Category: alerts

Cyber Security Monitor Alerts News Notifications. We monitor and send notifications on the latest Cyber Security alerts, blogs, news on data breaches and emerging cyber threats.

alerts

ACSC and CISA Release Business Continuity in a Box

Post author By admin
Post date November 13, 2023

Today, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and CISA released Business Continuity in a Box. Business Continuity in a Box, developed by ACSC with contributions from CISA, assists organizations with swiftly and securely standing up critical business functions during or following a cyber incident.

Comprised of two core components—Continuity of Communications and Continuity of Applications—Business Continuity in a Box is designed for situations where the availability or integrity of an organization’s data and/or systems has been compromised. The core components focus on keeping communications flowing during an incident and establishing interim business-critical applications.

Business Continuity in a Box aligns with CISA’s goals for Critical Infrastructure Security and Resilience Month which aims to provide businesses of all sizes with free or low-cost resources and tools that aid in strengthening our national cybersecurity posture.

alerts

Vulnerability Summary for the Week of October 30, 2023

Post author By admin
Post date November 6, 2023

High Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
contec — solarview_compact_firmware	An issue in Contec SolarView Compact v.6.0 and before allows an attacker to execute arbitrary code via the texteditor.php component.	2023-10-27	9.8	CVE-2023-46509 MISC
dreamsecurity — magicline_4.0	A Buffer overflow vulnerability in DreamSecurity MagicLine4NX versions 1.0.0.1 to 1.0.0.26 allows an attacker to remotely execute code.	2023-10-30	9.8	CVE-2023-45797 MISC
google — android	In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	8.8	CVE-2023-21356 MISC
google — android	In Bluetooth, there is a possibility of code-execution due to a use after free. This could lead to paired device escalation of privilege in the privileged Bluetooth process with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	8.8	CVE-2023-21361 MISC
google — android	In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	8.8	CVE-2023-40129 MISC MISC
google — android	In NFC, there is a possible way to setup a default contactless payment app without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	7.8	CVE-2021-39810 MISC
google — android	In Activity Manager, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	7.8	CVE-2023-21351 MISC
google — android	In libaudioclient, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	7.8	CVE-2023-21355 MISC
google — android	In UWB Google, there is a possible way for a malicious app to masquerade as system app com.android.uwb.resources due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	7.8	CVE-2023-21358 MISC
google — android	In libdexfile, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	7.8	CVE-2023-21372 MISC
google — android	In Telephony, there is a possible way for a guest user to change the preferred SIM due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	7.8	CVE-2023-21373 MISC
google — android	In System UI, there is a possible factory reset protection bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	7.8	CVE-2023-21374 MISC
google — android	In Sysproxy, there is a possible out of bounds write due to an integer underflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	7.8	CVE-2023-21375 MISC
google — android	In Telecomm, there is a possible way to silence the ring for calls of secondary users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	7.8	CVE-2023-21378 MISC
google — android	In Media Resource Manager, there is a possible local arbitrary code execution due to use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	7.8	CVE-2023-21381 MISC
google — android	In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	7.8	CVE-2023-40116 MISC MISC
google — android	In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	7.8	CVE-2023-40117 MISC MISC MISC
google — android	In multiple locations, there is a possible way to bypass user notification of foreground services due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	7.8	CVE-2023-40120 MISC MISC
google — android	In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	7.8	CVE-2023-40125 MISC MISC
google — android	In several functions of xmlregexp.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	7.8	CVE-2023-40128 MISC MISC
google — android	In onBindingDied of CallRedirectionProcessor.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege and background activity launch with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	7.8	CVE-2023-40130 MISC MISC
google — android	In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	7.5	CVE-2023-21347 MISC
google — android	In NFA, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	7.5	CVE-2023-21353 MISC
google — android	In GpuService of GpuService.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	7	CVE-2023-40131 MISC MISC
juzaweb — cms	An issue in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted file to the custom plugin function.	2023-10-28	7.8	CVE-2023-46468 MISC
projectworlds — online_art_gallery	Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ’email’ parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-10-27	9.8	CVE-2023-43738 MISC MISC
projectworlds — online_art_gallery	Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘contact’ parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-10-27	9.8	CVE-2023-44162 MISC MISC
projectworlds — online_art_gallery	Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘add1’ parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-10-27	9.8	CVE-2023-44375 MISC MISC
projectworlds — online_art_gallery	Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘add2’ parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-10-27	9.8	CVE-2023-44376 MISC MISC
projectworlds — online_art_gallery	Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘add3’ parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-10-27	9.8	CVE-2023-44377 MISC MISC
projectworlds — online_bus_booking_system	Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘user_email’ parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45012 MISC MISC
projectworlds — online_bus_booking_system	Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘user_query’ parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45013 MISC MISC
projectworlds — online_bus_booking_system	Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘bus_id’ parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45014 MISC MISC
projectworlds — online_bus_booking_system	Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘date’ parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45015 MISC MISC
projectworlds — online_bus_booking_system	Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘source’ parameter of the search.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45016 MISC MISC
projectworlds — online_bus_booking_system	Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘destination’ parameter of the search.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45017 MISC MISC
projectworlds — online_bus_booking_system	Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘username’ parameter of the includes/login.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45018 MISC MISC
projectworlds — online_bus_booking_system	Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘category’ parameter of the category.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45019 MISC MISC
projectworlds — online_examination_system	Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ’email’ parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45111 MISC MISC
projectworlds — online_examination_system	Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘feedback’ parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45112 MISC MISC
projectworlds — online_examination_system	Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘name’ parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45113 MISC MISC
projectworlds — online_examination_system	Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘subject’ parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45114 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘name’ parameter of the routers/add-item.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45323 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘price’ parameter of the routers/add-item.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45324 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘address’ parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45325 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ’email’ parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45326 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘name’ parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45327 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘password’ parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45328 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘role’ parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45329 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘username’ parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45330 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘contact’ parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45331 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘deleted’ parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45332 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘verified’ parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45333 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘status’ parameter of the routers/edit-orders.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45334 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘id’ parameter of the routers/edit-orders.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45335 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘password’ parameter of the routers/router.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45336 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘username’ parameter of the routers/router.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45337 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘id’ parameter of the routers/add-ticket.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45338 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘type’ parameter of the routers/add-ticket.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45339 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘phone’ parameter of the routers/details-router.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45340 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘*_price’ parameter of the routers/menu-router.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45341 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘phone’ parameter of the routers/register-router.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45342 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘ticket_id’ parameter of the routers/ticket-message.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45343 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘*_balance’ parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45344 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘*_deleted’ parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45345 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘*_role’ parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45346 MISC MISC
projectworlds — online_food_ordering_system	Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘*_verified’ parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-11-02	9.8	CVE-2023-45347 MISC MISC
radare — radare2	An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-dis.h.	2023-10-28	9.8	CVE-2023-46569 MISC MISC
radare — radare2	An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h.	2023-10-28	9.8	CVE-2023-46570 MISC MISC
solarwinds — network_configuration_manager	The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM privileges.	2023-11-01	8	CVE-2023-33226 MISC MISC
solarwinds — network_configuration_manager	The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability This vulnerability allows a low level user to perform the actions with SYSTEM privileges.	2023-11-01	8	CVE-2023-33227 MISC MISC
solarwinds — solarwinds_platform	SolarWinds Platform Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability. If executed, this vulnerability would allow a low-privileged user to execute commands with SYSTEM privileges.	2023-11-01	8	CVE-2023-40062 MISC MISC
solarwinds — solarwinds_platform	Insecure job execution mechanism vulnerability. This vulnerability can lead to other attacks as a result.	2023-11-01	7.1	CVE-2023-40061 MISC
trteksolutions — education_portal	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in TRtek Software Education Portal allows SQL Injection.This issue affects Education Portal: before 3.2023.29.	2023-10-27	9.8	CVE-2023-5807 MISC
zentao — biz	ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF).	2023-10-27	8.8	CVE-2023-46375 MISC
zentao — biz	Zentao Biz version 8.7 and before is vulnerable to Information Disclosure.	2023-10-27	7.5	CVE-2023-46376 MISC
zpesystems — nodegrid_os	ZPE Systems, Inc Nodegrid OS v5.0.0 to v5.0.17, v5.2.0 to v5.2.19, v5.4.0 to v5.4.16, v5.6.0 to v5.6.13, v5.8.0 to v5.8.10, and v5.10.0 to v5.10.3 was discovered to contain a command injection vulnerability via the endpoint /v1/system/toolkit/files/.	2023-10-28	8.8	CVE-2023-43322 CONFIRM

Medium Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
adobe — acrobat_for_edge	Adobe Acrobat for Edge version 118.0.2088.46 (and earlier) is affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2023-10-30	5.5	CVE-2023-44323 MISC
color — demoiccmax	In International Color Consortium DemoIccMAX 79ecb74, CIccCLUT::Interp3d in IccProfLib/IccTagLut.cpp in libSampleICC.a attempts to access array elements at out-of-bounds indexes.	2023-10-30	6.5	CVE-2023-46866 MISC MISC
color — demoiccmax	In International Color Consortium DemoIccMAX 79ecb74, CIccXformMatrixTRC::GetCurve in IccCmm.cpp in libSampleICC.a has a NULL pointer dereference.	2023-10-30	6.5	CVE-2023-46867 MISC MISC
flusity — flusity	A vulnerability, which was classified as problematic, has been found in flusity CMS. This issue affects the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument edit_post_id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 6943991c62ed87c7a57989a0cb7077316127def8. It is recommended to apply a patch to fix this issue. The identifier VDB-243641 was assigned to this vulnerability.	2023-10-27	4.8	CVE-2023-5810 MISC MISC MISC MISC
google — android	In Bluetooth, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	6.7	CVE-2023-21360 MISC
google — android	In the Security Element API, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	6.7	CVE-2023-21370 MISC
google — android	In Secure Element, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	6.7	CVE-2023-21371 MISC
google — android	In Bluetooth, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	6.7	CVE-2023-21380 MISC
google — android	In Bluetooth, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	6.5	CVE-2023-21395 MISC
google — android	In Slice, there is a possible disclosure of installed packages due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	5.5	CVE-2023-21294 MISC
google — android	In Media Projection, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	5.5	CVE-2023-21350 MISC
google — android	In NFA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	5.5	CVE-2023-21352 MISC
google — android	In Package Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	5.5	CVE-2023-21354 MISC
google — android	In Usage, there is a possible permanent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	5.5	CVE-2023-21362 MISC
google — android	In ContactsProvider, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	5.5	CVE-2023-21364 MISC
google — android	In Contacts, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	5.5	CVE-2023-21365 MISC
google — android	In Scudo, there is a possible way for an attacker to predict heap allocation patterns due to insecure implementation/design. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	5.5	CVE-2023-21366 MISC
google — android	In Scudo, there is a possible way to exploit certain heap OOB read/write issues due to an insecure implementation/design. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	5.5	CVE-2023-21367 MISC
google — android	In Audio, there is a possible out of bounds read due to missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	5.5	CVE-2023-21368 MISC
google — android	In Usage Access, there is a possible way to display a Settings usage access restriction toggle screen due to a permissions bypass. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.	2023-10-30	5.5	CVE-2023-21369 MISC
google — android	In Telephony, there is a possible way to retrieve the ICCID due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	5.5	CVE-2023-21376 MISC
google — android	In SELinux Policy, there is a possible restriction bypass due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	5.5	CVE-2023-21377 MISC
google — android	In Content Resolver, there is a possible method to access metadata about existing content providers on the device due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	5.5	CVE-2023-21382 MISC
google — android	In Settings, there is a possible way for the user to unintentionally send extra data due to an unclear prompt. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.	2023-10-30	5.5	CVE-2023-21383 MISC
google — android	In Package Manager, there is a possible possible permissions bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	5.5	CVE-2023-21384 MISC
google — android	In Whitechapel, there is a possible out of bounds read due to memory corruption. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	5.5	CVE-2023-21385 MISC
google — android	In Telecomm, there is a possible bypass of a multiuser security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	5.5	CVE-2023-21394 MISC
google — android	In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	5.5	CVE-2023-40121 MISC MISC
google — android	In updateActionViews of PipMenuView.java, there is a possible bypass of a multiuser security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	5.5	CVE-2023-40123 MISC MISC
google — android	In multiple locations of DialogFillUi.java, there is a possible way to view another user’s images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	5.5	CVE-2023-40133 MISC MISC
google — android	In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	4.4	CVE-2023-21357 MISC
google — android	In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server with System execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	4.4	CVE-2023-21359 MISC
google — android	In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server with System execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	4.4	CVE-2023-21379 MISC
gougucms — gougucms	A stored cross-site scripting (XSS) vulnerability in /home/user/edit_submit of gougucms v4.08.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the headimgurl parameter.	2023-10-27	5.4	CVE-2023-46394 MISC
lenovo — thinkpad_e14_firmware	An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.	2023-10-30	6.7	CVE-2022-48189 MISC
lenovo — thinkpad_x1_fold_gen_1_firmware	An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbitrary code.	2023-10-30	6.7	CVE-2022-4573 MISC
macwk — icecms	IceCMS v2.0.1 is vulnerable to Cross Site Request Forgery (CSRF).	2023-10-27	6.5	CVE-2023-42188 MISC MISC
projectworlds — online_blood_donation_management_system	Online Blood Donation Management System v1.0 is vulnerable to multiple Store Cross-Site Scripting vulnerabilities. The ‘firstName’ parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response.	2023-10-31	6.1	CVE-2023-44484 MISC MISC
projectworlds — online_blood_donation_management_system	Online Blood Donation Management System v1.0 is vulnerable to multiple Store Cross-Site Scripting vulnerabilities. The ‘lastName’ parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response.	2023-10-31	6.1	CVE-2023-44485 MISC MISC
projectworlds — online_blood_donation_management_system	Online Blood Donation Management System v1.0 is vulnerable to multiple Store Cross-Site Scripting vulnerabilities. The ‘address’ parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response.	2023-10-31	6.1	CVE-2023-44486 MISC MISC
projectworlds — online_blood_donation_management_system	Online Blood Donation Management System v1.0 is vulnerable to multiple Store Cross-Site Scripting vulnerabilities. The ‘city’ parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response.	2023-10-31	6.1	CVE-2023-5306 MISC MISC
projectworlds — online_examination_system	Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The ‘q’ parameter of the admin.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.	2023-11-01	6.1	CVE-2023-45201 MISC MISC
projectworlds — online_examination_system	Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The ‘q’ parameter of the feed.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.	2023-11-01	6.1	CVE-2023-45202 MISC MISC
projectworlds — online_examination_system	Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The ‘q’ parameter of the login.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.	2023-11-01	6.1	CVE-2023-45203 MISC MISC
pwncyn — fancms	Cross Site Scripting vulnerability in FanCMS v.1.0.0 allows an attacker to execute arbitrary code via the content1 parameter in the demo.php file.	2023-10-27	6.1	CVE-2023-46505 MISC
pwncyn — yxbookcms	Cross Site Scripting (XSS) vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a remote attacker to execute arbitrary code via the reader management and book input modules.	2023-10-27	6.1	CVE-2023-46503 MISC
pwncyn — yxbookcms	Cross Site Scripting (XSS) vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a physically proximate attacker to execute arbitrary code via the library name function in the general settings component.	2023-10-27	5.4	CVE-2023-46504 MISC
solarwinds — network_configuration_manager	The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to obtain sensitive information.	2023-11-01	4.5	CVE-2023-33228 MISC MISC
wordpress — wordpress	The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the deleteselected function. This makes it possible for unauthenticated attackers to delete sliders in bulk via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-27	6.5	CVE-2023-5821 MISC MISC MISC
wordpress — wordpress	Unauth. Stored Cross-Site Scripting (XSS) vulnerability in UserFeedback Team User Feedback plugin <= 1.0.9 versions.	2023-10-27	6.1	CVE-2023-46153 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin <= 1.7.5 versions.	2023-10-27	6.1	CVE-2023-46194 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.6 versions.	2023-10-27	6.1	CVE-2023-46208 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in G5Theme Grid Plus – Unlimited grid plugin <= 1.3.2 versions.	2023-10-27	6.1	CVE-2023-46209 MISC
wordpress — wordpress	Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder plugin <= 3.19.14 versions.	2023-10-27	5.4	CVE-2023-46211 MISC
wordpress — wordpress	The CallRail Phone Call Tracking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘callrail_form’ shortcode in versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping on the ‘form_id’ user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-27	5.4	CVE-2023-5051 MISC MISC MISC
wordpress — wordpress	The Buzzsprout Podcasting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘buzzsprout’ shortcode in versions up to, and including, 1.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-30	5.4	CVE-2023-5335 MISC MISC
wordpress — wordpress	The Shortcode Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘shortmenu’ shortcode in versions up to, and including, 3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-30	5.4	CVE-2023-5565 MISC MISC
wordpress — wordpress	The Simple Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-30	5.4	CVE-2023-5566 MISC MISC MISC MISC
wordpress — wordpress	The VK Filter Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘vk_filter_search’ shortcode in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-27	5.4	CVE-2023-5705 MISC MISC MISC
wordpress — wordpress	The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcode(s) in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-27	5.4	CVE-2023-5774 MISC MISC MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin <= 2.5 versions.	2023-10-27	4.8	CVE-2023-46091 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in LionScripts.Com Webmaster Tools plugin <= 2.0 versions.	2023-10-27	4.8	CVE-2023-46093 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Internet Marketing Ninjas Internal Link Building plugin <= 1.2.3 versions.	2023-10-27	4.8	CVE-2023-46192 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Triberr plugin <= 4.1.1 versions.	2023-10-27	4.8	CVE-2023-46199 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Stephen Darlington, Wandle Software Limited Smart App Banner plugin <= 1.1.3 versions.	2023-10-27	4.8	CVE-2023-46200 MISC
zentao — biz	ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS).	2023-10-27	6.1	CVE-2023-46374 MISC
zentao — biz	ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library.	2023-10-27	6.1	CVE-2023-46491 MISC

