated | CVE-2023-2372 MISC MISC MISC |
| uniquiti — edgerouter_x |
A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown part of the component Web Management Interface. The manipulation of the argument ecn-up leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227649 was assigned to this vulnerability. | 2023-04-28 | not yet calculated | CVE-2023-2373 MISC MISC MISC |
| uniquiti — edgerouter_x |
A vulnerability has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6 and classified as critical. This vulnerability affects unknown code of the component Web Management Interface. The manipulation of the argument ecn-down leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227650 is the identifier assigned to this vulnerability. | 2023-04-28 | not yet calculated | CVE-2023-2374 MISC MISC MISC |
| uniquiti — edgerouter_x |
A vulnerability was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6 and classified as critical. This issue affects some unknown processing of the component Web Management Interface. The manipulation of the argument src leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227651. | 2023-04-28 | not yet calculated | CVE-2023-2375 MISC MISC MISC |
| vi-solutions — visforms_base_package_for_joomla_3 |
The ‘Visforms Base Package for Joomla 3’ extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attacker can interact with the database and could be able to read, modify and delete data on it. | 2023-04-23 | not yet calculated | CVE-2023-23753 MISC MISC |
| uniquiti — edgerouter_x |
A vulnerability was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. It has been classified as critical. Affected is an unknown function of the component Web Management Interface. The manipulation of the argument dpi leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227652. | 2023-04-28 | not yet calculated | CVE-2023-2376 MISC MISC MISC |
| uniquiti — edgerouter_x |
A vulnerability was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Web Management Interface. The manipulation of the argument name leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227653 was assigned to this vulnerability. | 2023-04-28 | not yet calculated | CVE-2023-2377 MISC MISC MISC |
| uniquiti — edgerouter_x |
A vulnerability was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. It has been rated as critical. Affected by this issue is some unknown functionality of the component Web Management Interface. The manipulation of the argument suffix-rate-up leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227654 is the identifier assigned to this vulnerability. | 2023-04-28 | not yet calculated | CVE-2023-2378 MISC MISC MISC |
| uniquiti — edgerouter_x |
A vulnerability classified as critical has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown part of the component Web Service. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227655. | 2023-04-28 | not yet calculated | CVE-2023-2379 MISC MISC MISC |
| netgear — srx5308 |
A vulnerability, which was classified as problematic, was found in Netgear SRX5308 up to 4.3.5-3. Affected is an unknown function. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-227658 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2380 MISC MISC MISC |
| netgear — srx5308 |
A vulnerability has been found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file scgi-bin/platform.cgi?page=bandwidth_profile.htm of the component Web Management Interface. The manipulation of the argument BandWidthProfile.ProfileName leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227659. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2381 MISC MISC MISC |
| netgear — srx5308 |
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this issue is some unknown functionality of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument sysLogInfo.serverName leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227660. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2382 MISC MISC MISC |
| netgear — srx5308 |
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been classified as problematic. This affects an unknown part of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument smtpServer.fromAddr leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227661 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2383 MISC MISC MISC |
| solarwinds — database_performance_analyzer |
No exception handling vulnerability which revealed sensitive or excessive information to users. | 2023-04-25 | not yet calculated | CVE-2023-23837 MISC MISC |
| solarwinds — database_performance_analyzer |
Directory traversal and file enumeration vulnerability which allowed users to enumerate to different folders of the server. | 2023-04-25 | not yet calculated | CVE-2023-23838 MISC MISC |
| solarwinds — solarwinds_platform |
The SolarWinds Platform was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users to access Orion.WebCommunityStrings SWIS schema object and obtain sensitive information. | 2023-04-25 | not yet calculated | CVE-2023-23839 MISC MISC |
| netgear — srx5308 |
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been declared as problematic. This vulnerability affects unknown code of the file scgi-bin/platform.cgi?page=dmz_setup.htm of the component Web Management Interface. The manipulation of the argument dhcp.SecDnsIPByte2 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227662 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2384 MISC MISC MISC |
| netgear — srx5308 |
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been rated as problematic. This issue affects some unknown processing of the file scgi-bin/platform.cgi?page=ike_policies.htm of the component Web Management Interface. The manipulation of the argument IpsecIKEPolicy.IKEPolicyName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227663. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2385 MISC MISC MISC |
| netgear — srx5308 |
A vulnerability classified as problematic has been found in Netgear SRX5308 up to 4.3.5-3. Affected is an unknown function of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument smtpServer.toAddr leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227664. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2386 MISC MISC MISC |
| netgear — srx5308 |
A vulnerability classified as problematic was found in Netgear SRX5308 up to 4.3.5-3. Affected by this vulnerability is an unknown functionality of the file scgi-bin/platform.cgi?page=dmz_setup.htm of the component Web Management Interface. The manipulation of the argument winsServer1 leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227665 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2387 MISC MISC MISC |
| netgear — srx5308 |
A vulnerability, which was classified as problematic, has been found in Netgear SRX5308 up to 4.3.5-3. Affected by this issue is some unknown functionality of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument smtpServer.fromAddr leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227666 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2388 MISC MISC MISC |
| netgear — srx5308 |
A vulnerability, which was classified as problematic, was found in Netgear SRX5308 up to 4.3.5-3. This affects an unknown part of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument smtpServer.emailServer leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227667. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2389 MISC MISC MISC |
| jamie_poitra — m_chart |
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Jamie Poitra M Chart plugin <= 1.9.4 versions. | 2023-04-24 | not yet calculated | CVE-2023-23892 MISC |
| netgear — srx5308 |
A vulnerability has been found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. This vulnerability affects unknown code of the file scgi-bin/platform.cgi?page=time_zone.htm of the component Web Management Interface. The manipulation of the argument ntp.server1 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227668. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2390 MISC MISC MISC |
| netgear — srx5308 |
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. This issue affects some unknown processing of the file scgi-bin/platform.cgi?page=time_zone.htm of the component Web Management Interface. The manipulation of the argument ntp.server2 leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227669 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2391 MISC MISC MISC |
| netgear — srx5308 |
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been classified as problematic. Affected is an unknown function of the file scgi-bin/platform.cgi?page=time_zone.htm of the component Web Management Interface. The manipulation of the argument ManualDate.minutes leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-227670 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2392 MISC MISC MISC |
| netgear – srx5308 |
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file scgi-bin/platform.cgi?page=dmz_setup.htm of the component Web Management Interface. The manipulation of the argument ConfigPort.LogicalIfName leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227671. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2393 MISC MISC MISC |
| netgear – srx5308 |
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Web Management Interface. The manipulation of the argument wanName leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227672. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2394 MISC MISC MISC |
| netgear – srx5308 |
A vulnerability classified as problematic has been found in Netgear SRX5308 up to 4.3.5-3. This affects an unknown part of the component Web Management Interface. The manipulation of the argument Login.userAgent leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227673 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2395 MISC MISC MISC |
| netgear – srx5308 |
A vulnerability classified as problematic was found in Netgear SRX5308 up to 4.3.5-3. This vulnerability affects unknown code of the component Web Management Interface. The manipulation of the argument USERDBUsers.Password leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227674 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-28 | not yet calculated | CVE-2023-2396 MISC MISC MISC |
| sourcecodester — simple_mobile_comparison_website |
A vulnerability, which was classified as problematic, has been found in SourceCodester Simple Mobile Comparison Website 1.0. This issue affects some unknown processing of the file classes/Master.php?f=save_field. The manipulation of the argument Field Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227675. | 2023-04-28 | not yet calculated | CVE-2023-2397 MISC MISC MISC |
| sourcecodester — ac_repair_and_services_system |
A vulnerability, which was classified as critical, has been found in SourceCodester AC Repair and Services System 1.0. Affected by this issue is some unknown functionality of the file services/view.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227702 is the identifier assigned to this vulnerability. | 2023-04-28 | not yet calculated | CVE-2023-2408 MISC MISC MISC |
| sourcecodester — ac_repair_and_services_system |
A vulnerability, which was classified as critical, was found in SourceCodester AC Repair and Services System 1.0. This affects an unknown part of the file /admin/services/view_service.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227703. | 2023-04-28 | not yet calculated | CVE-2023-2409 MISC MISC MISC |