Low Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
google — android	In Game Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	3.3	CVE-2023-21345 MISC
google — android	In the Device Idle Controller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	3.3	CVE-2023-21346 MISC
google — android	In Window Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	3.3	CVE-2023-21348 MISC
google — android	In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	3.3	CVE-2023-21349 MISC
google — android	In multiple locations, there is a possible way to access screenshots due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	3.3	CVE-2023-40127 MISC MISC
google — android	In isFullScreen of FillUi.java, there is a possible way to view another user’s images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	3.3	CVE-2023-40134 MISC MISC
google — android	In applyCustomDescription of SaveUi.java, there is a possible way to view another user’s images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	3.3	CVE-2023-40135 MISC MISC
google — android	In setHeader of DialogFillUi.java, there is a possible way to view another user’s images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	3.3	CVE-2023-40136 MISC MISC
google — android	In multiple functions of DialogFillUi.java, there is a possible way to view another user’s images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	3.3	CVE-2023-40137 MISC MISC
google — android	In FillUi of FillUi.java, there is a possible way to view another user’s images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-27	3.3	CVE-2023-40138 MISC MISC

Severity Not Yet Assigned

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
7-zip — 7-zip	7-Zip through 22.01 on Linux allows an integer underflow and code execution via a crafted 7Z archive.	2023-11-03	not yet calculated	CVE-2023-31102 MISC MISC MISC
addify — addifyfreegifts	SQL injection vulnerability in addify Addifyfreegifts v.1.0.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the getrulebyid function in the AddifyfreegiftsModel.php component.	2023-11-01	not yet calculated	CVE-2023-44025 MISC
artifex_software — jbig2dec	Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.	2023-10-31	not yet calculated	CVE-2023-46361 MISC
asus — rt-ax55	ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system, or terminate services.	2023-11-03	not yet calculated	CVE-2023-41345 MISC
asus — rt-ax55	ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.	2023-11-03	not yet calculated	CVE-2023-41346 MISC
asus — rt-ax55	ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.	2023-11-03	not yet calculated	CVE-2023-41347 MISC
asus — rt-ax55	ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.	2023-11-03	not yet calculated	CVE-2023-41348 MISC
atera — agent_package_availability	The C:WindowsTempAgent.Package.AvailabilityAgent.Package.Availability.exe file is automatically launched as SYSTEM when the system reboots. Since the C:WindowsTempAgent.Package.Availability folder inherits permissions from C:WindowsTemp and Agent.Package.Availability.exe is susceptible to DLL hijacking, standard users can write a malicious DLL to it and elevate their privileges.	2023-10-31	not yet calculated	CVE-2023-37243 MISC
atlassian — confluence_data_center	All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. There is no impact to confidentiality as an attacker cannot exfiltrate any instance data. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.	2023-10-31	not yet calculated	CVE-2023-22518 MISC MISC
authentik — authentik	authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the default admin user, which can also optionally set the default admin users’ password from an environment variable. When the user is deleted, the `initial-setup` flow used to configure authentik after the first installation becomes available again. authentik 2023.8.4 and 2023.10.2 fix this issue. As a workaround, ensure the default admin user (Username `akadmin`) exists and has a password set. It is recommended to use a very strong password for this user and store it in a secure location like a password manager. It is also possible to deactivate the user to prevent any logins as akadmin.	2023-10-31	not yet calculated	CVE-2023-46249 MISC MISC MISC MISC MISC
avahi — avahi	A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.	2023-11-02	not yet calculated	CVE-2023-38469 MISC MISC
avahi — avahi	A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.	2023-11-02	not yet calculated	CVE-2023-38470 MISC MISC
avahi — avahi	A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.	2023-11-02	not yet calculated	CVE-2023-38471 MISC MISC
avahi — avahi	A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.	2023-11-02	not yet calculated	CVE-2023-38472 MISC MISC
avahi — avahi	A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function.	2023-11-02	not yet calculated	CVE-2023-38473 MISC MISC
basercms — basercms	baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload feature of baserCMS. Version 4.8.0 contains a patch for this issue.	2023-10-30	not yet calculated	CVE-2023-43647 MISC MISC MISC
basercms — basercms	baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission data management feature of baserCMS. Version 4.8.0 contains a patch for this issue.	2023-10-30	not yet calculated	CVE-2023-43648 MISC MISC MISC
basercms — basercms	baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue.	2023-10-30	not yet calculated	CVE-2023-43649 MISC MISC MISC
basercms — basercms	baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in the mail form of baserCMS. As of time of publication, no known patched versions are available.	2023-10-30	not yet calculated	CVE-2023-43792 MISC MISC
beijing_yunfan_internet_technology_co.,_ltd — yunfan_learning_examination_system	An issue in Beijing Yunfan Internet Technology Co., Ltd, Yunfan Learning Examination System v.6.5 allows a remote attacker to obtain sensitive information via the password parameter in the login function.	2023-11-04	not yet calculated	CVE-2023-46963 MISC
best_courier_management_system — best_courier_management_system	Best Courier Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the change username field.	2023-10-31	not yet calculated	CVE-2023-46451 MISC MISC
best_courier_management_system — best_courier_management_system	An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the userID parameter.	2023-11-03	not yet calculated	CVE-2023-46980 MISC MISC
best_practical_solutions_llc. — request_tracker	Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder.	2023-11-03	not yet calculated	CVE-2023-45024 MISC CONFIRM
best_practical_solutions_llc. — request_tracker	Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call.	2023-11-03	not yet calculated	CVE-2023-41259 MISC CONFIRM CONFIRM
best_practical_solutions_llc. — request_tracker	Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls.	2023-11-03	not yet calculated	CVE-2023-41260 MISC CONFIRM CONFIRM
bigbluebutton — bigbluebutton	BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension before saving the file, and does not remove it in case of validation failures. BigBlueButton 2.6.0-beta.2 contains a patch. There are no known workarounds.	2023-10-30	not yet calculated	CVE-2023-42803 MISC MISC
bigbluebutton — bigbluebutton	BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.1 has a path traversal vulnerability that allows an attacker with a valid starting folder path, to traverse and read other files without authentication, assuming the files have certain extensions (txt, swf, svg, png). In version 2.6.0-beta.1, input validation was added on the parameters being passed and dangerous characters are stripped. There are no known workarounds.	2023-10-30	not yet calculated	CVE-2023-42804 MISC MISC
bigbluebutton — bigbluebutton	BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.	2023-10-30	not yet calculated	CVE-2023-43797 MISC MISC MISC
bigbluebutton — bigbluebutton	BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Request Forgery (SSRF). This issue is a bypass of CVE-2023-33176. A patch in versions 2.6.12 and 2.7.0-rc.1 disabled follow redirect at `httpclient.execute` since the software no longer has to follow it when using `finalUrl`. There are no known workarounds. We recommend upgrading to a patched version of BigBlueButton.	2023-10-30	not yet calculated	CVE-2023-43798 MISC MISC MISC MISC
bigtree_cms — bigtree_cms	Cross Site Scripting vulnerability in BigTree CMS v.4.5.7 allows a remote attacker to execute arbitrary code via the ID parameter in the Developer Settings functions.	2023-11-01	not yet calculated	CVE-2023-44954 MISC MISC
bitrix24 — bitrix24	Insecure temporary file creation in bitrix/modules/crm/lib/order/import/instagram.php in Bitrix24 22.0.300 hosted on Apache HTTP Server allows remote authenticated attackers to execute arbitrary code via uploading a crafted “.htaccess” file.	2023-11-01	not yet calculated	CVE-2023-1713 MISC
bitrix24 — bitrix24	Unsafe variable extraction in bitrix/modules/main/classes/general/user_options.php in Bitrix24 22.0.300 allows remote authenticated attackers to execute arbitrary code via (1) appending arbitrary content to existing PHP files or (2) PHAR deserialization.	2023-11-01	not yet calculated	CVE-2023-1714 MISC
bitrix24 — bitrix24	A logic error when using mb_strpos() to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitization via placing HTML tags at the beginning of the payload.	2023-11-01	not yet calculated	CVE-2023-1715 MISC
bitrix24 — bitrix24	Cross-site scripting (XSS) vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege.	2023-11-01	not yet calculated	CVE-2023-1716 MISC
bitrix24 — bitrix24	Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.	2023-11-01	not yet calculated	CVE-2023-1717 MISC
bitrix24 — bitrix24	Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause denial-of-service via a crafted “tmp_url”.	2023-11-01	not yet calculated	CVE-2023-1718 MISC
bitrix24 — bitrix24	Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialized variables.	2023-11-01	not yet calculated	CVE-2023-1719 MISC
bitrix24 — bitrix24	Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via uploading a crafted HTML file through /desktop_app/file.ajax.php?action=uploadfile.	2023-11-01	not yet calculated	CVE-2023-1720 MISC
bluespice — bluespiceavatars	Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This only applies to the genuine user context.	2023-10-30	not yet calculated	CVE-2023-42431 MISC
bon_presta — boninstagramcarousel	Bon Presta boninstagramcarousel between v5.2.1 to v7.0.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at insta_parser.php. This vulnerability allows attackers to use the vulnerable website as proxy to attack other websites or exfiltrate data via a HTTP call.	2023-11-03	not yet calculated	CVE-2023-43982 MISC
boomerang_parental_control — boomerang_parental_control	An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup=”false” attribute in the manifest. This allows the user to back up the internal memory of the app to a PC. This gives the user access to the API token that is used to authenticate requests to the API.	2023-11-03	not yet calculated	CVE-2023-36620 MISC MISC MISC
boomerang_parental_control — boomerang_parental_control	An issue was discovered in the Boomerang Parental Control application through 13.83 for Android. The child can use Safe Mode to remove all restrictions temporarily or uninstall the application without the parents noticing.	2023-11-03	not yet calculated	CVE-2023-36621 MISC MISC MISC
botan — botan	bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it easier for attackers to determine the cleartext password.	2023-11-03	not yet calculated	CVE-2017-7252 CONFIRM MISC
campcodes — simple_student_information_system	A vulnerability classified as critical has been found in Campcodes Simple Student Information System 1.0. This affects an unknown part of the file /admin/index.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-244323.	2023-11-02	not yet calculated	CVE-2023-5923 MISC MISC MISC
campcodes — simple_student_information_system	A vulnerability classified as critical was found in Campcodes Simple Student Information System 1.0. This vulnerability affects unknown code of the file /admin/courses/view_course.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-244324.	2023-11-02	not yet calculated	CVE-2023-5924 MISC MISC MISC
campcodes — simple_student_information_system	A vulnerability, which was classified as critical, has been found in Campcodes Simple Student Information System 1.0. This issue affects some unknown processing of the file /classes/Master.php. The manipulation of the argument f leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-244325 was assigned to this vulnerability.	2023-11-02	not yet calculated	CVE-2023-5925 MISC MISC MISC
campcodes — simple_student_information_system	A vulnerability, which was classified as critical, was found in Campcodes Simple Student Information System 1.0. Affected is an unknown function of the file /admin/students/update_status.php. The manipulation of the argument student_id leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-244326 is the identifier assigned to this vulnerability.	2023-11-02	not yet calculated	CVE-2023-5926 MISC MISC MISC
campcodes — simple_student_information_system	A vulnerability has been found in Campcodes Simple Student Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/courses/manage_course.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-244327.	2023-11-02	not yet calculated	CVE-2023-5927 MISC MISC MISC
campcodes — simple_student_information_system	A vulnerability was found in Campcodes Simple Student Information System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/departments/manage_department.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-244328.	2023-11-02	not yet calculated	CVE-2023-5928 MISC MISC MISC
campcodes — simple_student_information_system	A vulnerability was found in Campcodes Simple Student Information System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/students/manage_academic.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-244329 was assigned to this vulnerability.	2023-11-02	not yet calculated	CVE-2023-5929 MISC MISC MISC
campcodes — simple_student_information_system	A vulnerability was found in Campcodes Simple Student Information System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/students/manage_academic.php. The manipulation of the argument student_id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-244330 is the identifier assigned to this vulnerability.	2023-11-02	not yet calculated	CVE-2023-5930 MISC MISC MISC
chef_automate –chef_automate	Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution.	2023-10-31	not yet calculated	CVE-2023-40050 MISC MISC MISC
chef_inspec — chef_inspec	Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.	2023-10-31	not yet calculated	CVE-2023-42658 MISC MISC MISC
chinghwa_telecom — nokia	Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenticated remote attacker can execute a crafted Javascript to expose captcha in page, making it very easy for bots to bypass the captcha check and more susceptible to brute force attacks.	2023-11-03	not yet calculated	CVE-2023-41350 MISC
chunghwa_telecom — nokia	Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the authentication mechanism to log in to the device by an alternative URL. This makes it possible for unauthenticated remote attackers to log in as any existing users, such as an administrator, to perform arbitrary system operations or disrupt service.	2023-11-03	not yet calculated	CVE-2023-41351 MISC
chunghwa_telecom — nokia	Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.	2023-11-03	not yet calculated	CVE-2023-41352 MISC
chunghwa_telecom — nokia	Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements. A remote attacker with regular user privilege can easily infer the administrator password from system information after logging system, resulting in admin access and performing arbitrary system operations or disrupt service.	2023-11-03	not yet calculated	CVE-2023-41353 MISC
chunghwa_telecom — nokia	Chunghwa Telecom NOKIA G-040W-Q Firewall function does not block ICMP TIMESTAMP requests by default, an unauthenticated remote attacker can exploit this vulnerability by sending a crafted package, resulting in partially sensitive information exposed to an actor.	2023-11-03	not yet calculated	CVE-2023-41354 MISC
chunghwa_telecom — nokia	Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted package to modify the network routing table, resulting in a denial of service or sensitive information leaking.	2023-11-03	not yet calculated	CVE-2023-41355 MISC
cisco — cisco_adaptive_security_appliance/firepower_threat_defense_software	A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an implementation error within the SSL/TLS session handling process that can prevent the release of a session handler under specific conditions. An attacker could exploit this vulnerability by sending crafted SSL/TLS traffic to an affected device, increasing the probability of session handler leaks. A successful exploit could allow the attacker to eventually deplete the available session handler pool, preventing new sessions from being established and causing a DoS condition.	2023-11-01	not yet calculated	CVE-2023-20042 MISC
cisco — cisco_adaptive_security_appliance/firepower_threat_defense_software	A vulnerability in ICMPv6 processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper processing of ICMPv6 messages. An attacker could exploit this vulnerability by sending crafted ICMPv6 messages to a targeted Cisco ASA or FTD system with IPv6 enabled. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.	2023-11-01	not yet calculated	CVE-2023-20086 MISC
cisco — cisco_adaptive_security_appliance/firepower_threat_defense_software	A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of HTTPS requests. An attacker could exploit this vulnerability by sending crafted HTTPS requests to an affected system. A successful exploit could allow the attacker to cause resource exhaustion, resulting in a DoS condition.	2023-11-01	not yet calculated	CVE-2023-20095 MISC
cisco — cisco_adaptive_security_appliance/firepower_threat_defense_software	Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should be denied to flow through an affected device. These vulnerabilities are due to a logic error that could occur when the affected software constructs and applies per-user-override rules. An attacker could exploit these vulnerabilities by connecting to a network through an affected device that has a vulnerable configuration. A successful exploit could allow the attacker to bypass the interface ACL and access resources that should be protected.	2023-11-01	not yet calculated	CVE-2023-20245 MISC
cisco — cisco_adaptive_security_appliance/firepower_threat_defense_software	A vulnerability in the remote access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to bypass a configured multiple certificate authentication policy and connect using only a valid username and password. This vulnerability is due to improper error handling during remote access VPN authentication. An attacker could exploit this vulnerability by sending crafted requests during remote access VPN session establishment. A successful exploit could allow the attacker to bypass the configured multiple certificate authentication policy while retaining the privileges and permissions associated with the original connection profile.	2023-11-01	not yet calculated	CVE-2023-20247 MISC
cisco — cisco_adaptive_security_appliance/firepower_threat_defense_software	Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should be denied to flow through an affected device. These vulnerabilities are due to a logic error that could occur when the affected software constructs and applies per-user-override rules. An attacker could exploit these vulnerabilities by connecting to a network through an affected device that has a vulnerable configuration. A successful exploit could allow the attacker to bypass the interface ACL and access resources that would should be protected.	2023-11-01	not yet calculated	CVE-2023-20256 MISC
cisco — cisco_adaptive_security_appliance/firepower_threat_defense_software	A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 single sign-on (SSO) for remote access VPN in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to intercept the SAML assertion of a user who is authenticating to a remote access VPN session. This vulnerability is due to insufficient validation of the login URL. An attacker could exploit this vulnerability by persuading a user to access a site that is under the control of the attacker, allowing the attacker to modify the login URL. A successful exploit could allow the attacker to intercept a successful SAML assertion and use that assertion to establish a remote access VPN session toward the affected device with the identity and permissions of the hijacked user, resulting in access to the protected network.	2023-11-01	not yet calculated	CVE-2023-20264 MISC
cisco — cisco_firepower_management_center	Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by inserting crafted input into various data fields in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface, or access sensitive, browser-based information. In some cases, it is also possible to cause a temporary availability impact to portions of the FMC Dashboard.	2023-11-01	not yet calculated	CVE-2023-20005 MISC
cisco — cisco_firepower_management_center	Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by inserting crafted input into various data fields in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface, or access sensitive, browser-based information. In some cases, it is also possible to cause a temporary availability impact to portions of the FMC Dashboard.	2023-11-01	not yet calculated	CVE-2023-20041 MISC
cisco — cisco_firepower_management_center	A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute certain unauthorized configuration commands on a Firepower Threat Defense (FTD) device that is managed by the FMC Software. This vulnerability is due to insufficient authorization of configuration commands that are sent through the web service interface. An attacker could exploit this vulnerability by authenticating to the FMC web services interface and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to execute certain configuration commands on the targeted FTD device. To successfully exploit this vulnerability, an attacker would need valid credentials on the FMC Software.	2023-11-01	not yet calculated	CVE-2023-20048 MISC