| sourcecodester — ac_repair_and_services_system |
A vulnerability has been found in SourceCodester AC Repair and Services System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/bookings/view_booking.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227704. | 2023-04-28 | not yet calculated | CVE-2023-2410 MISC MISC MISC |
| sourcecodester — ac_repair_and_services_system |
A vulnerability was found in SourceCodester AC Repair and Services System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227705 was assigned to this vulnerability. | 2023-04-28 | not yet calculated | CVE-2023-2411 MISC MISC MISC |
| sourcecodester — ac_repair_and_services_system |
A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-227706 is the identifier assigned to this vulnerability. | 2023-04-29 | not yet calculated | CVE-2023-2412 MISC MISC MISC |
| sourcecodester — ac_repair_and_services_system |
A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/bookings/manage_booking.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227707. | 2023-04-29 | not yet calculated | CVE-2023-2413 MISC MISC MISC |
| ks-soft — advanced_host_monitor |
A vulnerability was found in ks-soft Advanced Host Monitor up to 12.56 and classified as problematic. Affected by this issue is some unknown functionality of the file C:Program Files (x86)HostMonitorRMA-Winrma_active.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local host. Upgrading to version 12.60 is able to address this issue. It is recommended to upgrade the affected component. VDB-227714 is the identifier assigned to this vulnerability. | 2023-04-29 | not yet calculated | CVE-2023-2417 MISC MISC |
| konga — konga |
A vulnerability was found in Konga 2.8.3 on Kong. It has been classified as problematic. This affects an unknown part of the component Login API. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. The associated identifier of this vulnerability is VDB-227715. | 2023-04-29 | not yet calculated | CVE-2023-2418 MISC MISC MISC |
| zhong_bang — crmeb |
A vulnerability was found in Zhong Bang CRMEB 4.6.0. It has been declared as critical. This vulnerability affects the function videoUpload of the file crmebappservicessystemattachmentSystemAttachmentServices.php. The manipulation of the argument filename leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227716. | 2023-04-29 | not yet calculated | CVE-2023-2419 MISC MISC MISC |
| mlecms — mlecms |
A vulnerability was found in MLECMS 3.0. It has been rated as critical. This issue affects the function get_url in the library /upload/inc/lib/admin of the file uploadincincludecommon.func.php. The manipulation of the argument $_SERVER[‘REQUEST_URI’] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227717 was assigned to this vulnerability. | 2023-04-29 | not yet calculated | CVE-2023-2420 MISC MISC MISC |
| control_id — rhid |
A vulnerability classified as problematic has been found in Control iD RHiD 23.3.19.0. Affected is an unknown function of the file /v2/#/add/department. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. VDB-227718 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | 2023-04-29 | not yet calculated | CVE-2023-2421 MISC MISC MISC |
| dedecms — dedecms |
A vulnerability was found in DedeCMS 5.7.106 and classified as critical. Affected by this issue is the function UpDateMemberModCache of the file uploads/dede/config.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227750 is the identifier assigned to this vulnerability. | 2023-04-29 | not yet calculated | CVE-2023-2424 MISC MISC MISC |
| sourcecodester — simple_student_information_system |
A vulnerability was found in SourceCodester Simple Student Information System 1.0. It has been classified as problematic. This affects an unknown part of the file /classes/Master.php?f=save_course of the component Add New Course. The manipulation of the argument name with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227751. | 2023-04-29 | not yet calculated | CVE-2023-2425 MISC MISC MISC |
| vim — vim |
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. | 2023-04-29 | not yet calculated | CVE-2023-2426 CONFIRM MISC |
| textpattern — textpattern |
An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute arbitrary code via a crafted Zip file. | 2023-04-28 | not yet calculated | CVE-2023-24269 MISC |
| arista_networks — terminattr |
On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. This situation occurs only when the Streaming Telemetry Agent (referred to as the TerminAttr agent) is enabled and gNMI access is configured on the agent. Note: This gNMI over the Streaming Telemetry Agent scenario is mostly commonly used when streaming to a 3rd party system and is not used by default when streaming to CloudVision | 2023-04-25 | not yet calculated | CVE-2023-24512 MISC |
| vinga — wr-ac1200 |
Password vulnerability found in Vinga WR-AC1200 81.102.1.4370 and before allows a remote attacker to execute arbitrary code via the password parameter at the /goform/sysTools and /adm/systools.asp endpoints. | 2023-04-26 | not yet calculated | CVE-2023-24796 MISC |
| riot-os — riot |
RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a NULL pointer dereference. During forwarding of a fragment an uninitialized entry in the reassembly buffer is used. The NULL pointer dereference triggers a hard fault exception resulting in denial of service. Version 2022.10 fixes this issue. As a workaround, disable support for fragmented IP datagrams or apply the patches manually. | 2023-04-24 | not yet calculated | CVE-2023-24818 MISC MISC MISC MISC MISC MISC MISC |
| riot-os — riot |
RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully manipulating the allocator metadata gives an attacker the possibility to write data to arbitrary locations and thus execute arbitrary code. Version 2022.10 fixes this issue. As a workaround, disable support for fragmented IP datagrams or apply the patches manually. | 2023-04-24 | not yet calculated | CVE-2023-24819 MISC MISC MISC |
| riot-os — riot |
RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. An attacker can send a crafted frame to the device resulting in a large out of bounds write beyond the packet buffer. The write will create a hard fault exception after reaching the last page of RAM. The hard fault is not handled and the system will be stuck until reset. Thus the impact is denial of service. Version 2022.10 fixes this issue. As a workaround, apply the patch manually. | 2023-04-24 | not yet calculated | CVE-2023-24820 MISC MISC MISC |
| riot-os — riot |
RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a large out of bounds write beyond the packet buffer. The write will create a hard fault exception after reaching the last page of RAM. The hard fault is not handled and the system will be stuck until reset, thus the impact is denial of service. Version 2022.10 fixes this issue. As a workaround, disable support for fragmented IP datagrams or apply the patches manually. | 2023-04-24 | not yet calculated | CVE-2023-24821 MISC MISC MISC |
| riot-os — riot |
RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a NULL pointer dereference while encoding a 6LoWPAN IPHC header. The NULL pointer dereference causes a hard fault exception, leading to denial of service. Version 2022.10 fixes this issue. As a workaround, apply the patches manually. | 2023-04-24 | not yet calculated | CVE-2023-24822 MISC MISC MISC |
| riot-os — riot |
RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a type confusion between IPv6 extension headers and a UDP header. This occurs while encoding a 6LoWPAN IPHC header. The type confusion manifests in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully manipulating the allocator metadata gives an attacker the possibility to write data to arbitrary locations and thus execute arbitrary code. Version 2022.10 fixes this issue. As a workaround, apply the patches manually. | 2023-04-24 | not yet calculated | CVE-2023-24823 MISC MISC MISC |
| ibm — websphere_application_server |
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246904. | 2023-04-27 | not yet calculated | CVE-2023-24966 MISC MISC |
| cyberpower — powerpanel_business_local_remote |
Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the ‘admin’ password. | 2023-04-24 | not yet calculated | CVE-2023-25131 MISC MISC MISC MISC MISC |
| cyberpower — powerpanel_business_local_remote |
Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to execute operation system commands via unspecified vectors. | 2023-04-24 | not yet calculated | CVE-2023-25132 CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM |
| cyberpower — powerpanel_business_local_remote |
Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to execute operation system commands via unspecified vectors. | 2023-04-24 | not yet calculated | CVE-2023-25133 MISC MISC MISC MISC MISC |
| intermesh — group-office |
Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE cookie. | 2023-04-27 | not yet calculated | CVE-2023-25292 MISC MISC MISC |
| world_wide_broadcast_network — avideo |
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature. | 2023-04-25 | not yet calculated | CVE-2023-25313 MISC |
| world_wide_broadcast_network — avideo |
Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user. | 2023-04-25 | not yet calculated | CVE-2023-25314 MISC |
| vtech – vcs754 |
An issue was discovered in vTech VCS754 version 1.1.1.A before 1.1.1.H, allows attackers to gain escalated privileges and gain sensitive information due to cleartext passwords passed in the raw HTML. | 2023-04-27 | not yet calculated | CVE-2023-25437 MISC MISC |
| lenovo — xclarity_controller |
A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exposure where no LDAP client password is configured | 2023-04-28 | not yet calculated | CVE-2023-25495 MISC |
| nvidia — cuda_toolkit |
A privilege escalation vulnerability was reported in Lenovo Drivers Management Lenovo Driver Manager that could allow a local user to execute code with elevated privileges. | 2023-04-28 | not yet calculated | CVE-2023-25496 MISC |
| nvidia — cuda_toolkit |
NVIDIA CUDA Toolkit SDK for Linux and Windows contains a NULL pointer dereference in cuobjdump, where a local user running the tool against a malformed binary may cause a limited denial of service. | 2023-04-22 | not yet calculated | CVE-2023-25510 MISC |
| nvidia — cuda_toolkit |
NVIDIA CUDA Toolkit for Linux and Windows contains a vulnerability in cuobjdump, where a division-by-zero error may enable a user to cause a crash, which may lead to a limited denial of service. | 2023-04-22 | not yet calculated | CVE-2023-25511 MISC |
| nvidia — cuda_toolkit |
NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in cuobjdump, where an attacker may cause an out-of-bounds memory read by running cuobjdump on a malformed input file. A successful exploit of this vulnerability may lead to limited denial of service, code execution, and limited information disclosure. | 2023-04-22 | not yet calculated | CVE-2023-25512 MISC |
| nvidia — cuda_toolkit |
NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in cuobjdump, where an attacker may cause an out-of-bounds read by tricking a user into running cuobjdump on a malformed input file. A successful exploit of this vulnerability may lead to limited denial of service, code execution, and limited information disclosure. | 2023-04-22 | not yet calculated | CVE-2023-25513 MISC |
| nvidia — cuda_toolkit |
NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in cuobjdump, where an attacker may cause an out-of-bounds read by tricking a user into running cuobjdump on a malformed input file. A successful exploit of this vulnerability may lead to limited denial of service, code execution, and limited information disclosure. | 2023-04-22 | not yet calculated | CVE-2023-25514 MISC |
| git — git |
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply –reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `–reject` when applying patches from an untrusted source. Use `git apply –stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists. | 2023-04-25 | not yet calculated | CVE-2023-25652 MISC MISC MISC MISC MISC MISC |
| git — git |
In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function’s implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:mingw64sharelocale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:` (and since `C:mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1. This vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:`. | 2023-04-25 | not yet calculated | CVE-2023-25815 MISC MISC MISC MISC MISC MISC MISC MISC |
| ibm – db2 |
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 11.1, and 11.5 is vulnerable to a denial of service. Under rare conditions, setting a special register may cause the Db2 server to terminate abnormally. IBM X-Force ID: 247862. | 2023-04-28 | not yet calculated | CVE-2023-25930 MISC MISC |
| ibm – db2 |
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service as the server may crash when compiling a specially crafted SQL query using a LIMIT clause. IBM X-Force ID: 247864. | 2023-04-28 | not yet calculated | CVE-2023-26021 MISC MISC |
| ibm – db2 |
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash when an Out of Memory occurs using the DBMS_OUTPUT module. IBM X-Force ID: 247868. | 2023-04-28 | not yet calculated | CVE-2023-26022 MISC MISC |
| nokia — netact |
An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user. | 2023-04-25 | not yet calculated | CVE-2023-26057 MISC MISC |
| nokia — netact |
An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user. | 2023-04-25 | not yet calculated | CVE-2023-26058 MISC MISC |
| nokia — netact |
An issue was discovered in Nokia NetAct before 22 SP1037. On the Site Configuration Tool tab, attackers can upload a ZIP file which, when processed, exploits Stored XSS. The upload option of the Site Configuration tool does not validate the file contents. The application is in a demilitarised zone behind a perimeter firewall and without exposure to the internet. The attack can only be performed by an internal user. | 2023-04-24 | not yet calculated | CVE-2023-26059 MISC MISC |
| nokia — netact |
An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that has a client-side template injection payload. Input validation is missing during creation of the working set. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user. | 2023-04-24 | not yet calculated | CVE-2023-26060 MISC MISC |
| nokia — netact |
An issue was discovered in Nokia NetAct before 22 FP2211. On the Scheduled Search tab under the Alarm Reports Dashboard page, users can create a script to inject XSS. Input validation was missing during creation of a scheduled task. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user. | 2023-04-24 | not yet calculated | CVE-2023-26061 MISC MISC |
| telindus — apsal | An issue was discovered in Telindus Apsal 3.14.2022.235 b. Unauthorized actions that could modify the application behaviour may not be blocked. | 2023-04-24 | not yet calculated | CVE-2023-26097 MISC MISC |
| telindus — apsal |
An issue was discovered in the Open Document feature in Telindus Apsal 3.14.2022.235 b. An attacker may upload a crafted file to execute arbitrary code. | 2023-04-25 | not yet calculated | CVE-2023-26098 MISC MISC |
| telindus — apsal |
An issue was discovered in Telindus Apsal 3.14.2022.235 b. The consultation permission is insecure. | 2023-04-24 | not yet calculated | CVE-2023-26099 MISC MISC |
| progress — flowmon_os |
In Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input. A threat actor could leverage a reflected XSS vulnerability to execute arbitrary code within the context of a Flowmon user’s web browser. | 2023-04-21 | not yet calculated | CVE-2023-26100 MISC MISC |
| progress — flowmon_packet_investigator |
In Progress Flowmon Packet Investigator before 12.1.0, a Flowmon user with access to Flowmon Packet Investigator could leverage a path-traversal vulnerability to retrieve files on the Flowmon appliance’s local filesystem. | 2023-04-21 | not yet calculated | CVE-2023-26101 MISC MISC |
| hyundai — gen5w_l_in-vehicle_infotainment_system |
An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The decryption binary used to decrypt firmware files has an information leak that allows an attacker to read the AES key and initialization vector from memory. An attacker may exploit this to create custom firmware that may be installed in the IVI system. Then, an attacker may be able to install a backdoor in the IVI system that may allow him to control it, if it is connected to the Internet through Wi-Fi. | 2023-04-27 | not yet calculated | CVE-2023-26243 MISC MISC MISC |
| hyundai — gen5w_l_in-vehicle_infotainment_system |
An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppDMClient binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the digital signature check of AppUpgrade and .lge.upgrade.xml files, which are used during the firmware installation process. This indirectly allows an attacker to use a custom version of AppUpgrade and .lge.upgrade.xml files. | 2023-04-27 | not yet calculated | CVE-2023-26244 MISC MISC MISC |
| hyundai — gen5w_l_in-vehicle_infotainment_system |
An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the version check in order to install any firmware version (e.g., newer, older, or customized). This indirectly allows an attacker to install custom firmware in the IVI system. | 2023-04-27 | not yet calculated | CVE-2023-26245 MISC MISC MISC |
| hyundai — gen5w_l_in-vehicle_infotainment_system |
An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the digital signature check. This indirectly allows an attacker to install custom firmware in the IVI system. | 2023-04-27 | not yet calculated | CVE-2023-26246 MISC MISC MISC |
| ibm — multiple_products |
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX runtime services library to execute arbitrary commands. IBM X-Force ID: 248421. | 2023-04-26 | not yet calculated | CVE-2023-26286 MISC MISC |
| lorawan — lorawan-stack |
lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume they were redirected to the homepage on login. Version 3.24.1 contains a fix. | 2023-04-24 | not yet calculated | CVE-2023-26494 MISC MISC MISC MISC MISC |
| io_finnet — tss-lib |
io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time (there is an if statement in a loop). One leak is in ecdsa/keygen/round_2.go. (bnb-chain/tss-lib and thorchain/tss are also affected.) | 2023-04-21 | not yet calculated | CVE-2023-26556 MISC MISC MISC MISC |
| io_finnet — tss-lib |
io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/paillier.go. (bnb-chain/tss-lib and thorchain/tss are also affected.) | 2023-04-21 | not yet calculated | CVE-2023-26557 MISC MISC MISC MISC |
| northern.tech — cfengine_enterprise |
Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Reports feature to read arbitrary files and potentially discover credentials. | 2023-04-26 | not yet calculated | CVE-2023-26560 MISC MISC |
| sangoma — freepbx |
Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables. This exposes cleartext authentication credentials for the Asterisk Database (MariaDB/MySQL) and Asterisk Manager Interface. For example, an attacker can make a /ari/asterisk/variable?variable=AMPDBPASS API call. | 2023-04-26 | not yet calculated | CVE-2023-26567 MISC MISC MISC |
| mccms — mccms |
SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search. | 2023-04-28 | not yet calculated | CVE-2023-26781 MISC |
| mccms — mccms |
An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configuration->Cache Configuration->Cache security characters. | 2023-04-28 | not yet calculated | CVE-2023-26782 MISC |
| jfinal_cms — jfinal_cms |
Command execution vulnerability in the ActionEnter Class ins jfinal CMS version 5.1.0 allows attackers to execute arbitrary code via a created json file to the ueditor route. | 2023-04-28 | not yet calculated | CVE-2023-26812 MISC |
| prestashop — bdroppy |
SQL injection vulnerability in com.xnx3.wangmarket.plugin.dataDictionary.controller.DataDictionaryPluginController.java in wangmarket CMS 4.10 allows remote attackers to run arbitrary SQL commands via the TableName parameter to /plugin/dataDictionary/tableView.do. | 2023-04-28 | not yet calculated | CVE-2023-26813 MISC |
| xpdf — xpdf |
SQL injection vulnerability found in PrestaShop bdroppy v.2.2.12 and before allowing a remote attacker to gain privileges via the BdroppyCronModuleFrontController::importProducts component. | 2023-04-24 | not yet calculated | CVE-2023-26865 MISC MISC |
| xpdf — xpdf |
Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc function. | 2023-04-26 | not yet calculated | CVE-2023-26930 MISC MISC |
| xpdf — xpdf |
Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the TextOutputDev.cc function. | 2023-04-26 | not yet calculated | CVE-2023-26931 MISC MISC |
| xpdf — xpdf |
An issue found in XPDF v.4.04 allows an attacker to cause a denial of service via a crafted pdf file in the object.cc parameter. | 2023-04-26 | not yet calculated | CVE-2023-26934 MISC MISC |
| xpdf — xpdf |
Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via SharedFile::readBlock at /xpdf/Stream.cc. | 2023-04-26 | not yet calculated | CVE-2023-26935 MISC MISC |
| xpdf — xpdf |
Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via gmalloc in gmem.cc | 2023-04-26 | not yet calculated | CVE-2023-26936 MISC MISC |
| xpdf — xpdf |
Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via GString::resize located in goo/GString.cc | 2023-04-26 | not yet calculated | CVE-2023-26937 MISC MISC |
| xpdf — xpdf |
Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service viaSharedFile::readBlock located in goo/gfile.cc. | 2023-04-26 | not yet calculated | CVE-2023-26938 MISC MISC |
| shanling — mtouch_os |
A vulnerability in the Wi-Fi file transfer module of Shanling M5S Portable Music Player with Shanling MTouch OS v4.3 and Shanling M2X Portable Music Player with Shanling MTouch OS v3.3 allows attackers to arbitrarily read, delete, or modify any critical system files via directory traversal. | 2023-04-25 | not yet calculated | CVE-2023-27105 MISC MISC |
| myq — multiple_products |
Incorrect access control in the runReport function of MyQ Solution Print Server before 8.2 Patch 32 and Central Server before 8.2 Patch 22 allows users who do not have appropriate access rights to generate internal reports using a direct URL. | 2023-04-26 | not yet calculated | CVE-2023-27107 MISC |
| apache — superset |
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. | 2023-04-24 | not yet calculated | CVE-2023-27524 MISC MISC |
| ibm– db2 |