cisco — cisco_firepower_management_center	A vulnerability in the inter-device communication mechanisms between devices that are running Cisco Firepower Threat Defense (FTD) Software and devices that are running Cisco Firepower Management (FMC) Software could allow an authenticated, local attacker to execute arbitrary commands with root permissions on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by accessing the expert mode of an affected device and submitting specific commands to a connected system. A successful exploit could allow the attacker to execute arbitrary code in the context of an FMC device if the attacker has administrative privileges on an associated FTD device. Alternatively, a successful exploit could allow the attacker to execute arbitrary code in the context of an FTD device if the attacker has administrative privileges on an associated FMC device.	2023-11-01	not yet calculated	CVE-2023-20063 MISC
cisco — cisco_firepower_management_center	Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by inserting crafted input into various data fields in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface, or access sensitive, browser-based information. In some cases, it is also possible to cause a temporary availability impact to portions of the FMC Dashboard.	2023-11-01	not yet calculated	CVE-2023-20074 MISC
cisco — cisco_firepower_management_center	A vulnerability in the file download feature of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to download arbitrary files from an affected system. This vulnerability is due to a lack of input sanitation. An attacker could exploit this vulnerability by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from the affected system.	2023-11-01	not yet calculated	CVE-2023-20114 MISC
cisco — cisco_firepower_management_center	A vulnerability in a logging API in Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to cause the device to become unresponsive or trigger an unexpected reload. This vulnerability could also allow an attacker with valid user credentials, but not Administrator privileges, to view a system log file that they would not normally have access to. This vulnerability is due to a lack of rate-limiting of requests that are sent to a specific API that is related to an FMC log. An attacker could exploit this vulnerability by sending a high rate of HTTP requests to the API. A successful exploit could allow the attacker to cause a denial of service (DoS) condition due to the FMC CPU spiking to 100 percent utilization or to the device reloading. CPU utilization would return to normal if the attack traffic was stopped before an unexpected reload was triggered.	2023-11-01	not yet calculated	CVE-2023-20155 MISC
cisco — cisco_firepower_management_center	Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by inserting crafted input into various data fields in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface, or access sensitive, browser-based information. In some cases, it is also possible to cause a temporary availability impact to portions of the FMC Dashboard.	2023-11-01	not yet calculated	CVE-2023-20206 MISC
cisco — cisco_firepower_management_center	Multiple vulnerabilities in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. The attacker would need valid device credentials but does not require administrator privileges to exploit this vulnerability. These vulnerabilities are due to insufficient validation of user-supplied input for certain configuration options. An attacker could exploit these vulnerabilities by using crafted input within the device configuration GUI. A successful exploit could allow the attacker to execute arbitrary commands on the device including the underlying operating system which could also affect the availability of the device.	2023-11-01	not yet calculated	CVE-2023-20219 MISC
cisco — cisco_firepower_management_center	Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. To exploit these vulnerabilities, the attacker must have valid device credentials, but does not need Administrator privileges. These vulnerabilities are due to insufficient validation of user-supplied input for certain configuration options. An attacker could exploit these vulnerabilities by using crafted input within the device configuration GUI. A successful exploit could allow the attacker to execute arbitrary commands on the device, including on the underlying operating system, which could also affect the availability of the device.	2023-11-01	not yet calculated	CVE-2023-20220 MISC
cisco — cisco_firepower_threat_defense_software	A vulnerability in the SSL/TLS certificate handling of Snort 3 Detection Engine integration with Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart. This vulnerability is due to a logic error that occurs when an SSL/TLS certificate that is under load is accessed when it is initiating an SSL connection. Under specific, time-based constraints, an attacker could exploit this vulnerability by sending a high rate of SSL/TLS connection requests to be inspected by the Snort 3 detection engine on an affected device. A successful exploit could allow the attacker to cause the Snort 3 detection engine to reload, resulting in either a bypass or a denial of service (DoS) condition, depending on device configuration. The Snort detection engine will restart automatically. No manual intervention is required.	2023-11-01	not yet calculated	CVE-2023-20031 MISC
cisco — cisco_firepower_threat_defense_software	A vulnerability in the TLS 1.3 implementation of the Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to unexpectedly restart. This vulnerability is due to a logic error in how memory allocations are handled during a TLS 1.3 session. Under specific, time-based constraints, an attacker could exploit this vulnerability by sending a crafted TLS 1.3 message sequence through an affected device. A successful exploit could allow the attacker to cause the Snort 3 detection engine to reload, resulting in a denial of service (DoS) condition. While the Snort detection engine reloads, packets going through the FTD device that are sent to the Snort detection engine will be dropped. The Snort detection engine will restart automatically. No manual intervention is required.	2023-11-01	not yet calculated	CVE-2023-20070 MISC
cisco — cisco_firepower_threat_defense_software	A vulnerability in ICMPv6 inspection when configured with the Snort 2 detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the CPU of an affected device to spike to 100 percent, which could stop all traffic processing and result in a denial of service (DoS) condition. FTD management traffic is not affected by this vulnerability. This vulnerability is due to improper error checking when parsing fields within the ICMPv6 header. An attacker could exploit this vulnerability by sending a crafted ICMPv6 packet through an affected device. A successful exploit could allow the attacker to cause the device to exhaust CPU resources and stop processing traffic, resulting in a DoS condition. Note: To recover from the DoS condition, the Snort 2 Detection Engine or the Cisco FTD device may need to be restarted.	2023-11-01	not yet calculated	CVE-2023-20083 MISC
cisco — cisco_firepower_threat_defense_software	A vulnerability in the SSL file policy implementation of Cisco Firepower Threat Defense (FTD) Software that occurs when the SSL/TLS connection is configured with a URL Category and the Snort 3 detection engine could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to unexpectedly restart. This vulnerability exists because a logic error occurs when a Snort 3 detection engine inspects an SSL/TLS connection that has either a URL Category configured on the SSL file policy or a URL Category configured on an access control policy with TLS server identity discovery enabled. Under specific, time-based constraints, an attacker could exploit this vulnerability by sending a crafted SSL/TLS connection through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 detection engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. The Snort 3 detection engine will restart automatically. No manual intervention is required.	2023-11-01	not yet calculated	CVE-2023-20177 MISC
cisco — cisco_firepower_threat_defense_software	A vulnerability in the internal packet processing of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Firewalls could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain packets when they are sent to the inspection engine. An attacker could exploit this vulnerability by sending a series of crafted packets to an affected device. A successful exploit could allow the attacker to deplete all 9,472 byte blocks on the device, resulting in traffic loss across the device or an unexpected reload of the device. If the device does not reload on its own, a manual reload of the device would be required to recover from this state.	2023-11-01	not yet calculated	CVE-2023-20244 MISC
cisco — cisco_firepower_threat_defense_software	A vulnerability in the IP geolocation rules of Snort 3 could allow an unauthenticated, remote attacker to potentially bypass IP address restrictions. This vulnerability exists because the configuration for IP geolocation rules is not parsed properly. An attacker could exploit this vulnerability by spoofing an IP address until they bypass the restriction. A successful exploit could allow the attacker to bypass location-based IP address restrictions.	2023-11-01	not yet calculated	CVE-2023-20267 MISC
cisco — cisco_firepower_threat_defense_software	A vulnerability in the interaction between the Server Message Block (SMB) protocol preprocessor and the Snort 3 detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the configured policies or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error-checking when the Snort 3 detection engine is processing SMB traffic. An attacker could exploit this vulnerability by sending a crafted SMB packet stream through an affected device. A successful exploit could allow the attacker to cause the Snort process to reload, resulting in a DoS condition.	2023-11-01	not yet calculated	CVE-2023-20270 MISC
cisco — cisco_identity_services_engine_software	A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit could allow the attacker to elevate privileges to root.	2023-11-01	not yet calculated	CVE-2023-20170 MISC
cisco — cisco_identity_services_engine_software	A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, an attacker must have valid Read-only-level privileges or higher on the affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit could allow the attacker to elevate privileges to root.	2023-11-01	not yet calculated	CVE-2023-20175 MISC
cisco — cisco_identity_services_engine_software	Two vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit these vulnerabilities, an attacker must have valid Administrator credentials on the affected device. These vulnerabilities are due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit these vulnerabilities by uploading a crafted file to an affected device. A successful exploit could allow the attacker to store malicious files in specific directories on the device. The attacker could later use those files to conduct additional attacks, including executing arbitrary code on the affected device with root privileges.	2023-11-01	not yet calculated	CVE-2023-20195 MISC
cisco — cisco_identity_services_engine_software	Two vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit these vulnerabilities, an attacker must have valid Administrator credentials on the affected device. These vulnerabilities are due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit these vulnerabilities by uploading a crafted file to an affected device. A successful exploit could allow the attacker to store malicious files in specific directories on the device. The attacker could later use those files to conduct additional attacks, including executing arbitrary code on the affected device with root privileges.	2023-11-01	not yet calculated	CVE-2023-20196 MISC
cisco — cisco_identity_services_engine_software	A vulnerability in the CDP processing feature of Cisco ISE could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition of the CDP process on an affected device. This vulnerability is due to insufficient bounds checking when an affected device processes CDP traffic. An attacker could exploit this vulnerability by sending crafted CDP traffic to the device. A successful exploit could cause the CDP process to crash, impacting neighbor discovery and the ability of Cisco ISE to determine the reachability of remote devices. After a crash, the CDP process must be manually restarted using the cdp enable command in interface configuration mode.	2023-11-01	not yet calculated	CVE-2023-20213 MISC
cisco — cisco_meeting_server	A vulnerability in an API of the Web Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP packets to an affected device. A successful exploit could allow the attacker to cause a partial availability condition, which could cause ongoing video calls to be dropped due to the invalid packets reaching the Web Bridge.	2023-11-01	not yet calculated	CVE-2023-20255 MISC
cisco — multiple_products	Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. This vulnerability is due to a flaw in the FTP module of the Snort detection engine. An attacker could exploit this vulnerability by sending crafted FTP traffic through an affected device. A successful exploit could allow the attacker to bypass FTP inspection and deliver a malicious payload.	2023-11-01	not yet calculated	CVE-2023-20071 MISC
cisco — multiple_products	Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. This vulnerability is due to a logic error that occurs when the access control policies are being populated. An attacker could exploit this vulnerability by establishing a connection to an affected device. A successful exploit could allow the attacker to bypass configured access control rules on the affected system.	2023-11-01	not yet calculated	CVE-2023-20246 MISC
click_studios_pty_ltd — passwordstate	Cross Site Request Forgery vulnerability in Click Studios (SA) Pty Ltd Passwordstate v.Build 9785 and before allows a local attacker to execute arbitrary code via a crafted request.	2023-10-31	not yet calculated	CVE-2023-43295 MISC
cloudexplorer_lite — cloudexplorer_lite	CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller with path starting with `matching/API/`, which can cause a permission bypass. Version 1.4.1 contains a patch for this issue.	2023-10-30	not yet calculated	CVE-2023-44397 MISC
codeigniter — codeigniter	CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set(‘display_errors’, ‘0’)` with `ini_set(‘display_errors’, ‘Off’)` in `app/Config/Boot/production.php`.	2023-10-31	not yet calculated	CVE-2023-46240 MISC MISC MISC
crater — crater	/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image.	2023-10-30	not yet calculated	CVE-2023-46865 MISC MISC
cybozu– remote_service	Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.1.0 to 4.1.1 allows a remote authenticated attacker to consume huge storage space or cause significantly delayed communication.	2023-11-01	not yet calculated	CVE-2023-46278 MISC MISC
daiky-value.fukuten — daiky-value.fukuten	An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.	2023-11-02	not yet calculated	CVE-2023-39050 MISC MISC
dell — powerscale_onefs	Dell PowerScale OneFS 8.2.x,9.0.0.x-9.5.0.x contains a denial-of-service vulnerability. A low privilege remote attacker could potentially exploit this vulnerability to cause an out of memory (OOM) condition.	2023-11-02	not yet calculated	CVE-2023-43076 MISC
dell — powerscale_onefs	Dell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of insufficient permissions. A low privileged remote attacker could potentially exploit this vulnerability to cause information disclosure.	2023-11-02	not yet calculated	CVE-2023-43087 MISC
demonisblack –demon_image_annotation	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Demonisblack demon image annotation allows SQL Injection. This issue affects demon image annotation: from n/a through 5.1.	2023-11-04	not yet calculated	CVE-2023-40215 MISC
devolutions — devolutions_server	Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries they are not allowed to access via the report request url query parameters.	2023-11-01	not yet calculated	CVE-2023-5358 MISC
devolutions — remote_desktop_manager	Improper access control in the password analyzer feature in Devolutions Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to bypass permissions via data source switching.	2023-11-01	not yet calculated	CVE-2023-5765 MISC
devolutions — remote_desktop_manager	A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to remotely execute code from another windows user session on the same host via a specially crafted TCP packet.	2023-11-01	not yet calculated	CVE-2023-5766 MISC
django — django	In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.	2023-11-03	not yet calculated	CVE-2023-41164 CONFIRM MISC MISC FEDORA
django — django	In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.	2023-11-03	not yet calculated	CVE-2023-43665 CONFIRM MISC MISC FEDORA
django — django	An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.	2023-11-02	not yet calculated	CVE-2023-46695 MISC MISC CONFIRM
dm_service — dm_service	In dm service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42644 MISC
dm_service — dm_service	In dm service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42654 MISC
dmpop_mejiro_commit — dmpop_mejiro_commit	Reflected Cross-Site Scripting (XSS) vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code via crafted string in metadata of uploaded images.	2023-11-01	not yet calculated	CVE-2023-46448 MISC MISC
dolibarr — dolibarr	Cross-site Scripting (XSS) – Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5.	2023-10-30	not yet calculated	CVE-2023-5842 MISC MISC
dolibarr — erp_crm	Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.	2023-11-01	not yet calculated	CVE-2023-4197 MISC MISC
dolibarr — erp_crm	Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data	2023-11-01	not yet calculated	CVE-2023-4198 MISC MISC
douhaocms — douhaocms	Cross Site Request Forgery (CSRF) vulnerability in DouHaocms v.3.3 allows a remote attacker to execute arbitrary code via the adminAction.class.php file.	2023-10-30	not yet calculated	CVE-2023-42323 MISC
dromara — lamp-cloud	Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token.	2023-11-02	not yet calculated	CVE-2023-31579 MISC MISC
eclipse_foundation — glassfish	In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners.	2023-11-03	not yet calculated	CVE-2023-5763 MISC MISC
eclipse_foundation — parsson	In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.	2023-11-03	not yet calculated	CVE-2023-4043 MISC MISC
elenos — etg150_fm_transmitter	An issue discovered in Elenos ETG150 FM transmitter v3.12 allows attackers to enumerate user accounts based on server responses when credentials are submitted.	2023-10-31	not yet calculated	CVE-2023-37831 MISC
elenos — etg150_fm_transmitter	A lack of rate limiting in Elenos ETG150 FM transmitter v3.12 allows attackers to obtain user credentials via brute force and cause other unspecified impacts.	2023-10-31	not yet calculated	CVE-2023-37832 MISC
elenos — etg150_fm_transmitter	Improper access control in Elenos ETG150 FM transmitter v3.12 allows attackers to make arbitrary configuration edits that are only accessed by privileged users.	2023-10-31	not yet calculated	CVE-2023-37833 MISC
elenos — etg150_fm_transmitter	Insufficient session expiration in Elenos ETG150 FM Transmitter v3.12 allows attackers to arbitrarily change transmitter configuration and data after logging out.	2023-10-31	not yet calculated	CVE-2023-39695 MISC
engineermode — engineermode	In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42648 MISC
engineermode — engineermode	In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42649 MISC
engineermode — engineermode	In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42650 MISC
engineermode — engineermode	In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42651 MISC
engineermode — engineermode	In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42652 MISC
exfatprogs — exfatprogs	exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.	2023-10-28	not yet calculated	CVE-2023-45897 MISC MISC MISC MISC MISC
faceid_service — faceid_service	In faceid service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges	2023-11-01	not yet calculated	CVE-2023-42653 MISC
fireflow — fireflow	Net-NTLM leak in Fireflow A32.20 and A32.50 allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks.	2023-11-02	not yet calculated	CVE-2023-46595 MISC
flyte — flyteadmin	FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list filters. The attacker needs to have access to the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for this issue.	2023-10-30	not yet calculated	CVE-2023-41891 MISC MISC MISC
fog — fog	FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the logs, they would be parsed as HTML and displayed accordingly. Version 1.5.10.15 contains a patch. As a workaround, view logs from an external text editor rather than the dashboard.	2023-10-31	not yet calculated	CVE-2023-46235 MISC MISC
fog — fog	FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch.	2023-10-31	not yet calculated	CVE-2023-46236 MISC MISC
fog — fog	FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.	2023-10-31	not yet calculated	CVE-2023-46237 MISC MISC
foodcoopshop — foodcoopshop	FoodCoopShop is open source software for food coops and local shops. Versions prior to 3.6.1 are vulnerable to server-side request forgery. In the Network module, a manufacturer account can use the `/api/updateProducts.json` endpoint to make the server send a request to an arbitrary host. This means that the server can be used as a proxy into the internal network where the server is. Furthermore, the checks on a valid image are not adequate, leading to a time of check time of use issue. For example, by using a custom server that returns 200 on HEAD requests, then return a valid image on first GET request and then a 302 redirect to final target on second GET request, the server will copy whatever file is at the redirect destination, making this a full SSRF. Version 3.6.1 fixes this vulnerability.	2023-11-02	not yet calculated	CVE-2023-46725 MISC MISC MISC MISC
franfinance — franfinance	An issue in franfinance before v.2.0.27 allows a remote attacker to execute arbitrary code via the validation.php, and controllers/front/validation.php components.	2023-10-31	not yet calculated	CVE-2023-43139 MISC
franklin_fueling_system — ts-550	Franklin Fueling System TS-550 versions prior to 1.9.23.8960 are vulnerable to attackers decoding admin credentials, resulting in unauthenticated access to the device.	2023-11-02	not yet calculated	CVE-2023-5846 MISC
frigate — frigate	Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the `config/save` and `config/set` endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server (e.g. via “drive-by” attack). Exploiting this vulnerability requires the attacker to both know very specific information about a user’s Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could be exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user’s Frigate instance; attacker crafts a specialized page which links to the user’s Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. This issue can lead to arbitrary configuration updates for the Frigate server, resulting in denial of service and possible data exfiltration. Version 0.13.0 Beta 3 contains a patch.	2023-10-30	not yet calculated	CVE-2023-45670 MISC MISC MISC MISC MISC
frigate — frigate	Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the `/<camera_name>` base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both know very specific information about a user’s Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could be exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user’s Frigate instance; attacker crafts a specialized page which links to the user’s Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. As the reflected values included in the URL are not sanitized or escaped, this permits execution arbitrary Javascript payloads. Version 0.13.0 Beta 3 contains a patch for this issue.	2023-10-30	not yet calculated	CVE-2023-45671 MISC
frigate — frigate	Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate. This can lead to unauthenticated remote code execution. This can be performed through the UI at `/config` or through a direct call to `/api/config/save`. Exploiting this vulnerability requires the attacker to both know very specific information about a user’s Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could be exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user’s Frigate instance; attacker crafts a specialized page which links to the user’s Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. Input is initially accepted through `http.py`. The user-provided input is then parsed and loaded by `load_config_with_no_duplicates`. However, `load_config_with_no_duplicates` does not sanitize this input by merit of using `yaml.loader.Loader` which can instantiate custom constructors. A provided payload will be executed directly at `frigate/util/builtin.py:110`. This issue may lead to pre-authenticated Remote Code Execution. Version 0.13.0 Beta 3 contains a patch.	2023-10-30	not yet calculated	CVE-2023-45672 MISC MISC MISC MISC
frrouting_frr — frrouting_frr	An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path attributes).	2023-11-03	not yet calculated	CVE-2023-47234 MISC
frrouting_frr — frrouting_frr	An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw outcome.	2023-11-03	not yet calculated	CVE-2023-47235 MISC
fujifilm_business_inovation_corp. — apeos_c3070_asia_pacific_model	Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their Address Book with encrypted form, but the encryption strength is insufficient. With the knowledge of the encryption process and the encryption key, the information such as the server credentials may be obtained from the exported Address Book data. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].	2023-11-02	not yet calculated	CVE-2023-46327 MISC MISC MISC
galaxy_software_services_corporation — vitals_esp	Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary directories to perform arbitrary system operations or disrupt service.	2023-11-03	not yet calculated	CVE-2023-41357 MISC
gawk — gawk	A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.	2023-11-02	not yet calculated	CVE-2023-3164 MISC MISC
getsimplecms — getsimplecms	Cross Site Scripting vulnerability in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the components.php function.	2023-10-31	not yet calculated	CVE-2023-46040 MISC
glpi — glpi	GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and available system libraries, malicious PHP files can then be executed through a web server request. Version 10.0.10 fixes this issue. As a workaround, remove write access on `/ajax` and `/front` files to the web server.	2023-11-02	not yet calculated	CVE-2023-42802 MISC MISC
gnss_service — gnss_service	In gnss service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42750 MISC
google — android	In Bluetooth, there is a possible way for a paired Bluetooth device to access a long-term identifier for an Android device due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21307 MISC
google — android	In collapse of canonicalize_md.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-40101 MISC
google — android	KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device is infected with a malware whose app signing block specially constructed, it can take over root privileges on the device. The vulnerable verification logic actually obtains the signature of the last block with an id of `0x7109871a`, while the verification logic during Android installation is to obtain the first one. In addition to the actual signature upgrade that has been fixed (KSU thought it was V2 but was actually V3), there is also the problem of actual signature downgrading (KSU thought it was V2 but was actually V1). Find a condition in the signature verification logic that will cause the signature not to be found error, and KernelSU does not implement the same conditions, so KSU thinks there is a V2 signature, but the APK signature verification actually uses the V1 signature. This issue is fixed in version 0.7.0. As workarounds, keep the KernelSU manager installed and avoid installing unknown apps.	2023-10-31	not yet calculated	CVE-2023-46139 MISC MISC MISC MISC MISC MISC MISC
google — android	In Usage Stats Service, there is a possible way to determine whether an app is installed, without query permissions due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2022-20264 MISC
google — android	In PackageManagerNative, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21293 MISC
google — android	In SliceManagerService, there is a possible way to check if a content provider is installed due to a missing null check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21295 MISC
google — android	In Permission, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21296 MISC
google — android	In SEPolicy, there is a possible way to access the factory MAC address due to a permissions bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21297 MISC
google — android	In Slice, there is a possible disclosure of installed applications due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21298 MISC
google — android	In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21299 MISC
google — android	In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21300 MISC
google — android	In ActivityManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21301 MISC
google — android	In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21302 MISC
google — android	In Content, here is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21303 MISC
google — android	In Content Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21304 MISC
google — android	In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21305 MISC
google — android	In ContentService, there is a possible way to read installed sync content providers due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21306 MISC
google — android	In Composer, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21308 MISC
google — android	In libcore, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21309 MISC
google — android	In Bluetooth, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21310 MISC
google — android	In Settings, there is a possible way to control private DNS settings from a secondary user due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21311 MISC
google — android	In IntentResolver, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21312 MISC
google — android	In Core, there is a possible way to forward calls without user knowledge due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21313 MISC
google — android	In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21314 MISC
google — android	In Bluetooth, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21315 MISC
google — android	In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21316 MISC
google — android	In ContentService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21317 MISC
google — android	In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21318 MISC
google — android	In UsageStatsService, there is a possible way to read installed 3rd party apps due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21319 MISC
google — android	In Device Policy, there is a possible way to verify if a particular admin app is registered on the device due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21320 MISC
google — android	In Package Manager, there is a possible cross-user settings disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21321 MISC
google — android	In Activity Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21323 MISC
google — android	In Package Installer, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21324 MISC
google — android	In Settings, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21325 MISC
google — android	In Package Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21326 MISC
google — android	In Permission Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21327 MISC
google — android	In Package Installer, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21328 MISC
google — android	In Activity Manager, there is a possible way to determine whether an app is installed due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21329 MISC
google — android	In Overlay Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21330 MISC
google — android	In InputMethod, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21331 MISC
google — android	In Text Services, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21332 MISC
google — android	In Text Services, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21333 MISC
google — android	In App Ops Service, there is a possible disclosure of information about installed packages due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21334 MISC
google — android	In Settings, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21335 MISC
google — android	In Input Method, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21336 MISC
google — android	In InputMethod, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21337 MISC
google — android	In Input Method, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21338 MISC
google — android	In Minikin, there is a possible way to trigger ANR by showing a malicious message due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21339 MISC
google — android	In Telecomm, there is a possible way to get the call state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21340 MISC
google — android	In Permission Manager, there is a possible way to bypass required permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21341 MISC
google — android	In Speech, there is a possible way to bypass background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21342 MISC
google — android	In ActivityStarter, there is a possible background activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21343 MISC
google — android	In Job Scheduler, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21344 MISC
google — android	In User Backup Manager, there is a possible way to leak a token to bypass user confirmation for backup due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21387 MISC
google — android	In Settings, there is a possible restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21388 MISC
google — android	In Settings, there is a possible bypass of profile owner restrictions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21389 MISC
google — android	In Sim, there is a possible way to evade mobile preference restrictions due to a permission bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21390 MISC
google — android	In Messaging, there is a possible way to disable the messaging application due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21391 MISC
google — android	In Bluetooth, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege when connecting to a Bluetooth device with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21392 MISC
google — android	In Settings, there is a possible way for the user to change SIM due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21393 MISC
google — android	In Activity Manager, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21396 MISC
google — android	In Setup Wizard, there is a possible way to save a WiFi network due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21397 MISC
google — android	In sdksandbox, there is a possible strandhogg style overlay attack due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-21398 MISC
google — chrome	Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Chromium security severity: High)	2023-11-01	not yet calculated	CVE-2023-5480 MISC MISC MISC
google — chrome	Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)	2023-11-01	not yet calculated	CVE-2023-5482 MISC MISC MISC
google — chrome	Integer overflow in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)	2023-11-01	not yet calculated	CVE-2023-5849 MISC MISC MISC
google — chrome	Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Medium)	2023-11-01	not yet calculated	CVE-2023-5850 MISC MISC MISC
google — chrome	Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)	2023-11-01	not yet calculated	CVE-2023-5851 MISC MISC MISC
google — chrome	Use after free in Printing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)	2023-11-01	not yet calculated	CVE-2023-5852 MISC MISC MISC
google — chrome	Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)	2023-11-01	not yet calculated	CVE-2023-5853 MISC MISC MISC
google — chrome	Use after free in Profiles in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)	2023-11-01	not yet calculated	CVE-2023-5854 MISC MISC MISC
google — chrome	Use after free in Reading Mode in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)	2023-11-01	not yet calculated	CVE-2023-5855 MISC MISC MISC
google — chrome	Use after free in Side Panel in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)	2023-11-01	not yet calculated	CVE-2023-5856 MISC MISC MISC
google — chrome	Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially execute arbitrary code via a malicious file. (Chromium security severity: Medium)	2023-11-01	not yet calculated	CVE-2023-5857 MISC MISC MISC
google — chrome	Inappropriate implementation in WebApp Provider in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)	2023-11-01	not yet calculated	CVE-2023-5858 MISC MISC MISC
google — chrome	Incorrect security UI in Picture In Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted local HTML page. (Chromium security severity: Low)	2023-11-01	not yet calculated	CVE-2023-5859 MISC MISC MISC
govee — led_strip	An issue discovered in Govee LED Strip v3.00.42 allows attackers to cause a denial of service via crafted Move and MoveWithOnoff commands.	2023-10-30	not yet calculated	CVE-2023-45956 MISC
gpac — gpac	GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in gf_isom_use_compact_size gpac/src/isomedia/isom_write.c:3403:3 in gpac/MP4Box.	2023-11-01	not yet calculated	CVE-2023-46927 MISC MISC
gpac — gpac	GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_media_change_pl /afltest/gpac/src/media_tools/isom_tools.c:3293:42.	2023-11-01	not yet calculated	CVE-2023-46928 MISC MISC
gpac — gpac	GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_isom_find_od_id_for_track /afltest/gpac/src/isomedia/media_odf.c:522:14.	2023-11-01	not yet calculated	CVE-2023-46930 MISC MISC
gpac — gpac	GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in ffdmx_parse_side_data /afltest/gpac/src/filters/ff_dmx.c:202:14 in gpac/MP4Box.	2023-11-01	not yet calculated	CVE-2023-46931 MISC MISC
groundhogg_inc. — groundhogg	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Groundhogg Inc. Groundhogg allows SQL Injection.This issue affects Groundhogg: from n/a through 2.7.11.	2023-11-03	not yet calculated	CVE-2023-34179 MISC
gyouza-newhushimi — gyouza-newhushimi	An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages.	2023-11-02	not yet calculated	CVE-2023-39042 MISC MISC
hadsky — hadsky	An arbitrary file upload vulnerability in HadSky v7.12.10 allows attackers to execute arbitrary code via a crafted file.	2023-11-01	not yet calculated	CVE-2023-46428 MISC
hattoriya — hattoriya	An information leak in Hattoriya v13.6.1 allows attackers to obtain the channel access token and send crafted messages.	2023-11-02	not yet calculated	CVE-2023-39053 MISC MISC
hirochankakiwaiting — hirochankakiwaiting	An information leak in hirochanKAKIwaiting v13.6.1 allows attackers to obtain the channel access token and send crafted messages.	2023-11-02	not yet calculated	CVE-2023-39057 MISC MISC
hitachi_energy — esoms	The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal structure of the application and to further plot attacks against web servers and deployed web applications.	2023-11-01	not yet calculated	CVE-2023-5515 MISC
hitachi_energy — esoms	Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical details like version Info, endpoints, backend server, Internal IP. etc., which can potentially expose additional attack surface containing other interesting vulnerabilities.	2023-11-01	not yet calculated	CVE-2023-5516 MISC
hitachi_energy — mach_system_software	The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer system. This vulnerability stems from the use of an outdated version of a third-party library, which is used to extract archives uploaded to McFeeder server. An authenticated malicious client can exploit this vulnerability by uploading a crafted ZIP archive via the network to McFeeder’s service endpoint.	2023-11-01	not yet calculated	CVE-2023-2621 MISC
hitachi_energy — mach_system_software	Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call (RPC) of the InspectSetup service endpoint. The low privilege client is then allowed to read arbitrary files that they do not have authorization to read.	2023-11-01	not yet calculated	CVE-2023-2622 MISC
hitachi_energy — esoms_report_generation	The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enumerating the local file system structure.	2023-11-01	not yet calculated	CVE-2023-5514 MISC
hp_inc. — hp_pc_hardware_diagnostics_windows	Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to elevation of privilege.	2023-10-31	not yet calculated	CVE-2023-5739 MISC
ibm — content_navigator	IBM Content Navigator 3.0.13 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 259247.	2023-11-03	not yet calculated	CVE-2023-35896 MISC MISC
ibm — i	Management Central as part of IBM i 7.2, 7.3, 7.4, and 7.5 Navigator contains a local privilege escalation vulnerability. A malicious actor with command line access to the operating system can exploit this vulnerability to elevate privileges to gain root access to the operating system. IBM X-Force ID: 264116.	2023-10-29	not yet calculated	CVE-2023-40685 MISC MISC
ibm — mq_appliance	IBM MQ Appliance 9.3 CD could allow a local attacker to gain elevated privileges on the system, caused by improper validation of security keys. IBM X-Force ID: 269535.	2023-11-03	not yet calculated	CVE-2023-46176 MISC MISC
ibm — multiple_products	IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. IBM X-Force ID: 266163.	2023-11-03	not yet calculated	CVE-2023-43018 MISC MISC
ibm — robotic_process_automation	A vulnerability in IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.10, 23.0.0 through 23.0.10 may result in access to client vault credentials. This difficult to exploit vulnerability could allow a low privileged attacker to programmatically access client vault credentials. IBM X-Force ID: 268752.	2023-11-03	not yet calculated	CVE-2023-45189 MISC MISC
ibm — multiple_products	IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 266057.	2023-11-03	not yet calculated	CVE-2023-42027 MISC MISC MISC
ibm — multiple_products	IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 266059.	2023-11-03	not yet calculated	CVE-2023-42029 MISC MISC MISC
idnovate_superuser — idnovate_superuser	An issue in the component SuperUserSetuserModuleFrontController:init() of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call.	2023-10-31	not yet calculated	CVE-2023-45899 MISC
ifaa_service — ifaa_service	In Ifaa service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42646 MISC
ifaa_service — ifaa_service	In Ifaa service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42647 MISC
inkdrop — inkdrop	Inkdrop prior to v5.6.0 allows a local attacker to conduct a code injection attack by having a legitimate user open a specially crafted markdown file.	2023-10-30	not yet calculated	CVE-2023-44141 MISC MISC MISC
insights-client — insights-client	A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local user or attacker could create the /var/tmp/insights-client directory (owning the directory with read, write, and execute permissions) on the system. After the insights-client is registered by root, an attacker could then control the directory content that insights are using by putting malicious scripts into it and executing arbitrary code as root (trivially bypassing SELinux protections because insights processes are allowed to disable SELinux system-wide).	2023-11-01	not yet calculated	CVE-2023-3972 MISC MISC MISC MISC MISC MISC MISC
insyde — insydeh2o	A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code execution during the DXE phase.	2023-11-01	not yet calculated	CVE-2023-39281 MISC MISC
insyde –insydeh2o	An SMM memory corruption vulnerability in the SMM driver (SMRAM write) in CsmInt10HookSmm in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to send arbitrary data to SMM which could lead to privilege escalation.	2023-11-02	not yet calculated	CVE-2023-39283 MISC MISC
insyde — insydeh20	An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There are arbitrary calls to SetVariable with unsanitized arguments in the SMI handler.	2023-11-02	not yet calculated	CVE-2023-39284 MISC MISC
inure — inure	Missing Authorization in GitHub repository hamza417/inure prior to Build95.	2023-10-31	not yet calculated	CVE-2023-5862 MISC MISC
ivanti — automation	A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication.	2023-11-03	not yet calculated	CVE-2022-44569 MISC
ivanti — avalance	Ivanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation Vulnerability	2023-11-03	not yet calculated	CVE-2023-41725 MISC
ivanti — avalanche	Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability	2023-11-03	not yet calculated	CVE-2022-43554 MISC