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 is vulnerable to a denial of service when attempting to use ACR client affinity for unfenced DRDA federation wrappers. IBM X-Force ID: 249187. | 2023-04-28 | not yet calculated | CVE-2023-27555 MISC MISC |
| ibm — counter_fraud_management_for_safer_payments |
IBM Counter Fraud Management for Safer Payments 6.1.0.00, 6.2.0.00, 6.3.0.00 through 6.3.1.03, 6.4.0.00 through 6.4.2.02 and 6.5.0.00 does not properly allocate resources without limits or throttling which could allow a remote attacker to cause a denial of service. IBM X-Force ID: 249190. | 2023-04-28 | not yet calculated | CVE-2023-27556 MISC MISC |
| ibm — counter_fraud_management_for_safer_payments |
IBM Counter Fraud Management for Safer Payments 6.1.0.00 through 6.1.1.02, 6.2.0.00 through 6.2.2.02, 6.3.0.00 through 6.3.1.02, 6.4.0.00 through 6.4.2.01, and 6.5.0.00 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 249192. | 2023-04-28 | not yet calculated | CVE-2023-27557 MISC MISC |
| ibm — db2 |
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using a specially crafted subquery. IBM X-Force ID: 249196. | 2023-04-26 | not yet calculated | CVE-2023-27559 MISC MISC |
| prestashop — askforaquote |
SQL injection vulnerability found in PrestaShop askforaquote v.5.4.2 and before allow a remote attacker to gain privileges via the QuotesProduct::deleteProduct component. | 2023-04-26 | not yet calculated | CVE-2023-27843 MISC MISC |
| broccoli-compass — broccoli-compass |
broccoli-compass v0.2.4 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function. | 2023-04-24 | not yet calculated | CVE-2023-27848 MISC MISC |
| rails-routes-to-json — rails-routes-to-json |
rails-routes-to-json v1.0.0 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function. | 2023-04-24 | not yet calculated | CVE-2023-27849 MISC MISC |
| ibm — maximo_asset_management |
IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could disclose sensitive information in an error message. This information could be used in further attacks against the system. IBM X-Force ID: 249207. | 2023-04-27 | not yet calculated | CVE-2023-27860 MISC MISC |
| ibm — maximo_asset_management |
IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim’s Web browser within the security context of the hosting site. IBM X-Force ID: 249327. | 2023-04-28 | not yet calculated | CVE-2023-27864 MISC MISC |
| hp — laserjet_pro |
Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Elevation of Privilege. | 2023-04-28 | not yet calculated | CVE-2023-27971 MISC |
| hp — laserjet_pro |
Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Remote Code Execution. | 2023-04-28 | not yet calculated | CVE-2023-27972 MISC |
| hp — laserjet_pro |
Certain HP LaserJet Pro print products are potentially vulnerable to Heap Overflow and/or Remote Code Execution. | 2023-04-28 | not yet calculated | CVE-2023-27973 MISC |
| zyxel — multiple_products |
The XSS vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker with administrator privileges to store malicious scripts in a vulnerable device. A successful XSS attack could then result in the stored malicious scripts being executed when the user visits the Logs page of the GUI on the device. | 2023-04-24 | not yet calculated | CVE-2023-27990 CONFIRM |
| zyxel — multiple_products |
The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker to execute some OS commands remotely. | 2023-04-24 | not yet calculated | CVE-2023-27991 CONFIRM |
| hcl — workload_automation |
HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. | 2023-04-26 | not yet calculated | CVE-2023-28008 MISC |
| hcl — workload_automation |
HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. | 2023-04-26 | not yet calculated | CVE-2023-28009 MISC |
| hewlett_packard_enterprise — multiple_products |
HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens | 2023-04-25 | not yet calculated | CVE-2023-28084 MISC MISC |
| hewlett_packard_enterprise — hpe_oneview |
An HPE OneView appliance dump may expose proxy credential settings | 2023-04-25 | not yet calculated | CVE-2023-28086 MISC |
| hewlett_packard_enterprise — hpe_oneview |
An HPE OneView appliance dump may expose OneView user accounts | 2023-04-25 | not yet calculated | CVE-2023-28087 MISC |
| hewlett_packard_enterprise — hpe_oneview |
An HPE OneView appliance dump may expose SAN switch administrative credentials | 2023-04-25 | not yet calculated | CVE-2023-28088 MISC |
| hewlett_packard_enterprise — hpe_oneview |
An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules | 2023-04-25 | not yet calculated | CVE-2023-28089 MISC |
| hewlett_packard_enterprise — hpe_oneview |
An HPE OneView appliance dump may expose SNMPv3 read credentials | 2023-04-25 | not yet calculated | CVE-2023-28090 MISC |
| expo.io — expo_authsession_module |
A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the “Expo AuthSession Redirect Proxy” for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to the victim in various ways (including email, text message, an attacker-controlled website, etc). | 2023-04-24 | not yet calculated | CVE-2023-28131 MISC |
| myscada_technologies — myscada_mypro |
mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. | 2023-04-27 | not yet calculated | CVE-2023-28384 MISC |
| myscada_technologies — myscada_mypro |
mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. | 2023-04-27 | not yet calculated | CVE-2023-28400 MISC |
| concrete_cms — concrete_cms |
Concrete CMS (previously concrete5) before 9.2 is vulnerable to Stored XSS via a container name. | 2023-04-28 | not yet calculated | CVE-2023-28471 MISC MISC |
| concrete_cms — concrete_cms |
Concrete CMS (previously concrete5) before 9.2 does not have Secure and HTTP only attributes set for ccmPoll cookies. | 2023-04-28 | not yet calculated | CVE-2023-28472 MISC MISC |
| concrete_cms — concrete_cms |
Concrete CMS (previously concrete5) before 9.2 is vulnerable to possible Auth bypass in the jobs section. | 2023-04-28 | not yet calculated | CVE-2023-28473 MISC MISC |
| concrete_cms — concrete_cms |
Concrete CMS (previously concrete5) before 9.2 is vulnerable to Stored XSS on Saved Presets on search. | 2023-04-28 | not yet calculated | CVE-2023-28474 MISC MISC |
| concrete_cms — concrete_cms |
Concrete CMS (previously concrete5) before 9.2 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized. | 2023-04-28 | not yet calculated | CVE-2023-28475 MISC MISC |
| concrete_cms — concrete_cms |
Concrete CMS (previously concrete5) before 9.2 is vulnerable to Stored XSS on Tags on uploaded files. | 2023-04-28 | not yet calculated | CVE-2023-28476 MISC MISC |
| concrete_cms — concrete_cms |
Concrete CMS (previously concrete5) before 9.2 is vulnerable to stored XSS on API Integrations via the name parameter. | 2023-04-28 | not yet calculated | CVE-2023-28477 MISC MISC |
| libxml2 — libxml2 |
In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c. | 2023-04-24 | not yet calculated | CVE-2023-28484 MISC MISC MLIST |
| ibm — aix |
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. IBM X-Force ID: 251207. | 2023-04-28 | not yet calculated | CVE-2023-28528 MISC MISC |
| myscada_technologies — myscada_mypro |
mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. | 2023-04-27 | not yet calculated | CVE-2023-28716 MISC |
| zyxel — dx5401-b0_firmware |
The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device. | 2023-04-27 | not yet calculated | CVE-2023-28769 CONFIRM |
| zyxel — dx5401-b0_firmware |
The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to read the system files and to retrieve the password of the supervisor from the encrypted file. | 2023-04-27 | not yet calculated | CVE-2023-28770 CONFIRM |
| zyxel — zywall/usg_series_firmware |
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device. | 2023-04-25 | not yet calculated | CVE-2023-28771 CONFIRM |
| concrete_cms — concrete_cms |
Concrete CMS (previously concrete5) before 9.1 is vulnerable to Stored XSS in uploaded file and folder names. | 2023-04-28 | not yet calculated | CVE-2023-28819 MISC MISC |
| concrete_cms — concrete_cms |
Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized. | 2023-04-28 | not yet calculated | CVE-2023-28820 MISC MISC |
| concrete_cms — concrete_cms |
Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets. | 2023-04-28 | not yet calculated | CVE-2023-28821 MISC MISC |
| nextcloud — security-advisories |
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior to 25.0.5; as well as Nextcloud Server Enterprise 23.0.0 prior to 23.0.12.6, 24.0.0 prior to 24.0.11, and 25.0.0 prior to 25.0.5; an attacker is not restricted in verifying passwords of share links so they can just start brute forcing the password. Nextcloud Server 24.0.11 and 25.0.5 and Nextcloud Enterprise Server 23.0.12.6, 24.0.11, and 25.0.5 contain a fix for this issue. No known workarounds are available. | 2023-04-25 | not yet calculated | CVE-2023-28847 MISC MISC MISC |
| trustwave — modsecurity |
Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations. | 2023-04-28 | not yet calculated | CVE-2023-28882 CONFIRM |
| git — git |
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user’s `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`. | 2023-04-25 | not yet calculated | CVE-2023-29007 MISC MISC MISC MISC MISC |
| git-for-windows — git |
Git for Windows, the Windows port of Git, ships with an executable called `connect.exe`, which implements a SOCKS5 proxy that can be used to connect e.g. to SSH servers via proxies when certain ports are blocked for outgoing connections. The location of `connect.exe`’s config file is hard-coded as `/etc/connectrc` which will typically be interpreted as `C:etcconnectrc`. Since `C:etc` can be created by any authenticated user, this makes `connect.exe` susceptible to malicious files being placed there by other users on the same multi-user machine. The problem has been patched in Git for Windows v2.40.1. As a workaround, create the folder `etc` on all drives where Git commands are run, and remove read/write access from those folders. Alternatively, watch out for malicious `<drive>:etcconnectrc` files on multi-user machines. | 2023-04-25 | not yet calculated | CVE-2023-29011 MISC MISC |
| git-for-windows — git |
Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an untrusted directory is impacted by an Uncontrolles Search Path Element vulnerability. Maliciously-placed `doskey.exe` would be executed silently upon running Git CMD. The problem has been patched in Git for Windows v2.40.1. As a workaround, avoid using Git CMD or, if using Git CMD, avoid starting it in an untrusted directory. | 2023-04-25 | not yet calculated | CVE-2023-29012 MISC MISC |
| fastify — fastify-passport |
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user authentication, in combination with `@fastify/session` as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers. fastify applications rely on the `@fastify/passport` library for user authentication. The login and user validation are performed by the `authenticate` function. When executing this function, the `sessionId` is preserved between the pre-login and the authenticated session. Network and same-site attackers can hijack the victim’s session by tossing a valid `sessionId` cookie in the victim’s browser and waiting for the victim to log in on the website. As a solution, newer versions of `@fastify/passport` regenerate `sessionId` upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session. Users are advised to upgrade. There are no known workarounds for this vulnerability. | 2023-04-21 | not yet calculated | CVE-2023-29019 MISC MISC MISC |