ivanti — avalanche	Ivanti Avalanche Printer Device Service Missing Authentication Local Privilege Escalation Vulnerability	2023-11-03	not yet calculated	CVE-2022-43555 MISC
ivanti –avalance	Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation Vulnerability	2023-11-03	not yet calculated	CVE-2023-41726 MISC
jhipster — jhipster	JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.	2023-10-31	not yet calculated	CVE-2015-20110 MISC MISC MISC MISC
jspxcms — jspxcms	There is a Cross Site Scripting (XSS) vulnerability in the choose_style_tree.do interface of Jspxcms v10.2.0 backend.	2023-11-01	not yet calculated	CVE-2023-46911 MISC
jumpserver — jumpserver	JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email for initial user admin is `admin[@]mycompany[.]com`, and users reset their passwords by sending an email. Currently, the domain `mycompany.com` has not been registered. However, if it is registered in the future, it may affect the password reset functionality. This issue has been patched in version 3.8.0 by changing the default email domain to `example.com`. Those who cannot upgrade may change the default email domain to `example.com` manually.	2023-10-31	not yet calculated	CVE-2023-46138 MISC MISC
kerawen — kerawen	kerawen before v2.5.1 was discovered to contain a SQL injection vulnerability via the ocs_id_cart parameter at KerawenDeliveryModuleFrontController::initContent().	2023-11-04	not yet calculated	CVE-2023-40922 MISC
kimai — kimai	Kimai is a web-based multi-user time-tracking application. Versions 2.1.0 and prior are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software’s PDF and HTML rendering functionalities. As of time of publication, no patches or known workarounds are available.	2023-10-31	not yet calculated	CVE-2023-46245 MISC
kubernetes — csi-proxy	A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy.	2023-11-03	not yet calculated	CVE-2023-3893 MISC MISC
kubernetes — kube-apiserver	A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client’s API server credentials to third parties.	2023-11-03	not yet calculated	CVE-2022-3172 MISC MISC
kubernetes — kubelet	A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.	2023-10-31	not yet calculated	CVE-2023-3676 MISC MISC
kubernetes — kubelet	A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.	2023-10-31	not yet calculated	CVE-2023-3955 MISC MISC
kubernetes — kubernetes	Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a LoadBalancer Service when the LoadBalancer controller does not set the “status.loadBalancer.ingress[].ip” field. Clusters where the LoadBalancer controller sets the “status.loadBalancer.ingress[].ip” field are unaffected.	2023-10-30	not yet calculated	CVE-2021-25736 MISC MISC
kyocera — taskalfa	Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read arbitrary files on the filesystem, even files that require root privileges. NOTE: this issue exists because of an incomplete fix for CVE-2020-23575.	2023-11-03	not yet calculated	CVE-2023-34259 MISC MISC
kyocera — taskalfa	Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow a denial of service (service outage) via /wlmdeu%2f%2e%2e%2f%2e%2e followed by a directory reference such as %2fetc%00index.htm to try to read the /etc directory.	2023-11-03	not yet calculated	CVE-2023-34260 MISC MISC
kyocera — taskalfa	Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow identification of valid user accounts via username enumeration because they lead to a “nicht einloggen” error rather than a falsch error.	2023-11-03	not yet calculated	CVE-2023-34261 MISC MISC
learndash — learndash_lms	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in LearnDash LearnDash LMS allows SQL Injection. This issue affects LearnDash LMS: from n/a through 4.5.3.	2023-10-31	not yet calculated	CVE-2023-28777 MISC
lenovo — thinkpad_bios	An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.	2023-10-30	not yet calculated	CVE-2022-4574 MISC
lenovo — thinkpad_bios	A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or local access and elevated privileges the ability to bypass Secure Boot.	2023-10-30	not yet calculated	CVE-2022-4575 MISC
line_corporation — line_for_android	LINE for Android version 5.0.2 and earlier and LINE for iOS version 5.0.0 and earlier are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM (man-in-the-middle) attacker.	2023-10-31	not yet calculated	CVE-2015-0897 MISC MISC
line_corporation — line_for_android	LINE@ for Android version 1.0.0 and LINE@ for iOS version 1.0.0 are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM (man-in-the-middle) attacker.	2023-10-31	not yet calculated	CVE-2015-2968 MISC MISC
linux — kernel	A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses it, CIFS will access a free memory region, leading to a denial of service.	2023-11-01	not yet calculated	CVE-2023-1192 MISC MISC MISC
linux — kernel	A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.	2023-11-03	not yet calculated	CVE-2023-1476 MISC MISC MISC MISC
linux — kernel	A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threads. This flaw allows a local attacker with normal user privileges to crash the system or leak internal kernel information.	2023-11-01	not yet calculated	CVE-2023-3397 MISC MISC MISC
linux — kernel	An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur.	2023-10-29	not yet calculated	CVE-2023-46862 MISC MISC
linux — kernel	The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local access, this “could be exploited in a real-world scenario.” This is related to brcmf_cfg80211_escan_timeout_worker in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c.	2023-11-03	not yet calculated	CVE-2023-47233 MISC MISC MISC
linux — kernel	A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation in case that the attacker already has local privileges.	2023-11-01	not yet calculated	CVE-2023-5178 MISC MISC MISC
liquidfiles — liquidfiles	HTML and SMTP injections on the registration page of LiquidFiles versions 3.7.13 and below, allow an attacker to perform more advanced phishing attacks against an organization.	2023-10-30	not yet calculated	CVE-2023-4393 MISC
lissy93_dashy — lissy93_dashy	A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Configuration Handler. The manipulation of the argument config leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-244305 was assigned to this vulnerability.	2023-11-02	not yet calculated	CVE-2023-5916 MISC MISC MISC MISC
lmxcms — lmxcms	An issue in lmxcms v.1.41 allows a remote attacker to execute arbitrary code via a crafted script to the admin.php file.	2023-11-02	not yet calculated	CVE-2023-46958 MISC MISC MISC
lost_and_found_information_system — lost_and_found_information_system	Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI.	2023-11-03	not yet calculated	CVE-2023-38965 MISC MISC
loytec — multiple_products	LOYTEC LINX-212 firmware 6.2.4 and LVIS-3ME12-A1 firmware 6.2.2 and LIOB-586 firmware 6.2.3 devices send password-change requests via cleartext HTTP.	2023-11-04	not yet calculated	CVE-2023-46380 MISC
loytec — multiple_products	LOYTEC LINX-212 firmware 6.2.4 and LVIS-3ME12-A1 firmware 6.2.2 and LIOB-586 firmware 6.2.3 devices lack authentication for the preinstalled version of LWEB-802 via an lweb802_pre/ URI. An unauthenticated attacker can edit any project (or create a new project) and control its GUI.	2023-11-04	not yet calculated	CVE-2023-46381 MISC
loytec — multiple_products	LOYTEC LINX-212 firmware 6.2.4 and LVIS-3ME12-A1 firmware 6.2.2 and LIOB-586 firmware 6.2.3 devices use cleartext HTTP for login.	2023-11-04	not yet calculated	CVE-2023-46382 MISC
lte-pic32-writer — lte-pic32-writer	lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use `sendto.txt` are vulnerable to attackers who known the IMEI reading the sendto.txt. The sendto.txt file can contain the SNS(such as slack and zulip) URL and API key. As of time of publication, a patch is not yet available. As workarounds, avoid using `sendto.txt` or use `.htaccess` to block access to `sendto.txt`.	2023-10-31	not yet calculated	CVE-2023-46723 MISC
manageengine — desktop_central	A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATE_ID/1613157927228/InvSWMetering.csv.	2023-11-03	not yet calculated	CVE-2023-4767 MISC
manageengine — desktop_central	A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATE_ID/1613157927228/InvSWMetering.pdf.	2023-11-03	not yet calculated	CVE-2023-4768 MISC
manageengine — desktop_central	A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component. This vulnerability could allow an authenticated attacker to launch targeted attacks, such as a cross-port attack, service enumeration and other attacks via HTTP requests.	2023-11-03	not yet calculated	CVE-2023-4769 MISC
mattermost — mattermost	Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitation from a malicious mattermost server	2023-11-02	not yet calculated	CVE-2023-5875 MISC
mattermost — mattermost	Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial-Of-Service.	2023-11-02	not yet calculated	CVE-2023-5876 MISC
mattermost — mattermost	Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard input.	2023-11-02	not yet calculated	CVE-2023-5920 MISC
mb_support — openviva	A stored XSS in the process overview (bersicht zugewiesener Vorgaenge) in mbsupport openVIVA c2 20220101 allows a remote, authenticated, low-privileged attacker to execute arbitrary code in the victim’s browser via name field of a process.	2023-10-30	not yet calculated	CVE-2022-39172 MISC
mediawiki — mediawiki	An issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is XSS in youhavenewmessagesmanyusers and youhavenewmessages i18n messages. This is related to MediaWiki:Youhavenewmessagesfromusers.	2023-11-03	not yet calculated	CVE-2023-45360 MISC
mediawiki — mediawiki	An issue was discovered in DifferenceEngine.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. diff-multi-sameuser (aka “X intermediate revisions by the same user not shown”) ignores username suppression. This is an information leak.	2023-11-03	not yet calculated	CVE-2023-45362 MISC
microsoft — edge	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	2023-11-03	not yet calculated	CVE-2023-36022 MISC
microsoft — edge	Microsoft Edge (Chromium-based) Spoofing Vulnerability	2023-11-03	not yet calculated	CVE-2023-36029 MISC
microsoft — edge	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	2023-11-03	not yet calculated	CVE-2023-36034 MISC
microweber — microweber	Cross-site Scripting (XSS) – Stored in GitHub repository microweber/microweber prior to 2.0.	2023-10-31	not yet calculated	CVE-2023-5861 MISC MISC
mincal — mincal	An issue in minCal v.1.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the customer_data parameter.	2023-10-30	not yet calculated	CVE-2023-46478 MISC
minicms — minicms	Stored Cross Site Scripting (XSS) vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-admin/conf.php.	2023-10-31	not yet calculated	CVE-2023-46378 MISC
mintplex-labs — anything-llm	Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.	2023-10-30	not yet calculated	CVE-2023-5832 MISC MISC
mintplex-labs — anything-llm	Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.	2023-10-30	not yet calculated	CVE-2023-5833 MISC MISC
mlsoft — tco!stream	In MLSoft TCO!stream versions 8.0.22.1115 and below, a vulnerability exists due to insufficient permission validation. This allows an attacker to make the victim download and execute arbitrary files.	2023-10-30	not yet calculated	CVE-2023-45799 MISC
moxa — multiple_products	A vulnerability has been identified in the EDR-810, EDR-G902, and EDR-G903 Series, making them vulnerable to the denial-of-service vulnerability. This vulnerability stems from insufficient input validation in the URI, potentially enabling malicious users to trigger the device reboot.	2023-11-01	not yet calculated	CVE-2023-4452 MISC
moxa — nport_6000_series	A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implementation of sensitive information protection, potentially allowing malicious users to gain unauthorized access to the web service.	2023-11-01	not yet calculated	CVE-2023-5627 MISC
moxa — pt-g503_series	A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.	2023-11-02	not yet calculated	CVE-2023-4217 MISC
moxa — pt-g503_series	A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the cookie to be transmitted in plaintext over an HTTP session. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.	2023-11-02	not yet calculated	CVE-2023-5035 MISC
mupdf — mupdf	MuPDF v1.21.1 was discovered to contain an infinite recursion in the component pdf_mark_list_push. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.	2023-10-31	not yet calculated	CVE-2023-31794 MISC MISC MISC
nanoleaf — light_strip	An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute commands.	2023-10-31	not yet calculated	CVE-2023-45955 MISC
nats — nats-server	NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.	2023-10-30	not yet calculated	CVE-2023-47090 MISC MISC MLIST
ncsist_manageengine — mobile_device_manager	NCSIST ManageEngine Mobile Device Manager (MDM) APP’s special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files.	2023-11-03	not yet calculated	CVE-2023-41356 MISC
ncsist_manageengine — mobile_device_manager	NCSIST ManageEngine Mobile Device Manager (MDM) APP’s special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files.	2023-11-03	not yet calculated	CVE-2023-41344 MISC
netmove_corporation — saat_netizen_installer	Improper file verification vulnerability in SaAT Netizen installer ver.1.2.0.424 and earlier, and SaAT Netizen ver.1.2.0.8 (Build427) and earlier allows a remote unauthenticated attacker to conduct a man-in-the-middle attack. A successful exploitation may result in a malicious file being downloaded and executed.	2023-10-31	not yet calculated	CVE-2016-1203 MISC MISC
nvidia — multiple_products	NVIDIA GPU Display Driver for Windows contains a vulnerability where an uncontrolled search path element may allow an attacker to execute arbitrary code, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.	2023-11-02	not yet calculated	CVE-2023-31016 MISC
nvidia — multiple_products	NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may be able to write arbitrary data to privileged locations by using reparse points. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.	2023-11-02	not yet calculated	CVE-2023-31017 MISC
nvidia — multiple_products	NVIDIA GPU Display Driver for Windows contains a vulnerability in wksServicePlugin.dll, where the driver implementation does not restrict or incorrectly restricts access from the named pipe server to a connecting client, which may lead to potential impersonation to the client’s secure context.	2023-11-02	not yet calculated	CVE-2023-31019 MISC
nvidia — multiple_products	NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause improper access control, which may lead to denial of service or data tampering.	2023-11-02	not yet calculated	CVE-2023-31020 MISC
nvidia — multiple_products	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a NULL-pointer dereference may lead to denial of service.	2023-11-02	not yet calculated	CVE-2023-31022 MISC
nvidia — multiple_products	NVIDIA Display Driver for Windows contains a vulnerability where an attacker may cause a pointer dereference of an untrusted value, which may lead to denial of service.	2023-11-02	not yet calculated	CVE-2023-31023 MISC
nvidia — multiple_products	NVIDIA GPU Display Driver for Windows contains a vulnerability that allows Windows users with low levels of privilege to escalate privileges when an administrator is updating GPU drivers, which may lead to escalation of privileges.	2023-11-02	not yet calculated	CVE-2023-31027 MISC
nvidia — vgpu_driver_and_cloud_gaming_driver	NVIDIA GPU Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause a NULL-pointer dereference, which may lead to denial of service.	2023-11-02	not yet calculated	CVE-2023-31018 MISC
nvidia — vgpu_driver_and_cloud_gaming_driver	NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a malicious user in the guest VM can cause a NULL-pointer dereference, which may lead to denial of service.	2023-11-02	not yet calculated	CVE-2023-31021 MISC
nvidia — vgpu_driver_and_cloud_gaming_driver	NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a NULL-pointer dereference may lead to denial of service.	2023-11-02	not yet calculated	CVE-2023-31026 MISC
opencrx — opencrx	An issue in OpenCRX v.5.2.2 allows a remote attacker to execute arbitrary code via a crafted request.	2023-10-30	not yet calculated	CVE-2023-46502 MISC MISC
openeuler — isulad	iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.	2023-10-29	not yet calculated	CVE-2021-33634 MISC MISC MISC
openeuler — isulad	When malicious images are pulled by isula pull, attackers can execute arbitrary code.	2023-10-29	not yet calculated	CVE-2021-33635 MISC MISC MISC
openeuler — isulad	When the isula load command is used to load malicious images, attackers can execute arbitrary code.	2023-10-29	not yet calculated	CVE-2021-33636 MISC MISC MISC
openeuler — isulad	When the isula export command is used to export a container to an image and the container is controlled by an attacker, the attacker can escape the container.	2023-10-29	not yet calculated	CVE-2021-33637 MISC MISC MISC
openeuler — isulad	When the isula cp command is used to copy files from a container to a host machine and the container is controlled by an attacker, the attacker can escape the container.	2023-10-29	not yet calculated	CVE-2021-33638 MISC MISC MISC
openimageio_oiio — openimageio_oiio	Buffer Overflow vulnerability in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service via the read_subimage_data function.	2023-11-02	not yet calculated	CVE-2023-42299 MISC
opentext — service_management_automation_x	Potential open redirect vulnerability in opentext Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11 and opentext Asset Management X (AMX) versions 2021.08, 2021.11, 2022.05, 2022.11. The vulnerability could allow attackers to redirect a user to malicious websites.	2023-10-30	not yet calculated	CVE-2023-4964 MISC
ox_software_gmbh — ox_app_suite	Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.	2023-11-02	not yet calculated	CVE-2023-26452 MISC MISC
ox_software_gmbh — ox_app_suite	Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.	2023-11-02	not yet calculated	CVE-2023-26453 MISC MISC
ox_software_gmbh — ox_app_suite	Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.	2023-11-02	not yet calculated	CVE-2023-26454 MISC MISC
ox_software_gmbh — ox_app_suite	RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interface has been updated to require authenticated requests. No publicly available exploits are known.	2023-11-02	not yet calculated	CVE-2023-26455 MISC MISC
ox_software_gmbh — ox_app_suite	Users were able to set an arbitrary “product name” for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting attacks. Accounts that were temporarily taken over could be configured to trigger persistent code execution, allowing an attacker to build a foothold. Sanitization is in place for product names now. No publicly available exploits are known.	2023-11-02	not yet calculated	CVE-2023-26456 MISC MISC
ox_software_gmbh — ox_app_suite	Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document. Script code embedded in malicious documents could be executed in the context of the user editing the document when performing certain actions, like copying content. The relevant attribute does now get encoded to avoid the possibility of executing script code. No publicly available exploits are known.	2023-11-02	not yet calculated	CVE-2023-29043 MISC MISC
ox_software_gmbh — ox_app_suite	Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now get escaped to avoid code execution. No publicly available exploits are known.	2023-11-02	not yet calculated	CVE-2023-29044 MISC MISC
ox_software_gmbh — ox_app_suite	Documents operations, in this case “drawing”, could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now gets checked for validity to avoid code execution. No publicly available exploits are known.	2023-11-02	not yet calculated	CVE-2023-29045 MISC MISC
ox_software_gmbh — ox_app_suite	Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Some connections use user-controlled endpoints, which could be malicious and attempt to keep the connection open for an extended period of time. As a result, users were able to trigger large amount of egress network connections, possibly exhausting network pool resources and lock up legitimate requests. A new mechanism has been introduced to cancel external connections that might access user-controlled endpoints. No publicly available exploits are known.	2023-11-02	not yet calculated	CVE-2023-29046 MISC MISC
ox_software_gmbh — ox_app_suite	Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. An attacker with access to the adjacent network and potentially API credentials, could read and modify database content which is accessible to the imageconverter SQL user account. None No publicly available exploits are known.	2023-11-02	not yet calculated	CVE-2023-29047 MISC MISC
pcrs — pcrs	PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing.	2023-11-03	not yet calculated	CVE-2023-46404 MISC MISC
peppermint_ticket_management — peppermint_ticket_management	Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request.	2023-10-30	not yet calculated	CVE-2023-46863 MISC
peppermint_ticket_management — peppermint_ticket_management	Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request.	2023-10-30	not yet calculated	CVE-2023-46864 MISC
php — php	A vulnerability was found in PHP when setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.	2023-11-02	not yet calculated	CVE-2022-4900 MISC MISC
phpbb — phpbb	A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named ccf6e6c255d38692d72fcb613b113e6eaa240aac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244307.	2023-11-02	not yet calculated	CVE-2023-5917 MISC MISC MISC MISC MISC MISC
phpfox — phpfox	An issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core/redirect route is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as executing arbitrary PHP code.	2023-11-03	not yet calculated	CVE-2023-46817 MISC MISC MISC MISC MISC
phpmyfaq — phpmyfaq	Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2.	2023-10-31	not yet calculated	CVE-2023-5865 MISC MISC
phpmyfaq — phpmyfaq	Cross-site Scripting (XSS) – Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2.	2023-10-31	not yet calculated	CVE-2023-5863 MISC MISC
phpmyfaq — phpmyfaq	Cross-site Scripting (XSS) – Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1.	2023-10-31	not yet calculated	CVE-2023-5864 MISC MISC
phpmyfaq — phpmyfaq	Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1.	2023-10-31	not yet calculated	CVE-2023-5866 MISC MISC
phpmyfaq — phpmyfaq	Cross-site Scripting (XSS) – Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2.	2023-10-31	not yet calculated	CVE-2023-5867 MISC MISC