| fastify — fastify-passport |
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by the `@fastify/csrf-protection` library, when combined with `@fastify/passport` in affected versions, can be bypassed by network and same-site attackers. `fastify/csrf-protection` implements the synchronizer token pattern (using plugins `@fastify/session` and `@fastify/secure-session`) by storing a random value used for CSRF token generation in the `_csrf` attribute of a user’s session. The `@fastify/passport` library does not clear the session object upon authentication, preserving the `_csrf` attribute between pre-login and authenticated sessions. Consequently, CSRF tokens generated before authentication are still valid. Network and same-site attackers can thus obtain a CSRF token for their pre-session, fixate that pre-session in the victim’s browser via cookie tossing, and then perform a CSRF attack after the victim authenticates. As a solution, newer versions of `@fastify/passport` include the configuration options: `clearSessionOnLogin (default: true)` and `clearSessionIgnoreFields (default: [‘passport’, ‘session’])` to clear all the session attributes by default, preserving those explicitly defined in `clearSessionIgnoreFields`. | 2023-04-21 | not yet calculated | CVE-2023-29020 MISC MISC MISC MISC |
| lenovo — xclarity_controller |
A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined. | 2023-04-28 | not yet calculated | CVE-2023-29056 MISC |
| lenovo — xclarity_controller |
A valid XCC user’s local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”. | 2023-04-28 | not yet calculated | CVE-2023-29057 MISC |
| lenovo — xclarity_controller |
A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions. | 2023-04-28 | not yet calculated | CVE-2023-29058 MISC |
| myscada_technologies — myscada_mypro |
mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. | 2023-04-27 | not yet calculated | CVE-2023-29150 MISC |
| myscada_technologies — myscada_mypro |
mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. | 2023-04-27 | not yet calculated | CVE-2023-29169 MISC |
| contao — contao |
Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds. | 2023-04-25 | not yet calculated | CVE-2023-29200 MISC MISC MISC |
| ibm — db2_for_linux,_unix_and_windows |
IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as it may trap when compiling a variation of an anonymous block. IBM X-Force ID: 251991. | 2023-04-27 | not yet calculated | CVE-2023-29255 MISC MISC |
| ibm — db2_for_linux,_unix_and_windows |
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to remote code execution as a database administrator of one database may execute code or read/write files from another database within the same instance. IBM X-Force ID: 252011. | 2023-04-26 | not yet calculated | CVE-2023-29257 MISC MISC |
| tibco_software_inc. — tibco_spotfire_statistics_services |
The Splus Server component of TIBCO Software Inc.’s TIBCO Spotfire Statistics Services contains a vulnerability that allows an unauthenticated remote attacker to upload or modify arbitrary files within the web server directory on the affected system. Affected releases are TIBCO Software Inc.’s TIBCO Spotfire Statistics Services: versions 11.4.10 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, and 12.0.2, versions 12.1.0 and 12.2.0. | 2023-04-26 | not yet calculated | CVE-2023-29268 MISC |
| zoho — manageengine_applications_manager |
Zoho ManageEngine Applications Manager through 16390 allows DOM XSS. | 2023-04-26 | not yet calculated | CVE-2023-29442 MISC |
| zoho — manageengine_servicedesk_plus |
Zoho ManageEngine ServiceDesk Plus through 14104 allows admin users to conduct an XXE attack. | 2023-04-26 | not yet calculated | CVE-2023-29443 MISC |
| libxml2 — libxml2 |
An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the ‘ ’ value). | 2023-04-24 | not yet calculated | CVE-2023-29469 MISC MISC MLIST |
| lightbend — alpakka_kafka |
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor. | 2023-04-27 | not yet calculated | CVE-2023-29471 MISC MISC |
| ribose — rnp |
Ribose RNP before 0.16.3 may hang when the input is malformed. | 2023-04-24 | not yet calculated | CVE-2023-29479 MISC MISC |
| ribose — rnp |
Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use. | 2023-04-24 | not yet calculated | CVE-2023-29480 CONFIRM |
| xpanel — xpanel |
An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31. | 2023-04-27 | not yet calculated | CVE-2023-29489 MISC MISC |
| laminas — laminas-diactoros |
Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value, can cause an invalid message. This can lead to denial of service vectors or application errors. The problem has been patched in following versions 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, and 2.25.1. As a workaround, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling `withHeader()`. | 2023-04-24 | not yet calculated | CVE-2023-29530 MISC MISC MISC |
| slp — multiple_products |
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor. | 2023-04-25 | not yet calculated | CVE-2023-29552 MISC MISC MISC MISC MISC MISC MISC CONFIRM |
| npm — multiple_products |
huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function. | 2023-04-24 | not yet calculated | CVE-2023-29566 MISC MISC MISC MISC |
| bento4 — mp42aac |
Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42aac component. | 2023-04-21 | not yet calculated | CVE-2023-29575 MISC MISC |
| mp4v2 — mp4stringproperty |
mp4v2 v2.0.0 was discovered to contain a heap buffer overflow via the mp4v2::impl::MP4StringProperty::~MP4StringProperty() function at src/mp4property.cpp. | 2023-04-24 | not yet calculated | CVE-2023-29578 MISC MISC |
| yasm — yasm |
yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the component yasm/yasm+0x43b466 in vsprintf. | 2023-04-24 | not yet calculated | CVE-2023-29579 MISC MISC |
| yasm — yasm |
yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the function parse_expr1 at /nasm/nasm-parse.c. | 2023-04-24 | not yet calculated | CVE-2023-29582 MISC MISC |
| yasm — yasm |
yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the function parse_expr5 at /nasm/nasm-parse.c. | 2023-04-24 | not yet calculated | CVE-2023-29583 MISC MISC |
| byronknoll_cmix — paq8 |
Buffer Overflow vulnerability found in ByronKnoll Cmix v.19 allows an attacker to execute arbitrary code and cause a denial of service via the paq8 function. | 2023-04-26 | not yet calculated | CVE-2023-29596 MISC |
| sengled — dimmer_switch |
Sengled Dimmer Switch V0.0.9 contains a denial of service (DOS) vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes. After receiving the malicious command, the device will keep reporting its status and finally drain its battery after receiving the ‘Set_short_poll_interval’ command. | 2023-04-25 | not yet calculated | CVE-2023-29779 MISC MISC |
| third_reality — smart_blind |
Third Reality Smart Blind 1.00.54 contains a denial-of-service vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes. | 2023-04-24 | not yet calculated | CVE-2023-29780 MISC MISC |
| mccms — mccms |
mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF). | 2023-04-28 | not yet calculated | CVE-2023-29815 MISC |
| wondershare — dr.fone |
Insecure Permission vulnerability found in Wondershare Dr.Fone v.12.9.6 allows a remote attacker to escalate privileges via the service permission function. | 2023-04-26 | not yet calculated | CVE-2023-29835 MISC |
| exelysis — unified_communication_solutions |
Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions (EUCS) v.1.0 allows a remote attacker to execute arbitrary code via the Username parameter of the eucsAdmin login form. | 2023-04-26 | not yet calculated | CVE-2023-29836 MISC MISC |
| bang — resto |
Bang Resto 1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the itemName parameter in the admin/menu.php Add New Menu function. | 2023-04-24 | not yet calculated | CVE-2023-29848 MISC MISC |
| bang — resto |
Bang Resto 1.0 was discovered to contain multiple SQL injection vulnerabilities via the btnMenuItemID, itemID, itemPrice, menuID, staffID, or itemqty parameter. | 2023-04-24 | not yet calculated | CVE-2023-29849 MISC MISC |
| h3c — magic_r200 |
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm. | 2023-04-21 | not yet calculated | CVE-2023-29905 MISC |
| h3c — magic_r200 |
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm. | 2023-04-21 | not yet calculated | CVE-2023-29906 MISC |
| h3c — magic_r200 |
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm. | 2023-04-21 | not yet calculated | CVE-2023-29907 MISC |
| h3c — magic_r200 |
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspForm. | 2023-04-21 | not yet calculated | CVE-2023-29908 MISC |
| h3c — magic_r200 |
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /goform/aspForm. | 2023-04-21 | not yet calculated | CVE-2023-29909 MISC |
| h3c — magic_r200 |
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm. | 2023-04-21 | not yet calculated | CVE-2023-29910 MISC |
| h3c — magic_r200 |
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm. | 2023-04-21 | not yet calculated | CVE-2023-29911 MISC |
| h3c — magic_r200 |
H3C Magic R200 R200V100R004 was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm. | 2023-04-21 | not yet calculated | CVE-2023-29912 MISC |
| h3c — magic_r200 |
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/aspForm. | 2023-04-21 | not yet calculated | CVE-2023-29913 MISC |
| h3c — magic_r200 |
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm. | 2023-04-21 | not yet calculated | CVE-2023-29914 MISC |
| h3c — magic_r200 |
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via CMD parameter at /goform/aspForm. | 2023-04-21 | not yet calculated | CVE-2023-29915 MISC |
| h3c — magic_r200 |
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm. | 2023-04-21 | not yet calculated | CVE-2023-29916 MISC |
| h3c — magic_r200 |
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via go parameter at /goform/aspForm. | 2023-04-21 | not yet calculated | CVE-2023-29917 MISC |
| swftools — swfrender |
swfrender v0.9.2 was discovered to contain a heap buffer overflow in the function enumerateUsedIDs_fillstyle at modules/swftools.c | 2023-04-27 | not yet calculated | CVE-2023-29950 MISC |
| magicjack — a921 |
Insecure Permissions vulnerability found in MagicJack A921 USB Phone Jack Rev 3.0 v.1.4 allows a physically proximate attacker to escalate privileges and gain access to sensitive information via the NAND flash memory. | 2023-04-28 | not yet calculated | CVE-2023-30024 MISC MISC MISC MISC |
| sourcecodester — medicine_tracker_system |
Sourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS) via page=about. | 2023-04-26 | not yet calculated | CVE-2023-30106 MISC MISC MISC |
| wuzhicms — wuzhicms |
Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS). | 2023-04-26 | not yet calculated | CVE-2023-30111 MISC MISC |
| eyoucms — eyoucms |
Medicine Tracker System in PHP 1.0.0 is vulnerable to SQL Injection. | 2023-04-26 | not yet calculated | CVE-2023-30112 MISC MISC |
| craftcms — craftcms |
wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings. | 2023-04-28 | not yet calculated | CVE-2023-30123 MISC |
| wangmarket_cms — wangmarket_cms |
EyouCms V1.6.1-UTF8-sp1 is vulnerable to Cross Site Scripting (XSS). | 2023-04-28 | not yet calculated | CVE-2023-30125 MISC |
| ourphp — ourphp |
CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name. | 2023-04-25 | not yet calculated | CVE-2023-30177 MISC |
| ourphp — ourphp |
Wangmarket CMS v4.10 was discovered to contain a SQL injection vulnerability via the component /plugin/dataDictionary/tableView.do?tableName=. | 2023-04-28 | not yet calculated | CVE-2023-30183 MISC |
| ourphp — ourphp |
OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php. | 2023-04-26 | not yet calculated | CVE-2023-30210 MISC |
| cltphp — cltphp |
OURPHP <= 7.2.0 is vulnerable to SQL Injection. | 2023-04-26 | not yet calculated | CVE-2023-30211 MISC |
| cltphp — cltphp |
OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php. | 2023-04-26 | not yet calculated | CVE-2023-30212 MISC |
| cltphp — cltphp |
CLTPHP <=6.0 is vulnerable to Directory Traversal. | 2023-04-26 | not yet calculated | CVE-2023-30265 MISC |
| cltphp — cltphp |
CLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. | 2023-04-26 | not yet calculated | CVE-2023-30266 MISC |
| cltphp — cltphp |
CLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan.php. | 2023-04-26 | not yet calculated | CVE-2023-30267 MISC |
| cltphp — cltphp |
CLTPHP <=6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php. | 2023-04-26 | not yet calculated | CVE-2023-30269 MISC |
| netgear — r6900 |
Buffer Overflow vulnerability found in Netgear R6900 v.1.0.2.26, R6700v3 v.1.0.4.128, R6700 v.1.0.0.26 allows a remote attacker to execute arbitrary code and cause a denial ofservice via the getInputData parameter of the fwSchedule.cgi page. | 2023-04-26 | not yet calculated | CVE-2023-30280 MISC MISC |
| emlog — pro |
Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Article Title or Article Summary parameters. | 2023-04-27 | not yet calculated | CVE-2023-30338 MISC |
| Jfinal_cms — jfinal_cms |
JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function. | 2023-04-27 | not yet calculated | CVE-2023-30349 MISC |
| tencent — vconsole |
vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts. | 2023-04-26 | not yet calculated | CVE-2023-30363 MISC MISC |
| dedecms — dedecms |
An issue in the component /dialog/select_media.php of DedeCMS v5.7.107 allows attackers to execute a directory traversal. | 2023-04-27 | not yet calculated | CVE-2023-30380 MISC |
| yasm — yasm |
YASM v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re. | 2023-04-25 | not yet calculated | CVE-2023-30402 MISC |
| aigital — wireless-n_repeater_mini_router |
Aigital Wireless-N Repeater Mini_Router v0.131229 was discovered to contain a remote code execution (RCE) vulnerability via the sysCmd parameter in the formSysCmd function. This vulnerability is exploited via a crafted HTTP request. | 2023-04-26 | not yet calculated | CVE-2023-30404 MISC MISC |
| aigital — wireless-n_repeater_mini_router |
A cross-site scripting (XSS) vulnerability in Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the wl_ssid parameter at /boafrm/formHomeWlanSetup. | 2023-04-28 | not yet calculated | CVE-2023-30405 MISC |
| jerryscript_project — jerryscript |
Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpers.c. | 2023-04-24 | not yet calculated | CVE-2023-30406 MISC |
| jerryscript_project — jerryscript |
Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry. | 2023-04-24 | not yet calculated | CVE-2023-30408 MISC |
| jerryscript_project — jerryscript |
Jerryscript commit 1a2c047 was discovered to contain a stack overflow via the component ecma_op_function_construct at /operations/ecma-function-object.c. | 2023-04-24 | not yet calculated | CVE-2023-30410 MISC |
| jerryscript_project — jerryscript |
Jerryscript commit 1a2c047 was discovered to contain a stack overflow via the component vm_loop at /jerry-core/vm/vm.c. | 2023-04-24 | not yet calculated | CVE-2023-30414 MISC |
| pear-admin — pear-admin-boot |
A cross-site scripting (XSS) vulnerability in Pear-Admin-Boot up to v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title of a private message. | 2023-04-25 | not yet calculated | CVE-2023-30417 MISC |
| ibm — multiple_products |
IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations. IBM X-Force ID: 253188. | 2023-04-29 | not yet calculated | CVE-2023-30441 MISC MISC MISC MISC MISC |
| ibm — watson_machine_learning |
IBM Watson Machine Learning on Cloud Pak for Data 4.0 and 4.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 253350. | 2023-04-27 | not yet calculated | CVE-2023-30444 MISC |
| ebankit — ebankit |
An issue was discovered in ebankIT before 7. Document Object Model based XSS exists within the /Security/Transactions/Transactions.aspx endpoint. Users can supply their own JavaScript within the ctl100$ctl00MainContent$TransactionMainContent$accControl$hdnAccountsArray POST parameter that will be passed to an eval() function and executed upon pressing the continue button. | 2023-04-28 | not yet calculated | CVE-2023-30454 MISC MISC |
| ebankit — ebankit |
An issue was discovered in ebankIT before 7. A Denial-of-Service attack is possible through the GET parameter EStatementsIds located on the /Controls/Generic/EBMK/Handlers/EStatements/DownloadEStatement.ashx endpoint. The GET parameter accepts over 100 comma-separated e-statement IDs without throwing an error. When this many IDs are supplied, the server takes around 60 seconds to respond and successfully generate the expected ZIP archive (during this time period, no other pages load). A threat actor could issue a request to this endpoint with 100+ statement IDs every 30 seconds, potentially resulting in an overload of the server for all users. | 2023-04-28 | not yet calculated | CVE-2023-30455 MISC MISC |
| sourcecodester — medicine_tracker_system |
A username enumeration issue was discovered in Medicine Tracker System 1.0. The login functionality allows a malicious user to guess a valid username due to a different response time from invalid usernames. When one enters a valid username, the response time increases depending on the length of the supplied password. | 2023-04-24 | not yet calculated | CVE-2023-30458 MISC MISC MISC |
| milesight — multiple_products |
This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device. Successful exploitation of this vulnerability could allow remote attacker to account takeover on the targeted device. | 2023-04-28 | not yet calculated | CVE-2023-30466 MISC |
| milesight — multiple_products |
This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to improper authorization at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device. Successful exploitation of this vulnerability could allow remote attacker to perform unauthorized activities on the targeted device. | 2023-04-28 | not yet calculated | CVE-2023-30467 MISC |
| sheetjs — community_edition |
SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. | 2023-04-24 | not yet calculated | CVE-2023-30533 MISC MISC |
| kiwi — tcms |
Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the `My profile` admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist. | 2023-04-24 | not yet calculated | CVE-2023-30544 MISC MISC MISC |
| prestashop — prestashop |
PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9 | 2023-04-25 | not yet calculated | CVE-2023-30545 MISC MISC MISC |
| contiki-ng — contiki-ng |
Contiki-NG is an operating system for Internet of Things devices. An off-by-one error can be triggered in the Antelope database management system in the Contiki-NG operating system in versions 4.8 and prior. The problem exists in the Contiki File System (CFS) backend for the storage of data (file os/storage/antelope/storage-cfs.c). In the functions `storage_get_index` and `storage_put_index`, a buffer for merging two strings is allocated with one byte less than the maximum size of the merged strings, causing subsequent function calls to the cfs_open function to read from memory beyond the buffer size. The vulnerability has been patched in the “develop” branch of Contiki-NG, and is expected to be included in the next release. As a workaround, the problem can be fixed by applying the patch in Contiki-NG pull request #2425. | 2023-04-26 | not yet calculated | CVE-2023-30546 MISC MISC |
| apptainer — apptainer |
Apptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Apptainer < 1.1.0, installations that include apptainer-suid < 1.1.8, and all versions of Singularity in their default configurations on older operating systems where that CVE has not been patched. That includes Red Hat Enterprise Linux 7, Debian 10 buster (unless the linux-5.10 package is installed), Ubuntu 18.04 bionic and Ubuntu 20.04 focal. Use-after-free flaws in the kernel can be used to attack the kernel for denial of service and potentially for privilege escalation. Apptainer 1.1.8 includes a patch that by default disables mounting of extfs filesystem types in setuid-root mode, while continuing to allow mounting of extfs filesystems in non-setuid “rootless” mode using fuse2fs. Some workarounds are possible. Either do not install apptainer-suid (for versions 1.1.0 through 1.1.7) or set `allow setuid = no` in apptainer.conf (or singularity.conf for singularity versions). This requires having unprivileged user namespaces enabled and except for apptainer 1.1.x versions will disallow mounting of sif files, extfs files, and squashfs files in addition to other, less significant impacts. (Encrypted sif files are also not supported unprivileged in apptainer 1.1.x.). Alternatively, use the `limit containers` options in apptainer.conf/singularity.conf to limit sif files to trusted users, groups, and/or paths, and set `allow container extfs = no` to disallow mounting of extfs overlay files. The latter option by itself does not disallow mounting of extfs overlay partitions inside SIF files, so that’s why the former options are also needed. | 2023-04-25 | not yet calculated | CVE-2023-30549 MISC MISC MISC MISC MISC MISC MISC |
| matrix-org — matrix-react-sdk |
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection. | 2023-04-25 | not yet calculated | CVE-2023-30609 MISC MISC MISC |
| kiwi — tcms |
Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc. In versions of Kiwi TCMS prior to 12.2, there is no control over what kinds of files can be uploaded. Thus, a malicious actor may upload an `.exe` file or a file containing embedded JavaScript and trick others into clicking on these files, causing vulnerable browsers to execute malicious code on another computer. Kiwi TCMS v12.2 comes with functionality that allows administrators to configure additional upload validator functions which give them more control over what file types are accepted for upload. By default `.exe` are denied. Other files containing the `<script>` tag, regardless of their type are also denied b/c they are a path to XSS attacks. There are no known workarounds aside from upgrading. | 2023-04-24 | not yet calculated | CVE-2023-30613 MISC MISC MISC |
| newcontext — kitchen-terraform |
Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and verify the resulting infrastructure systems with InSpec controls. Kitchen-Terraform v7.0.0 introduced a regression which caused all Terraform output values, including sensitive values, to be printed at the `info` logging level during the `kitchen converge` action. Prior to v7.0.0, the output values were printed at the `debug` level to avoid writing sensitive values to the terminal by default. An attacker would need access to the local machine in order to gain access to these logs during an operation. Users are advised to upgrade. There are no known workarounds for this vulnerability. | 2023-04-21 | not yet calculated | CVE-2023-30618 MISC MISC |