pillow — pillow	An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.	2023-11-03	not yet calculated	CVE-2023-44271 MISC MISC MISC
pimcore — pimcore	The Pimcore Admin Classic Bundle provides a backend UI for Pimcore. Prior to version 1.2.0, a cross-site scripting vulnerability has the potential to steal a user’s cookie and gain unauthorized access to that user’s account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 1.2.0 to receive a patch or, as a workaround, apply the patch manually.	2023-10-31	not yet calculated	CVE-2023-46722 MISC MISC MISC
pimcore — pimcore	Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0.	2023-10-30	not yet calculated	CVE-2023-5844 MISC MISC
pimcore — pimcore	Cross-site Scripting (XSS) – Stored in GitHub repository pimcore/pimcore prior to 11.1.0.	2023-10-31	not yet calculated	CVE-2023-5873 MISC MISC
pkp — pkp	Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16.	2023-11-01	not yet calculated	CVE-2023-5889 MISC MISC
pkp — pkp	Cross-site Scripting (XSS) – Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.	2023-11-01	not yet calculated	CVE-2023-5890 MISC MISC
pkp — pkp	Cross-site Scripting (XSS) – Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16.	2023-11-01	not yet calculated	CVE-2023-5891 MISC MISC
pkp — pkp	Cross-site Scripting (XSS) – Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.	2023-11-01	not yet calculated	CVE-2023-5892 MISC MISC
pkp — pkp	Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.	2023-11-01	not yet calculated	CVE-2023-5893 MISC MISC
pkp — pkp	Cross-site Scripting (XSS) – Stored in GitHub repository pkp/ojs prior to 3.3.0-16.	2023-11-01	not yet calculated	CVE-2023-5894 MISC MISC
pkp — pkp	Cross-site Scripting (XSS) – DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16.	2023-11-01	not yet calculated	CVE-2023-5895 MISC MISC
pkp — pkp	Cross-site Scripting (XSS) – Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4.	2023-11-01	not yet calculated	CVE-2023-5896 MISC MISC
pkp — pkp	Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1.	2023-11-01	not yet calculated	CVE-2023-5897 MISC MISC
pkp — pkp	Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.	2023-11-01	not yet calculated	CVE-2023-5898 MISC MISC
pkp — pkp	Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.	2023-11-01	not yet calculated	CVE-2023-5899 MISC MISC
popojicms — popojicms	A vulnerability was found in PopojiCMS 2.0.1 and classified as problematic. This issue affects some unknown processing of the file install.php of the component Web Config. The manipulation of the argument Site Title with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-244229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-11-02	not yet calculated	CVE-2023-5910 MISC MISC MISC MISC
prestashop — prestashop	SQL injection vulnerability found in PrestaShop themevolty v.4.0.8 and before allows a remote attacker to gain privileges via the tvcmsblog, tvcmsvideotab, tvcmswishlist, tvcmsbrandlist, tvcmscategorychainslider, tvcmscategoryproduct, tvcmscategoryslider, tvcmspaymenticon, tvcmstestimonial components.	2023-10-31	not yet calculated	CVE-2023-27846 MISC
prestashop — prestashop	Prestashop opartlimitquantity 1.4.5 and before is vulnerable to SQL Injection. OpartlimitquantityAlertlimitModuleFrontController::displayAjaxPushAlertMessage()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.	2023-10-31	not yet calculated	CVE-2023-36263 MISC
prestashop — prestashop	In the module “PrestaBlog” (prestablog) version 4.4.7 and before from HDclic for PrestaShop, a guest can perform SQL injection. The script ajax slider_positions.php has a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.	2023-10-31	not yet calculated	CVE-2023-45378 MISC
prestashop — prestashop	In the module “Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module” (facebookconversiontrackingplus) up to version 2.4.9 from Smart Modules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from the module which can lead to a leak of personal information from ps_customer table such as name / surname / email.	2023-11-02	not yet calculated	CVE-2023-46352 MISC MISC
prestashop — prestashop	In the module “CSV Feeds PRO” (csvfeeds) before 2.6.1 from Bl Modules for PrestaShop, a guest can perform SQL injection. The method `SearchApiCsv::getProducts()` has sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.	2023-10-31	not yet calculated	CVE-2023-46356 MISC
print_service — print_service	In Print Service, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.	2023-10-30	not yet calculated	CVE-2023-45780 MISC
px4-autopilot — px4-autopilot	PX4-Autopilot provides PX4 flight control solution for drones. In versions 1.14.0-rc1 and prior, PX4-Autopilot has a heap buffer overflow vulnerability in the parser function due to the absence of `parserbuf_index` value checking. A malfunction of the sensor device can cause a heap buffer overflow with leading unexpected drone behavior. Malicious applications can exploit the vulnerability even if device sensor malfunction does not occur. Up to the maximum value of an `unsigned int`, bytes sized data can be written to the heap memory area. As of time of publication, no fixed version is available.	2023-10-31	not yet calculated	CVE-2023-46256 MISC MISC
pypdf — pypdf	pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions 3.7.0 through 3.16.4 can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case when the pypdf-user manipulates an incoming malicious PDF e.g. by merging it with another PDF or by adding annotations. The issue was fixed in version 3.17.0. As a workaround, apply the patch manually by modifying `pypdf/generic/_data_structures.py`.	2023-10-31	not yet calculated	CVE-2023-46250 MISC MISC MISC
python-eventlet — python-eventlet	A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products.	2023-11-01	not yet calculated	CVE-2023-5625 MISC MISC MISC
qemu — qemu	A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM’s boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.	2023-11-03	not yet calculated	CVE-2023-5088 MISC MISC MISC
qnap_systems_inc. — multimedia_console	An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 ( 2023/05/04 ) and later Multimedia Console 1.4.8 ( 2023/05/05 ) and later QTS 5.1.0.2399 build 20230515 and later QTS 4.3.6.2441 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later	2023-11-03	not yet calculated	CVE-2023-23369 MISC
qnap_systems_inc. — music_station	A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: Music Station 4.8.11 and later Music Station 5.1.16 and later Music Station 5.3.23 and later	2023-11-03	not yet calculated	CVE-2023-39299 MISC
qnap_systems_inc. — qts	An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later	2023-11-03	not yet calculated	CVE-2023-23368 MISC
qnap_systems_inc. — qts	A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read application data via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2514 build 20230906 and later QTS 5.1.1.2491 build 20230815 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.1.2488 build 20230812 and later QuTScloud c5.1.0.2498 and later	2023-11-03	not yet calculated	CVE-2023-39301 MISC
quic-go — quic-go	quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.	2023-10-31	not yet calculated	CVE-2023-46239 MISC MISC MISC
ragic — no-code_database_builder	Rogic No-Code Database Builder’s file uploading function has insufficient filtering for special characters. A remote attacker with regular user privilege can inject JavaScript to perform XSS (Stored Cross-Site Scripting) attack.	2023-11-03	not yet calculated	CVE-2023-41343 MISC
red_hat — openshift	A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader access to the cluster.	2023-11-02	not yet calculated	CVE-2023-5408 MISC MISC MISC MISC
relativity_oda_llc — relativityone	SQL Injection vulnerability in Relativity ODA LLC RelativityOne v.12.1.537.3 Patch 2 and earlier allows a remote attacker to execute arbitrary code via the name parameter.	2023-11-03	not yet calculated	CVE-2023-46954 MISC
reportico — reportico	Reportico 7.1.21 is vulnerable to Cross Site Scripting (XSS).	2023-11-02	not yet calculated	CVE-2023-46925 MISC
rsvpmaker — rsvpmaker	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 10.6.6.	2023-11-03	not yet calculated	CVE-2023-41652 MISC
ruby-magick — ruby-magick	A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion.	2023-10-30	not yet calculated	CVE-2023-5349 MISC MISC MISC MISC
samba — samba	A use-after-free flaw was found in setup_async_work in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. This issue could allow an attacker to crash the system by accessing freed work.	2023-11-01	not yet calculated	CVE-2023-1193 MISC MISC MISC
samba — samba	An out-of-bounds (OOB) memory read flaw was found in parse_lease_state in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. When an attacker sends the CREATE command with a malformed payload to KSMBD, due to a missing check of `NameOffset` in the `parse_lease_state()` function, the `create_context` object can access invalid memory.	2023-11-03	not yet calculated	CVE-2023-1194 MISC MISC MISC
samba — samba	A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events, including compromise or service crashes.	2023-11-03	not yet calculated	CVE-2023-3961 MISC MISC MISC MISC MISC MISC
samba — samba	A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module “acl_xattr” is configured with “acl_xattr:ignore system acls = yes”. The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba’s permissions.	2023-11-03	not yet calculated	CVE-2023-4091 MISC MISC MISC MISC MISC MISC
samba — samba	A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba’s RPC server experiences a high load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation “classic DCs”) can erroneously start and compete for the same unix domain sockets. This issue leads to partial query responses from the AD DC, causing issues such as “The procedure number is out of range” when using tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.	2023-11-03	not yet calculated	CVE-2023-42670 MISC MISC MISC MISC MISC
sangoma_technologies — freepbx	Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to extension=101.	2023-11-02	not yet calculated	CVE-2023-43336 MISC MISC MISC
sap_se — sap_enable_now	In SAP Enable Now – versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not implemented, allowing an unauthenticated attacker to attempt clickjacking, which could result in disclosure or modification of information.	2023-10-30	not yet calculated	CVE-2023-36920 MISC MISC
schedmd_slurm — schedmd_slurm	SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 allows filesystem race conditions for gaining ownership of a file, overwriting a file, or deleting files.	2023-11-03	not yet calculated	CVE-2023-41914 MISC CONFIRM FEDORA
securepoint_ssl_vpn_client — securepoint_ssl_vpn_client	The installer (aka openvpn-client-installer) in Securepoint SSL VPN Client before 2.0.40 allows local privilege escalation during installation or repair.	2023-10-30	not yet calculated	CVE-2023-47101 MISC MISC
senayan — multiple_products	SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the reborrowLimit parameter in the member_type.php.	2023-10-31	not yet calculated	CVE-2023-45996 MISC MISC
shouzu — sweets_oz	An information leak in shouzu sweets oz v13.6.1 allows attackers to obtain the channel access token and send crafted messages.	2023-11-02	not yet calculated	CVE-2023-39047 MISC MISC
sim_service — sim_service	In sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42645 MISC
sim_service — sim_service	In sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42655 MISC
six_apart — multiple_products	Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script. Affected products/versions are as follows: Movable Type 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Premium 1.58 and earlier, Movable Type Premium Advanced 1.58 and earlier, Movable Type Cloud Edition (Version 7) r.5405 and earlier, and Movable Type Premium Cloud Edition 1.58 and earlier.	2023-10-30	not yet calculated	CVE-2023-45746 MISC MISC
solwin_infotech — user_activity_log	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Solwin Infotech User Activity Log user-activity-log allows SQL Injection. This issue affects User Activity Log: from n/a through 1.6.2.	2023-10-31	not yet calculated	CVE-2023-37966 MISC
sourcecodester — company_website_cms	A vulnerability was found in SourceCodester Company Website CMS 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /dashboard/createblog of the component Create Blog Page. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-244310 is the identifier assigned to this vulnerability.	2023-11-02	not yet calculated	CVE-2023-5919 MISC MISC MISC
sourcecodester — visitor_management_system	A vulnerability, which was classified as critical, was found in SourceCodester Visitor Management System 1.0. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-244308.	2023-11-02	not yet calculated	CVE-2023-5918 MISC MISC MISC
sourcegraph — cody	Cody is an artificial intelligence (AI) coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution under certain conditions. An attacker in control of a malicious repository could modify the Cody configuration file `.vscode/cody.json` and overwrite Cody commands. If a user with the extension installed opens this malicious repository and runs a Cody command such as /explain or /doc, this could allow arbitrary code execution on the user’s machine. The vulnerability is rated as critical severity, but with low exploitability. It requires the user to have a malicious repository loaded and execute the overwritten command in VS Code. The issue is exploitable regardless of the user blocking code execution on a repository through VS Code Workspace Trust. The issue was found during a regular 3rd party penetration test. The maintainers of Cody do not have evidence of open source repositories having malicious `.vscode/cody.json` files to exploit this vulnerability. The issue is fixed in version 0.14.1 of the Cody VSCode extension. In case users can’t promptly upgrade, they should not open any untrusted repositories with the Cody extension loaded.	2023-10-31	not yet calculated	CVE-2023-46248 MISC MISC
spicedb — spicedb	SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.	2023-10-31	not yet calculated	CVE-2023-46255 MISC MISC
squid — squid	Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `–with-openssl` are vulnerable to a Denial-of-Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid’s patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.	2023-11-01	not yet calculated	CVE-2023-46724 MISC MISC MISC MISC
squid — squid	SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.	2023-11-03	not yet calculated	CVE-2023-46846 MISC MISC MISC MISC MISC MISC
squid — squid	Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.	2023-11-03	not yet calculated	CVE-2023-46847 MISC MISC MISC MISC MISC MISC
squid — squid	Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.	2023-11-03	not yet calculated	CVE-2023-46848 MISC MISC MISC MISC MISC
squid — squid	Squid is vulnerable to Denial-of-Service attack against HTTP and HTTPS clients due to an Improper Handling of Structural Elements bug.	2023-11-03	not yet calculated	CVE-2023-5824 MISC MISC MISC
submitty — submitty	Submitty before v22.06.00 is vulnerable to Cross Site Scripting (XSS). An attacker can create a malicious link in the forum that leads to XSS.	2023-11-02	not yet calculated	CVE-2023-43193 MISC MISC
submitty — submitty	Submitty before v22.06.00 is vulnerable to Incorrect Access Control. An attacker can delete any post in the forum by modifying request parameter.	2023-11-02	not yet calculated	CVE-2023-43194 MISC MISC
subrion — subrion	Subrion 4.2.1 has a remote command execution vulnerability in the backend.	2023-11-03	not yet calculated	CVE-2023-46947 MISC
swtpm — swtpm	In swtpm before 0.4.2 and 0.5.x before 0.5.1, a local attacker may be able to overwrite arbitrary files via a symlink attack against a temporary file such as TMP2-00.permall.	2023-11-03	not yet calculated	CVE-2020-28407 MISC CONFIRM CONFIRM
synapse — synapse	Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or 1.96.0rc1 to receive a patch. As a workaround, the `federation_domain_whitelist` can be used to limit federation traffic with a homeserver.	2023-10-31	not yet calculated	CVE-2023-43796 MISC MISC
teamamaze — amazefileutilities	Improper Authorization in GitHub repository teamamaze/amazefileutilities prior to 1.91.	2023-11-03	not yet calculated	CVE-2023-5948 MISC MISC
tenable — nessus	Under certain conditions, a low privileged attacker could load a specially crafted file during installation or upgrade to escalate privileges on Windows and Linux hosts.	2023-11-01	not yet calculated	CVE-2023-5847 MISC MISC
thorn_sftp_gateway — thorn_sftp_gateway	Thorn SFTP gateway 3.4.x before 3.4.4 uses Pivotal Spring Framework for Java deserialization of untrusted data, which is not supported by Pivotal, a related issue to CVE-2016-1000027. Also, within the specific context of Thorn SFTP gateway, this leads to remote code execution.	2023-10-31	not yet calculated	CVE-2023-47174 MISC
tinyfiledialogs — tinyfiledialogs	tinyfiledialogs (aka tiny file dialogs) before 3.8.0 allows shell metacharacters in titles, messages, and other input data.	2023-10-30	not yet calculated	CVE-2020-36767 MISC
tinyfiledialogs — tinyfiledialogs	tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input data. NOTE: this issue exists because of an incomplete fix for CVE-2020-36767, which only considered single and double quote characters.	2023-10-30	not yet calculated	CVE-2023-47104 MISC MISC
tokudaya.ekimae_mc — tokudaya.ekimae_mc	An information leak in Tokudaya.ekimae_mc v13.6.1 allows attackers to obtain the channel access token and send crafted messages.	2023-11-02	not yet calculated	CVE-2023-39054 MISC MISC
tokudaya.honten — tokudaya.honten	An information leak in Tokudaya.honten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.	2023-11-02	not yet calculated	CVE-2023-39048 MISC MISC
totolink — totolink	An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setLedCfg function.	2023-10-31	not yet calculated	CVE-2023-46484 MISC
totolink — totolink	An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setTracerouteCfg function of the stecgi.cgi component.	2023-10-31	not yet calculated	CVE-2023-46485 MISC
totolink — totolink	TOTOLINK A3300R 17.0.0cu.557_B20221024 contains a command injection via the file_name parameter in the UploadFirmwareFile function.	2023-10-31	not yet calculated	CVE-2023-46976 MISC
totolink — totolink	TOTOLINK LR1200GB V9.1.0u.6619_B20230130 was discovered to contain a stack overflow via the password parameter in the function loginAuth.	2023-10-31	not yet calculated	CVE-2023-46977 MISC
totolink — totolink	TOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control. Attackers can reset login password & WIFI passwords without authentication.	2023-10-31	not yet calculated	CVE-2023-46978 MISC
totolink — totolink	TOTOLINK X6000R V9.4.0cu.852_B20230719 was discovered to contain a command injection vulnerability via the enable parameter in the setLedCfg function.	2023-10-31	not yet calculated	CVE-2023-46979 MISC
totolink — totolink	TOTOLINK A3300R V17.0.0cu.557_B20221024 is vulnerable to Incorrect Access Control. Attackers are able to reset several critical passwords without authentication by visiting specific pages.	2023-10-31	not yet calculated	CVE-2023-46992 MISC
totolink — totolink	In TOTOLINK A3300R V17.0.0cu.557_B20221024 when dealing with setLedCfg request, there is no verification for the enable parameter, which can lead to command injection.	2023-10-31	not yet calculated	CVE-2023-46993 MISC
tp-link — tapo_c100	An issue in TP-Link Tapo C100 v1.1.15 Build 211130 Rel.15378n(4555) and before allows attackers to cause a Denial of Service (DoS) via supplying a crafted web request.	2023-10-31	not yet calculated	CVE-2023-39610 MISC
transmute-core — transmute-core	Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code.	2023-11-02	not yet calculated	CVE-2023-47204 MISC MISC
turing_video — turing_edge+_evc5fd	An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components.	2023-10-31	not yet calculated	CVE-2023-42425 MISC MISC
unisoc_(shanghai)_technologies_co.,_ltd. — multiple_products	In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2022-48457 MISC
unisoc_(shanghai)_technologies_co.,_ltd. — multiple_products	In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2022-48454 MISC
unisoc_(shanghai)_technologies_co.,_ltd. — multiple_products	In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2022-48455 MISC
unisoc_(shanghai)_technologies_co.,_ltd. — multiple_products	In camera driver, there is a possible out of bounds write due to a incorrect bounds check. This could lead to local denial of service with System execution privileges needed	2023-11-01	not yet calculated	CVE-2022-48456 MISC
unisoc_(shanghai)_technologies_co.,_ltd. — multiple_products	In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2022-48458 MISC
unisoc_(shanghai)_technologies_co.,_ltd. — multiple_products	In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2022-48459 MISC
unisoc_(shanghai)_technologies_co.,_ltd. — multiple_products	In setting service, there is a possible undefined behavior due to incorrect error handling. This could lead to local denial of service with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2022-48460 MISC
unisoc_(shanghai)_technologies_co.,_ltd. — multiple_products	In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed	2023-11-01	not yet calculated	CVE-2022-48461 MISC
univention_ucs — univention_ucs	An issue in Univention UCS v.5.0 allows a local attacker to execute arbitrary code and gain privileges via the check_univention_joinstatus function.	2023-10-31	not yet calculated	CVE-2023-38994 MISC MISC MISC
validationtools — validationtools	In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42631 MISC
validationtools — validationtools	In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42632 MISC
validationtools — validationtools	In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42633 MISC
validationtools — validationtools	In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42634 MISC
validationtools — validationtools	In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42635 MISC
validationtools — validationtools	In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42636 MISC
validationtools — validationtools	In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42637 MISC
validationtools — validationtools	In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42638 MISC
validationtools — validationtools	In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42639 MISC
validationtools — validationtools	In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42640 MISC