| clusternet — clusternet |
Clusternet is a general-purpose system for controlling Kubernetes clusters across different environments. An issue in clusternet prior to version 0.15.2 can be leveraged to lead to a cluster-level privilege escalation. The clusternet has a deployment called `cluster-hub` inside the `clusternet-system` Kubernetes namespace, which runs on worker nodes randomly. The deployment has a service account called `clusternet-hub`, which has a cluster role called `clusternet:hub` via cluster role binding. The `clusternet:hub` cluster role has `”*” verbs of “*.*”` resources. Thus, if a malicious user can access the worker node which runs the clusternet, they can leverage the service account to do malicious actions to critical system resources. For example, the malicious user can leverage the service account to get ALL secrets in the entire cluster, resulting in cluster-level privilege escalation. Version 0.15.2 contains a fix for this issue. | 2023-04-24 | not yet calculated | CVE-2023-30622 MISC MISC |
| wip — wip |
`embano1/wip` is a GitHub Action written in Bash. Prior to version 2, the `embano1/wip` action uses the `github.event.pull_request.title` parameter in an insecure way. The title parameter is used in a run statement – resulting in a command injection vulnerability due to string interpolation. This vulnerability can be triggered by any user on GitHub. They just need to create a pull request with a commit message containing an exploit. (Note that first-time PR requests will not be run – but the attacker can submit a valid PR before submitting an invalid PR). The commit can be genuine, but the commit message can be malicious. This can be used to execute code on the GitHub runners and can be used to exfiltrate any secrets used in the CI pipeline, including repository tokens. Version 2 has a fix for this issue. | 2023-04-24 | not yet calculated | CVE-2023-30623 MISC MISC MISC |
| bytecodealliance — wasmtime |
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime’s implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined behavior was found to cause runtime-level issues when compiled with LLVM 16 which causes some writes, which are critical for correctness, to be optimized away. Vulnerable versions of Wasmtime compiled with Rust 1.70, which is currently in beta, or later are known to have incorrectly compiled functions. Versions of Wasmtime compiled with the current Rust stable release, 1.69, and prior are not known at this time to have any issues, but can theoretically exhibit potential issues. The underlying problem is that Wasmtime’s runtime state for an instance involves a Rust-defined structure called `Instance` which has a trailing `VMContext` structure after it. This `VMContext` structure has a runtime-defined layout that is unique per-module. This representation cannot be expressed with safe code in Rust so `unsafe` code is required to maintain this state. The code doing this, however, has methods which take `&self` as an argument but modify data in the `VMContext` part of the allocation. This means that pointers derived from `&self` are mutated. This is typically not allowed, except in the presence of `UnsafeCell`, in Rust. When compiled to LLVM these functions have `noalias readonly` parameters which means it’s UB to write through the pointers. Wasmtime’s internal representation and management of `VMContext` has been updated to use `&mut self` methods where appropriate. Additionally verification tools for `unsafe` code in Rust, such as `cargo miri`, are planned to be executed on the `main` branch soon to fix any Rust-level issues that may be exploited in future compiler versions. Precomplied binaries available for Wasmtime from GitHub releases have been compiled with at most LLVM 15 so are not known to be vulnerable. As mentioned above, however, it’s still recommended to update. Wasmtime version 6.0.2, 7.0.1, and 8.0.1 have been issued which contain the patch necessary to work correctly on LLVM 16 and have no known UB on LLVM 15 and earlier. If Wasmtime is compiled with Rust 1.69 and prior, which use LLVM 15, then there are no known issues. There is a theoretical possibility for undefined behavior to exploited, however, so it’s recommended that users upgrade to a patched version of Wasmtime. Users using beta Rust (1.70 at this time) or nightly Rust (1.71 at this time) must update to a patched version to work correctly. | 2023-04-27 | not yet calculated | CVE-2023-30624 MISC MISC |
| jellyfin — jellyfin |
Jellyfin is a free-software media system. Versions starting with 10.8.0 and prior to 10.8.10 and prior have a directory traversal vulnerability inside the `ClientLogController`, specifically `/ClientLog/Document`. When combined with a cross-site scripting vulnerability (CVE-2023-30627), this can result in file write and arbitrary code execution. Version 10.8.10 has a patch for this issue. There are no known workarounds. | 2023-04-24 | not yet calculated | CVE-2023-30626 MISC MISC MISC MISC MISC MISC |
| jellyfin — jellyfin |
jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and prior to version 10.8.10, a stored cross-site scripting vulnerability in device.js can be used to make arbitrary calls to the `REST` endpoints with admin privileges. When combined with CVE-2023-30626, this results in remote code execution on the Jellyfin instance in the context of the user who’s running it. This issue is patched in version 10.8.10. There are no known workarounds. | 2023-04-24 | not yet calculated | CVE-2023-30627 MISC MISC MISC MISC |
| kiwi — tcms |
Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior, the `changelog.yml` workflow is vulnerable to command injection attacks because of using an untrusted `github.head_ref` field. The `github.head_ref` value is an attacker-controlled value. Assigning the value to `zzz”;echo${IFS}”hello”;#` can lead to command injection. Since the permission is not restricted, the attacker has a write-access to the repository. Commit 834c86dfd1b2492ccad7ebbfd6304bfec895fed2 of the kiwitcms/Kiwi repository and commit e39f7e156fdaf6fec09a15ea6f4e8fec8cdbf751 of the kiwitcms/enterprise repository contain a fix for this issue. | 2023-04-24 | not yet calculated | CVE-2023-30628 MISC MISC MISC MISC MISC |
| vyperlang — vyper |
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the `raw_call` with `revert_on_failure=False` and `max_outsize=0` receives the wrong response from `raw_call`. Depending on the memory garbage, the result can be either `True` or `False`. A patch is available and, as of time of publication, anticipated to be part of Vyper 0.3.8. As a workaround, one may always put `max_outsize>0`. | 2023-04-24 | not yet calculated | CVE-2023-30629 MISC MISC MISC MISC MISC |
| apache — apache_superset |
An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1. | 2023-04-24 | not yet calculated | CVE-2023-30776 MISC MISC |
| meta_platforms — lexical |
Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources. | 2023-04-29 | not yet calculated | CVE-2023-30792 MISC |
| prestashop — prestashop |
PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Prestashop misses hijackable events which can lead to cross-site scripting (XSS) injection, allowed by the presence of pre-setup `@keyframes` methods. This XSS, which hijacks HTML attributes, can be triggered without any interaction by the visitor/administrator, which makes it as dangerous as a trivial XSS attack. Contrary to other attacks which target HTML attributes and are triggered without user interaction (such as onload / onerror which suffer from a very limited scope), this one can hijack every HTML element, which increases the danger due to a complete HTML elements scope. Versions 8.0.4 and 1.7.8.9 contain a fix for this issue. | 2023-04-25 | not yet calculated | CVE-2023-30838 MISC MISC MISC |
| prestashop — prestashop |
PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 contain a patch for this issue. There are no known workarounds. | 2023-04-25 | not yet calculated | CVE-2023-30839 MISC MISC MISC |
| metal3-io — baremetal_operator |
Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster’s Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241. | 2023-04-26 | not yet calculated | CVE-2023-30841 MISC MISC |
| payloadcms — payload |
Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data. | 2023-04-26 | not yet calculated | CVE-2023-30843 MISC MISC |
| google — espv2 |
ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 through 2.42.0 contains an authentication bypass vulnerability. API clients can craft a malicious `X-HTTP-Method-Override` header value to bypass JWT authentication in specific cases. ESPv2 allows malicious requests to bypass authentication if both the conditions are true: The requested HTTP method is **not** in the API service definition (OpenAPI spec or gRPC `google.api.http` proto annotations, and the specified `X-HTTP-Method-Override` is a valid HTTP method in the API service definition. ESPv2 will forward the request to your backend without checking the JWT. Attackers can craft requests with a malicious `X-HTTP-Method-Override` value that allows them to bypass specifying JWTs. Restricting API access with API keys works as intended and is not affected by this vulnerability. Upgrade deployments to release v2.43.0 or higher to receive a patch. This release ensures that JWT authentication occurs, even when the caller specifies `x-http-method-override`. `x-http-method-override` is still supported by v2.43.0+. API clients can continue sending this header to ESPv2. | 2023-04-26 | not yet calculated | CVE-2023-30845 MISC MISC MISC MISC |
| microsoft — typed-rest-client |
typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as follows: First, send any request with `BasicCredentialHandler`, `BearerCredentialHandler` or `PersonalAccessTokenCredentialHandler`. Second, the target host may return a redirection (3xx), with a link to a second host. Third, the next request will use the credentials to authenticate with the second host, by setting the `Authorization` header. The expected behavior is that the next request will *NOT* set the `Authorization` header. The problem was fixed in version 1.8.0. There are no known workarounds. | 2023-04-26 | not yet calculated | CVE-2023-30846 MISC MISC |
| h20 — h20 |
H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to processes a certain type of invalid HTTP request, it tries to build an upstream URL by reading from uninitialized pointer. This behavior can lead to crashes or leak of information to back end HTTP servers. Pull request number 3229 fixes the issue. The pull request has been merged to the `master` branch in commit f010336. Users should upgrade to commit f010336 or later. | 2023-04-27 | not yet calculated | CVE-2023-30847 MISC MISC MISC |
| pimcore — pimcore |
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as a workaround, apply the patch manually. | 2023-04-27 | not yet calculated | CVE-2023-30848 MISC MISC MISC |
| pimcore — pimcore |
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually. | 2023-04-27 | not yet calculated | CVE-2023-30849 MISC MISC MISC |