validationtools — validationtools	In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42641 MISC
validationtools — validationtools	In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42642 MISC
validationtools — validationtools	In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed	2023-11-01	not yet calculated	CVE-2023-42643 MISC
vinchin_backup_&_recovery — vinchin_backup_&_recovery	VinChin Backup & Recovery v5.0., v6.0., v6.7., and v7.0. was discovered to contain a command injection vulnerability.	2023-10-27	not yet calculated	CVE-2023-45498 MISC FULLDISC MISC
vinchin_backup_&_recovery — vinchin_backup_&_recovery	VinChin Backup & Recovery v5.0., v6.0., v6.7., and v7.0. was discovered to contain hardcoded credentials.	2023-10-27	not yet calculated	CVE-2023-45499 MISC FULLDISC MISC
virtualmin — virtualmin	A Stored Cross-Site Scripting (XSS) vulnerability in the Account Plans tab of System Settings in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Plan name field while editing Account plan details.	2023-11-01	not yet calculated	CVE-2023-47094 MISC
virtualmin — virtualmin	A Stored Cross-Site Scripting (XSS) vulnerability in the Custom fields of Edit Virtual Server under System Customization in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Batch Label field while details of Virtual Server.	2023-11-01	not yet calculated	CVE-2023-47095 MISC
virtualmin — virtualmin	A Reflected Cross-Site Scripting (XSS) vulnerability in the Cloudmin Services Client under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Cloudmin services master field.	2023-11-01	not yet calculated	CVE-2023-47096 MISC
virtualmin — virtualmin	A Stored Cross-Site Scripting (XSS) vulnerability in the Server Template under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Template name field while creating server templates.	2023-11-01	not yet calculated	CVE-2023-47097 MISC
virtualmin — virtualmin	A Stored Cross-Site Scripting (XSS) vulnerability in the Manage Extra Admins under Administration Options in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the real name or description field.	2023-11-01	not yet calculated	CVE-2023-47098 MISC
virtualmin — virtualmin	A Stored Cross-Site Scripting (XSS) vulnerability in the Create Virtual Server in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via Description field while creating the Virtual server.	2023-11-01	not yet calculated	CVE-2023-47099 MISC
vision_meat_works — track_diner_10/10mbl	An information leak in VISION MEAT WORKS Track Diner 10/10mbl v13.6.1 allows attackers to obtain the channel access token and send crafted messages.	2023-11-02	not yet calculated	CVE-2023-39051 MISC MISC
vmware — open-vm-tools	open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor allowing them to simulate user inputs.	2023-10-27	not yet calculated	CVE-2023-34059 MISC MISC MISC MISC MISC
vmware — tools	VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .	2023-10-27	not yet calculated	CVE-2023-34058 MISC MISC MISC MISC
vmware — workspace_one_uem_console	VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user.	2023-10-31	not yet calculated	CVE-2023-20886 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Themeisle Multiple Page Generator Plugin – MPG multiple-pages-generator-by-porthas allows SQL Injection. This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.3.19.	2023-10-31	not yet calculated	CVE-2023-33927 MISC
wordpress — wordpress	A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress. Affected is the function sf_downloads of the file secure-files.php. The manipulation of the argument downloadfile leads to path traversal. Upgrading to version 1.2 is able to address this issue. The name of the patch is cab025e5fc2bcdad8032d833ebc38e6bd2a13c92. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-243804.	2023-10-29	not yet calculated	CVE-2005-10002 MISC MISC MISC
wordpress — wordpress	A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress. This issue affects some unknown processing of the file ajax_blurb.php of the component HTTP POST Request Handler. The manipulation of the argument user leads to sql injection. The attack may be initiated remotely. Upgrading to version 0.9.7b is able to address this issue. The patch is named 7dd8acf7cd8442609840037121074425d363b694. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-243803.	2023-10-29	not yet calculated	CVE-2007-10003 MISC MISC MISC MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Paytm Paytm Payment Gateway paytm-payments allows SQL Injection. This issue affects Paytm Payment Gateway: from n/a through 2.7.3.	2023-11-03	not yet calculated	CVE-2022-45805 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Repute Infosystems ARMember armember-membership allows SQL Injection. This issue affects ARMember: from n/a through 3.4.11.	2023-11-03	not yet calculated	CVE-2022-46808 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Gopi Ramasamy Email posts to subscribers allows SQL Injection. This issue affects Email posts to subscribers: from n/a through 6.2.	2023-11-03	not yet calculated	CVE-2022-46818 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows SQL Injection. This issue affects Spiffy Calendar: from n/a through 4.9.1.	2023-11-03	not yet calculated	CVE-2022-46859 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Neshan Maps Platform Neshan Maps neshan-maps allows SQL Injection. This issue affects Neshan Maps: from n/a through 1.1.4.	2023-11-03	not yet calculated	CVE-2022-47426 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Web-X Be POPIA Compliant be-popia-compliant allows SQL Injection. This issue affects Be POPIA Compliant: from n/a through 1.2.0.	2023-11-03	not yet calculated	CVE-2022-47445 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Tips and Tricks HQ, Peter Petreski Simple Photo Gallery simple-photo-gallery allows SQL Injection. This issue affects Simple Photo Gallery: from n/a through v1.8.1.	2023-11-03	not yet calculated	CVE-2022-47588 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in GamiPress gamipress allows SQL Injection.This issue affects GamiPress: from n/a through 2.5.7.	2023-10-31	not yet calculated	CVE-2023-24000 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Contact Form – WPManageNinja LLC Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms fluentform allows SQL Injection.This issue affects Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms: from n/a through 4.3.25.	2023-10-31	not yet calculated	CVE-2023-24410 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in David F. Carr RSVPMaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 9.9.3.	2023-10-31	not yet calculated	CVE-2023-25045 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 9.9.3.	2023-10-31	not yet calculated	CVE-2023-25047 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.1.10.	2023-11-03	not yet calculated	CVE-2023-25700 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.2.0.	2023-11-03	not yet calculated	CVE-2023-25800 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Zendrop Zendrop – Global Dropshipping zendrop-dropshipping-and-fulfillment allows SQL Injection. This issue affects Zendrop – Global Dropshipping: from n/a through 1.0.0.	2023-11-03	not yet calculated	CVE-2023-25960 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Themeum Tutor LMS allows SQL Injection. This issue affects Tutor LMS: from n/a through 2.1.10.	2023-11-03	not yet calculated	CVE-2023-25990 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Chris Richardson MapPress Maps for WordPress mappress-google-maps-for-wordpress allows SQL Injection. This issue affects MapPress Maps for WordPress: from n/a through 2.85.4.	2023-11-03	not yet calculated	CVE-2023-26015 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in CRM Perks Database for Contact Form 7, WPforms, Elementor forms contact-form-entries allows SQL Injection.This issue affects Database for Contact Form 7, WPforms, Elementor forms: from n/a through 1.3.0.	2023-10-31	not yet calculated	CVE-2023-31212 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Highfivery LLC Zero Spam for WordPress allows SQL Injection. This issue affects Zero Spam for WordPress: from n/a through 5.4.4.	2023-11-03	not yet calculated	CVE-2023-32121 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Rolf van Gelder Order Your Posts Manually allows SQL Injection. This issue affects Order Your Posts Manually: from n/a through 2.2.5.	2023-11-03	not yet calculated	CVE-2023-32508 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in IT Path Solutions PVT LTD Contact Form to Any API allows SQL Injection. This issue affects Contact Form to Any API: from n/a through 1.1.2.	2023-11-04	not yet calculated	CVE-2023-32741 MISC
wordpress — wordpress	The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user’s email address. We are disclosing this issue as the developer has not yet released a patch but continues to release updates and we escalated this issue to the plugin’s team 30 days ago.	2023-11-03	not yet calculated	CVE-2023-3277 MISC MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in weDevs WP Project Manager wedevs-project-manager allows SQL Injection. This issue affects WP Project Manager: from n/a through 2.6.0.	2023-11-03	not yet calculated	CVE-2023-34383 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in WooCommerce Product Vendors allows SQL Injection. This issue affects Product Vendors: from n/a through 2.1.78.	2023-10-31	not yet calculated	CVE-2023-35879 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Nucleus_genius Quasar form free – Contact Form Builder for WordPress allows SQL Injection. This issue affects Quasar form free – Contact Form Builder for WordPress: from n/a through 6.0.	2023-11-04	not yet calculated	CVE-2023-35910 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress contact-form-to-db allows SQL Injection. This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: from n/a through 1.7.1.	2023-10-31	not yet calculated	CVE-2023-36508 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Favethemes Houzez – Real Estate WordPress Theme allows SQL Injection.This issue affects Houzez – Real Estate WordPress Theme: from n/a through 1.3.4.	2023-11-03	not yet calculated	CVE-2023-36529 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Smartypants SP Project & Document Manager allows SQL Injection. This issue affects SP Project & Document Manager: from n/a through 4.67.	2023-11-03	not yet calculated	CVE-2023-36677 MISC
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Themesgrove Onepage Builder allows SQL Injection. This issue affects Onepage Builder: from n/a through 2.4.1.	2023-11-04	not yet calculated	CVE-2023-38391 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Groundhogg Inc. Groundhogg plugin <= 2.7.11.10 versions.	2023-10-31	not yet calculated	CVE-2023-40681 MISC
wordpress — wordpress	The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.	2023-10-31	not yet calculated	CVE-2023-4250 MISC
wordpress — wordpress	The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.	2023-10-31	not yet calculated	CVE-2023-4251 MISC
wordpress — wordpress	The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).	2023-10-31	not yet calculated	CVE-2023-4390 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebCource WC Captcha plugin <= 1.4 versions.	2023-10-31	not yet calculated	CVE-2023-46210 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Zaytech Smart Online Order for Clover plugin <= 1.5.4 versions.	2023-10-31	not yet calculated	CVE-2023-46312 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Katie Seaborn Zotpress plugin <= 7.3.4 versions.	2023-10-31	not yet calculated	CVE-2023-46313 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ollybach WPPizza – A Restaurant Plugin plugin <= 3.18.2 versions.	2023-10-31	not yet calculated	CVE-2023-46622 MISC
wordpress — wordpress	The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change them and perform Stored Cross-Site Scripting.	2023-10-31	not yet calculated	CVE-2023-4823 MISC
wordpress — wordpress	The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced	2023-10-31	not yet calculated	CVE-2023-4836 MISC MISC
wordpress — wordpress	The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rafflepress’ and ‘rafflepress_gutenberg’ shortcode in versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping on ‘giframe’ user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-30	not yet calculated	CVE-2023-5049 MISC MISC MISC MISC
wordpress — wordpress	The iframe forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘iframe’ shortcode in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-31	not yet calculated	CVE-2023-5073 MISC MISC
wordpress — wordpress	The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string “true”, which could lead to a variety of outcomes, including DoS.	2023-10-31	not yet calculated	CVE-2023-5098 MISC
wordpress — wordpress	The HTML filter and csv-file search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.7 via the ‘src’ attribute of the ‘csvsearch’ shortcode. This allows authenticated attackers, with contributor-level permissions and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.	2023-10-31	not yet calculated	CVE-2023-5099 MISC MISC
wordpress — wordpress	The idbbee plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘idbbee’ shortcode in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-31	not yet calculated	CVE-2023-5114 MISC MISC
wordpress — wordpress	The Live updates from Excel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘ipushpull_page’ shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-31	not yet calculated	CVE-2023-5116 MISC MISC
wordpress — wordpress	The Bellows Accordion Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-30	not yet calculated	CVE-2023-5164 MISC MISC MISC
wordpress — wordpress	The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the ‘php-to-page’ shortcode. This allows authenticated attackers with subscriber-level permissions or above, to include local file and potentially execute code on the server. While subscribers may need to poison log files or otherwise get a file installed in order to achieve remote code execution, author and above users can upload files by default and achieve remote code execution easily.	2023-10-30	not yet calculated	CVE-2023-5199 MISC MISC
wordpress — wordpress	The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the ‘id’ parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting vulnerability.	2023-10-31	not yet calculated	CVE-2023-5211 MISC
wordpress — wordpress	The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed	2023-10-31	not yet calculated	CVE-2023-5229 MISC
wordpress — wordpress	The Memberlite Shortcodes WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.	2023-10-31	not yet calculated	CVE-2023-5237 MISC MISC
wordpress — wordpress	The EventPrime WordPress plugin before 3.2.0 does not sanitize and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.	2023-10-31	not yet calculated	CVE-2023-5238 MISC
wordpress — wordpress	The Login Screen Manager WordPress plugin through 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	2023-10-31	not yet calculated	CVE-2023-5243 MISC
wordpress — wordpress	The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.2 via a shortcode attribute. This allows subscriber-level, and above, attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files with arbitrary content can be uploaded and included. This is limited to .php files.	2023-10-30	not yet calculated	CVE-2023-5250 MISC MISC
wordpress — wordpress	The Grid Plus plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the ‘grid_plus_save_layout_callback’ and ‘grid_plus_delete_callback’ functions in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with subscriber privileges or above, to add, update or delete grid layout.	2023-10-30	not yet calculated	CVE-2023-5251 MISC MISC MISC
wordpress — wordpress	The FareHarbor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-30	not yet calculated	CVE-2023-5252 MISC MISC
wordpress — wordpress	The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitize and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks via certain headers.	2023-10-31	not yet calculated	CVE-2023-5307 MISC MISC
wordpress — wordpress	The Google Maps made Simple plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-30	not yet calculated	CVE-2023-5315 MISC MISC
wordpress — wordpress	The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.	2023-10-31	not yet calculated	CVE-2023-5360 MISC
wordpress — wordpress	The Carousel, Recent Post Slider and Banner Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘spice_post_slider’ shortcode in versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-30	not yet calculated	CVE-2023-5362 MISC MISC MISC MISC
wordpress — wordpress	The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-31	not yet calculated	CVE-2023-5412 MISC MISC MISC
wordpress — wordpress	The Image vertical reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 9.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-31	not yet calculated	CVE-2023-5428 MISC MISC MISC
wordpress — wordpress	The Information Reel plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-31	not yet calculated	CVE-2023-5429 MISC MISC MISC
wordpress — wordpress	The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-31	not yet calculated	CVE-2023-5430 MISC MISC MISC
wordpress — wordpress	The Left right image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-31	not yet calculated	CVE-2023-5431 MISC MISC MISC
wordpress — wordpress	The Message ticker plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-31	not yet calculated	CVE-2023-5433 MISC MISC MISC
wordpress — wordpress	The Superb slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-31	not yet calculated	CVE-2023-5434 MISC MISC MISC
wordpress — wordpress	The Up down image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-31	not yet calculated	CVE-2023-5435 MISC MISC MISC
wordpress — wordpress	The Vertical marquee plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-31	not yet calculated	CVE-2023-5436 MISC MISC MISC
wordpress — wordpress	The WP fade in text news plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-31	not yet calculated	CVE-2023-5437 MISC MISC MISC
wordpress — wordpress	The wp image slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-31	not yet calculated	CVE-2023-5438 MISC MISC MISC
wordpress — wordpress	The Wp photo text slider 50 plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-31	not yet calculated	CVE-2023-5439 MISC MISC MISC
wordpress — wordpress	The CITS Support svg, webp Media and TTF, OTF File Upload WordPress plugin before 3.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.	2023-10-31	not yet calculated	CVE-2023-5458 MISC
wordpress — wordpress	The Jquery accordion slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-31	not yet calculated	CVE-2023-5464 MISC MISC MISC
wordpress — wordpress	The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.	2023-10-31	not yet calculated	CVE-2023-5519 MISC
wordpress — wordpress	The WP Simple Galleries plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.34 via deserialization of untrusted input from the ‘wpsimplegallery_gallery’ post meta via ‘wpsgallery’ shortcode. This allows authenticated attackers, with contributor-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.	2023-10-30	not yet calculated	CVE-2023-5583 MISC MISC
wordpress — wordpress	The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions 4.8.6 through 4.9.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. NOTE: This vulnerability is a re-introduction of CVE-2023-4253.	2023-11-02	not yet calculated	CVE-2023-5606 MISC MISC
wordpress — wordpress	The Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘tcpaccordion’ shortcode in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-30	not yet calculated	CVE-2023-5666 MISC MISC MISC
wordpress — wordpress	The SEO Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘slider’ shortcode and post meta in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-11-03	not yet calculated	CVE-2023-5707 MISC MISC MISC MISC
wordpress — wordpress	The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the ‘dfads_ajax_load_ads’ function. This allows unauthenticated attackers to execute code on the server. The parameters of the callable function are limited, they cannot be specified arbitrarily.	2023-10-30	not yet calculated	CVE-2023-5843 MISC MISC
wordpress — wordpress	The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site’s server which may make remote code execution possible.	2023-11-02	not yet calculated	CVE-2023-5860 MISC MISC
wordpress — wordpress	The video carousel slider with lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the responsive_video_gallery_with_lightbox_video_management_func() function. This makes it possible for unauthenticated attackers to delete videos hosted from the video slider via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-11-03	not yet calculated	CVE-2023-5945 MISC MISC MISC
wordpress — wordpress	The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘current_group_id’ parameter in version 6.0.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	2023-11-03	not yet calculated	CVE-2023-5946 MISC MISC
wpn-xm_serverstack — wpn-xm_serverstack	A local file inclusion vulnerability has been found in WPN-XM Serverstack affecting version 0.8.6, which would allow an unauthenticated user to perform a local file inclusion (LFI) via the /tools/webinterface/index.php?page parameter by sending a GET request. This vulnerability could lead to the loading of a PHP file on the server, leading to a critical webshell exploit.	2023-11-03	not yet calculated	CVE-2023-4591 MISC
wpn-xm_serverstack — wpn-xm_serverstack	A Cross-Site Scripting vulnerability has been detected in WPN-XM Serverstack affecting version 0.8.6. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload through the /tools/webinterface/index.php parameter and retrieve the cookie session details of an authenticated user, resulting in a session hijacking.	2023-11-03	not yet calculated	CVE-2023-4592 MISC
wuzhicms — wuzhicms	SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute arbitrary code via the Database Backup Functionality in the coreframe/app/database/admin/index.php component.	2023-11-01	not yet calculated	CVE-2023-46482 MISC
yettiesoft — vestcert	In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution.	2023-10-30	not yet calculated	CVE-2023-45798 MISC
zentao — zentao	A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.	2023-11-02	not yet calculated	CVE-2023-46475 MISC MISC
nats.io — multiple_products	NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library’s `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.	2023-10-31	not yet calculated	CVE-2023-46129 MISC MISC