| pimcore — pimcore |
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the admin translations API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually. | 2023-04-27 | not yet calculated | CVE-2023-30850 MISC MISC MISC |
| pimcore — pimcore |
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CSS file read via the `scriptPath` and `scripts` parameters. The `scriptPath` parameter is not sanitized properly and is vulnerable to path traversal attack. Any JavaScript/CSS file from the application server can be read by specifying sufficient number of `../` patterns to go out from the application webroot followed by path of the folder where the file is located in the “scriptPath” parameter and the file name in the “scripts” parameter. The JavaScript file is successfully read only if the web application has read access to it. Users should update to version 10.5.21 to receive a patch or, as a workaround, apply the patch manual. | 2023-04-27 | not yet calculated | CVE-2023-30852 MISC MISC MISC |
| gradle — gradle_build_action |
Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using the Gradle Build Action prior to version 2.4.2 that have executed the Gradle Build Tool with the configuration cache enabled, potentially exposing secrets configured for the repository. Secrets configured for GitHub Actions are normally passed to the Gradle Build Tool via environment variables. Due to the way that the Gradle Build Tool records these environment variables, they may be persisted into an entry in the GitHub Actions cache. This data stored in the GitHub Actions cache can be read by a GitHub Actions workflow running in an untrusted context, such as that running for a Pull Request submitted by a developer via a repository fork. This vulnerability was discovered internally through code review, and we have not seen any evidence of it being exploited in the wild. However, in addition to upgrading the Gradle Build Action, affected users should delete any potentially vulnerable cache entries and may choose to rotate any potentially affected secrets. Gradle Build Action v2.4.2 and newer no longer saves this sensitive data for later use, preventing ongoing leakage of secrets via the GitHub Actions Cache. While upgrading to the latest version of the Gradle Build Action will prevent leakage of secrets going forward, additional actions may be required due to current or previous GitHub Actions Cache entries containing this information. Current cache entries will remain vulnerable until they are forcibly deleted or they expire naturally after 7 days of not being used. Potentially vulnerable entries can be easily identified in the GitHub UI by searching for a cache entry with key matching `configuration-cache-*`. The maintainers recommend that users of the Gradle Build Action inspect their list of cache entries and manually delete any that match this pattern. While maintainers have not seen any evidence of this vulnerability being exploited, they recommend cycling any repository secrets if you cannot be certain that these have not been compromised. Compromise could occur if a user runs a GitHub Actions workflow for a pull request attempting to exploit this data. Warning signs to look for in a pull request include: – Making changes to GitHub Actions workflow files in a way that may attempt to read/extract data from the Gradle User Home or `<project-root>/.gradle` directories. – Making changes to Gradle build files or other executable files that may be invoked by a GitHub Actions workflow, in a way that may attempt to read/extract information from these locations. Some workarounds to limit the impact of this vulnerability are available: – If the Gradle project does not opt-in to using the configuration cache, then it is not vulnerable. – If the Gradle project does opt-in to using the configuration-cache by default, then the `–no-configuration-cache` command-line argument can be used to disable this feature in a GitHub Actions workflow. In any case, we recommend that users carefully inspect any pull request before approving the execution of GitHub Actions workflows. It may be prudent to require approval for all PRs from external contributors. | 2023-04-28 | not yet calculated | CVE-2023-30853 MISC MISC |
| wwbn — avideo |
AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4. | 2023-04-28 | not yet calculated | CVE-2023-30854 MISC |
| gitsquared — edex-ui |
eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX’s internal terminal control websocket, and send arbitrary commands to the shell. The project has been archived since 2021, and as of time of publication there are no plans to patch this issue and release a new version. Some workarounds are available, including shutting down eDEX-UI when browsing the web and ensuring the eDEX terminal runs with lowest possible privileges. | 2023-04-28 | not yet calculated | CVE-2023-30856 MISC MISC MISC |
| aedart — ion |
@aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollution issue for the `MetadataRecord`, when merged with a base class’ metadata object, in `meta` decorator from the `@aedart/support` package. The likelihood of exploitation is questionable, given that a class’s metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can lead to a security impact. The issue has been patched in version `0.6.1`. | 2023-04-28 | not yet calculated | CVE-2023-30857 MISC MISC |
| denosaurs — emoji |
The Denosaurs emoji package provides emojis for dinosaurs. Starting in version 0.1.0 and prior to version 0.3.0, the reTrimSpace regex has 2nd degree polynomial inefficiency, leading to a delayed response given a big payload. The issue has been patched in 0.3.0. As a workaround, avoid using the `replace`, `unemojify`, or `strip` functions. | 2023-04-28 | not yet calculated | CVE-2023-30858 MISC MISC MISC |
| enterprisedb — ebd_postgres_advanced_server_(epas) |
EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used with CREATE/ALTER USER/GROUP/ROLE, and redacting was configured with edb_filter_log.redact_password_commands. The fixed versions are 10.23.33, 11.18.29, 12.13.17, 13.9.13, and 14.6.0. | 2023-04-23 | not yet calculated | CVE-2023-31043 MISC MISC MISC MISC MISC |
| backdrop_cms — backdrop_cms |
** DISPUTED ** A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option. NOTE: the vendor disputes the security relevance of this finding because “any administrator that can configure a text format could easily allow Full HTML anywhere.” | 2023-04-24 | not yet calculated | CVE-2023-31045 MISC MISC |
| repetier_server — repetier_server |
Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLost.php. | 2023-04-24 | not yet calculated | CVE-2023-31059 MISC MISC |
| repetier_server — repetier_server |
Repetier Server through 1.4.10 executes as SYSTEM. This can be leveraged in conjunction with CVE-2023-31059 for full compromise. | 2023-04-24 | not yet calculated | CVE-2023-31060 MISC MISC |
| repetier_server — repetier_server |
Repetier Server through 1.4.10 does not have CSRF protection. | 2023-04-24 | not yet calculated | CVE-2023-31061 MISC MISC |
| linux — kernel |
An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_bridge.c in the Linux kernel 6.2. There is a NULL pointer dereference in vidtv_mux_stop_thread. In vidtv_stop_streaming, after dvb->mux=NULL occurs, it executes vidtv_mux_stop_thread(dvb->mux). | 2023-04-24 | not yet calculated | CVE-2023-31081 MISC |
| linux — kernel |
An issue was discovered in drivers/tty/n_gsm.c in the Linux kernel 6.2. There is a sleeping function called from an invalid context in gsmld_write, which will block the kernel. | 2023-04-24 | not yet calculated | CVE-2023-31082 MISC |
| linux — kernel |
An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur. | 2023-04-24 | not yet calculated | CVE-2023-31083 MISC |
| linux — kernel |
An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process. | 2023-04-24 | not yet calculated | CVE-2023-31084 MISC |
| linux — kernel |
An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0. | 2023-04-24 | not yet calculated | CVE-2023-31085 MISC |
| dradis — dradis |
Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars. | 2023-04-25 | not yet calculated | CVE-2023-31223 CONFIRM |
| drupal — drupal |
The file download facility doesn’t sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating. | 2023-04-26 | not yet calculated | CVE-2023-31250 CONFIRM |
| serenity_software — multiple_products |
An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When users upload temporary files, some specific file endings are not allowed, but it is possible to upload .html or .htm files containing an XSS payload. The resulting link can be sent to an administrator user. | 2023-04-27 | not yet calculated | CVE-2023-31285 MISC |
| serenity_software — multiple_products |
An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist. | 2023-04-27 | not yet calculated | CVE-2023-31286 MISC |
| serenity_software — multiple_products |
An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the corresponding user. The token expires only 3 hours after issuance and is sent as a query parameter when resetting. An attacker with access to the browser history can thus use the token again to change the password in order to take over the account. | 2023-04-27 | not yet calculated | CVE-2023-31287 MISC |
| trust_wallet — wallet_core |
Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input seed, resulting in only four billion possible mnemonics. The affected versions of the browser extension are 0.0.172 through 0.0.182. To steal funds efficiently, an attacker can identify all Ethereum addresses created since the 0.0.172 release, and check whether they are Ethereum addresses that could have been created by this extension. To respond to the risk, affected users need to upgrade the product version and also move funds to a new wallet address. | 2023-04-27 | not yet calculated | CVE-2023-31290 MISC MISC MISC MISC MISC |
| linux — kernel |
qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX. | 2023-04-28 | not yet calculated | CVE-2023-31436 MISC MISC MISC |
| talend — talend_studio |
In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the Jolokia endpoint of the microservice. This allows for remote access to the JVM via the Jolokia JMX-HTTP bridge. | 2023-04-28 | not yet calculated | CVE-2023-31444 MISC MISC |
| smartdns — smartdns |
SmartDNS through 41 before 56d0332 allows an out-of-bounds write because of a stack-based buffer overflow in the _dns_encode_domain function in the dns.c file, via a crafted DNS request. | 2023-04-28 | not yet calculated | CVE-2023-31470 MISC MISC |
| cauldron_development — cbang |
tar/TarFileReader.cpp in Cauldron cbang before bastet-v8.1.17 has a directory traversal during extraction that allows the attacker to create or write to files outside the current directory via a crafted tar archive. | 2023-04-28 | not yet calculated | CVE-2023-31483 MISC MISC |
| http_tiny — http_tiny |
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. | 2023-04-29 | not yet calculated | CVE-2023-31484 MISC MISC MISC MISC MLIST |
| gitlab — gitlab |
GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks. | 2023-04-29 | not yet calculated | CVE-2023-31485 MISC MISC MISC MISC MLIST |
| http_tiny — http_tiny |
HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. | 2023-04-29 | not yet calculated | CVE-2023-31486 MISC MISC MISC MISC MLIST |