alerts

CISA Published When to Issue VEX Information

Post author By admin
Post date November 6, 2023

Today, CISA published When to Issue Vulnerability Exploitability eXchange (VEX) Information, developed by a community of industry and government experts with the goal to offer some guidance and structure for the software security world, including the large and growing global SBOM community.

This guide explains the circumstances and events that could lead an entity to issue VEX information and describes the entities that create or consume VEX information. Whether, and when, to issue VEX information is a business decision for most suppliers and possibly a more individual decision for independent open source developers. This document identifies factors that influence the decision.

For more information, read the new reference material When to Issue Vulnerability Exploitability eXchange (VEX) Information.

alerts

CISA Updates Guidance for Addressing Cisco IOS XE Web UI Vulnerabilities

Post author By admin
Post date November 1, 2023

Today, CISA updated its guidance addressing two vulnerabilities, CVE-2023-20198 and CVE-2023-20273, affecting Cisco’s Internetworking Operating System (IOS) XE Software Web User Interface (UI).

The guidance now notes that Cisco has fixed these vulnerabilities for the 17.3 Cisco IOS XE software release train with version 17.3.8a. CISA urges organizations to immediately apply necessary updates.

CISA urges organizations to review:

alerts

VMware Releases Advisory for VMware Tools Vulnerabilities

Post author By admin
Post date October 30, 2023

VMware released a security advisory addressing multiple vulnerabilities (CVE-2023-34057, CVE-2023-34058) in VMware Tools. A cyber actor could exploit one of these vulnerabilities to take control of an affected system.

CISA encourages users and administrators to review the VMware advisory VMSA-2023-0024 and apply the necessary updates.

alerts

Vulnerability Summary for the Week of October 23, 2023

Post author By admin
Post date October 30, 2023

High Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
projectworlds_pvt._limited — online_art_gallery	Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘fnm’ parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-10-26	9.8	CVE-2023-43737 MISC MISC
projectworlds_pvt._limited — online_art_gallery	Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ’email’ parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-10-27	9.8	CVE-2023-43738 MISC MISC
projectworlds_pvt._limited — online_art_gallery	Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘contact’ parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-10-27	9.8	CVE-2023-44162 MISC MISC
projectworlds_pvt._limited — online_art_gallery	Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘lnm’ parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-10-26	9.8	CVE-2023-44267 MISC MISC
projectworlds_pvt._limited — online_art_gallery	Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘gender’ parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-10-26	9.8	CVE-2023-44268 MISC MISC
projectworlds_pvt._limited — online_art_gallery	Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘add1’ parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-10-27	9.8	CVE-2023-44375 MISC MISC
projectworlds_pvt._limited — online_art_gallery	Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘add2’ parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-10-27	9.8	CVE-2023-44376 MISC MISC
projectworlds_pvt._limited — online_art_gallery	Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘add3’ parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-10-27	9.8	CVE-2023-44377 MISC MISC
apache — http_server	Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.57.	2023-10-23	9.1	CVE-2023-31122 MISC MISC MISC
byzoro — smart_s85f_firmware	A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btn_file_renew leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243059. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-10-21	9.8	CVE-2023-5683 MISC MISC MISC
byzoro — smart_s85f_firmware	A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /importexport.php. The manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243061 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-10-21	9.8	CVE-2023-5684 MISC MISC MISC
calibre-ebook — calibre	link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root.	2023-10-22	7.5	CVE-2023-46303 MISC MISC
codeastro — internet_banking_system	A vulnerability was found in CodeAstro Internet Banking System 1.0 and classified as critical. This issue affects some unknown processing of the file pages_reset_pwd.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243131.	2023-10-22	9.8	CVE-2023-5693 MISC MISC MISC
color — demoiccmax	In International Color Consortium DemoIccMAX 79ecb74, there is a stack-based buffer overflow in the icFixXml function in IccXML/IccLibXML/IccUtilXml.cpp in libIccXML.a.	2023-10-23	8.8	CVE-2023-46602 MISC
color — demoiccmax	In International Color Consortium DemoIccMAX 79ecb74, there is an out-of-bounds read in the CIccPRMG::GetChroma function in IccProfLib/IccPrmg.cpp in libSampleICC.a.	2023-10-23	7.8	CVE-2023-46603 MISC
dell — unity_operating_environment	Dell Unity prior to 5.3 contains a Restricted Shell Bypass vulnerability. This could allow an authenticated, local attacker to exploit this vulnerability by authenticating to the device CLI and issuing certain commands.	2023-10-23	7.8	CVE-2023-43066 MISC
dell — unity_operating_environment	Dell Unity 5.3 contain(s) an Arbitrary File Creation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by crafting arbitrary files through a request to the server.	2023-10-23	7.5	CVE-2023-43074 MISC
edm_informatics — e-invoice	Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting. This issue affects E-invoice: before 2.1.	2023-10-27	7.5	CVE-2023-5443 MISC
f5 — big-ip	Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated	2023-10-26	9.8	CVE-2023-46747 MISC
f5 — big-ip	An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated	2023-10-26	8.8	CVE-2023-46748 MISC
frostming — pdm	pdm is a Python package and dependency manager supporting the latest PEP standards. It’s possible to craft a malicious `pdm.lock` file that could allow e.g., an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project `foo` can be targeted by creating the project `foo-2` and uploading the file `foo-2-2.tar.gz` to pypi.org. PyPI will see this as project `foo-2` version `2`, while PDM will see this as project `foo` version `2-2`. The version must only be `parseable as a version` and the filename must be a prefix of the project name, but it’s not verified to match the version being installed. Version `2-2` is also not a valid normalized version per PEP 440. Matching the project name exactly (not just prefix) would fix the issue. When installing dependencies with PDM, what’s actually installed could differ from what’s listed in `pyproject.toml` (including arbitrary code execution on install). It could also be used for downgrade attacks by only changing the version. This issue has been addressed in commit `6853e2642df` which is included in release version `2.9.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-20	7.8	CVE-2023-45805 MISC MISC MISC MISC MISC
ibm — cognos_dashboards_on_cloud_pak_for_data	IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in container images which could lead to further attacks against the system. IBM X-Force ID: 260730.	2023-10-22	7.5	CVE-2023-38275 MISC MISC
ibm — cognos_dashboards_on_cloud_pak_for_data	IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in environment variables which could aid in further attacks against the system. IBM X-Force ID: 260736.	2023-10-22	7.5	CVE-2023-38276 MISC MISC
ibm — security_verify_governance	IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 225222.	2023-10-23	9.8	CVE-2022-22466 MISC MISC
ibm — security_verify_governance	IBM Security Verify Governance 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 256036.	2023-10-23	8.8	CVE-2023-33839 MISC MISC
ibm — security_verify_governance	IBM Security Verify Governance 10.0 does not encrypt sensitive or critical information before storage or transmission. IBM X-Force ID: 256020.	2023-10-23	7.5	CVE-2023-33837 MISC MISC
ibm — sterling_partner_engagement_manager	IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM X-Force ID: 266896.	2023-10-23	7.5	CVE-2023-43045 MISC MISC
idattend — idweb	Unauthenticated SQL injection in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.	2023-10-25	9.1	CVE-2023-26568 MISC
idattend — idweb	Unauthenticated SQL injection in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.	2023-10-25	9.1	CVE-2023-26569 MISC
idattend — idweb	Unauthenticated SQL injection in the GetExcursionList method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.	2023-10-25	9.1	CVE-2023-26572 MISC
idattend — idweb	Missing authentication in the SetDB method in IDAttend’s IDWeb application 3.1.052 and earlier allows denial of service or theft of database login credentials.	2023-10-25	9.1	CVE-2023-26573 MISC
idattend — idweb	Unauthenticated SQL injection in the GetVisitors method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.	2023-10-25	9.1	CVE-2023-26581 MISC
idattend — idweb	Unauthenticated SQL injection in the GetExcursionDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.	2023-10-25	9.1	CVE-2023-26582 MISC
idattend — idweb	Unauthenticated SQL injection in the GetCurrentPeriod method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.	2023-10-25	9.1	CVE-2023-26583 MISC
idattend — idweb	Unauthenticated SQL injection in the GetStudentInconsistencies method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.	2023-10-25	9.1	CVE-2023-26584 MISC
idattend — idweb	Unauthenticated SQL injection in the GetRoomChanges method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.	2023-10-25	9.1	CVE-2023-27254 MISC
idattend — idweb	Unauthenticated SQL injection in the DeleteRoomChanges method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.	2023-10-25	9.1	CVE-2023-27255 MISC
idattend — idweb	Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.	2023-10-25	9.1	CVE-2023-27260 MISC
idattend — idweb	Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers.	2023-10-25	9.1	CVE-2023-27262 MISC
idattend — idweb	Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP or ASPX, gaining command execution on the affected server.	2023-10-25	8.8	CVE-2023-26578 MISC
idattend — idweb	Missing authentication in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers.	2023-10-25	7.5	CVE-2023-26570 MISC
idattend — idweb	Missing authentication in the SetStudentNotes method in IDAttend’s IDWeb application 3.1.052 and earlier allows modification of student data by unauthenticated attackers.	2023-10-25	7.5	CVE-2023-26571 MISC
idattend — idweb	Missing authentication in the SearchStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers.	2023-10-25	7.5	CVE-2023-26574 MISC
idattend — idweb	Missing authentication in the SearchStudentsStaff method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student and teacher data by unauthenticated attackers.	2023-10-25	7.5	CVE-2023-26575 MISC
idattend — idweb	Missing authentication in the SearchStudentsRFID method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers.	2023-10-25	7.5	CVE-2023-26576 MISC
idattend — idweb	Unauthenticated arbitrary file read in the IDAttend’s IDWeb application 3.1.013 allows the retrieval of any file present on the web server by unauthenticated attackers.	2023-10-25	7.5	CVE-2023-26580 MISC
idattend — idweb	Missing authentication in the GetActiveToiletPasses method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student information by unauthenticated attackers.	2023-10-25	7.5	CVE-2023-27257 MISC
idattend — idweb	Missing authentication in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student and teacher data by unauthenticated attackers.	2023-10-25	7.5	CVE-2023-27258 MISC
idattend — idweb	Missing authentication in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student and teacher data by unauthenticated attackers.	2023-10-25	7.5	CVE-2023-27259 MISC
idattend — idweb	Missing authentication in the StudentPopupDetails_ContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student data by unauthenticated attackers.	2023-10-25	7.5	CVE-2023-27375 MISC
idattend — idweb	Missing authentication in the StudentPopupDetails_StudentDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student data by unauthenticated attackers.	2023-10-25	7.5	CVE-2023-27376 MISC
idattend — idweb	Missing authentication in the StudentPopupDetails_EmergencyContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student data by unauthenticated attackers.	2023-10-25	7.5	CVE-2023-27377 MISC
inohom — home_manager_gateway	Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Account Footprinting. This issue affects Home Manager Gateway: before v.1.27.12.	2023-10-27	7.5	CVE-2023-5570 MISC
langchain — langchain	In Langchain through 0.0.155, prompt injection allows execution of arbitrary code against the SQL service provided by the chain.	2023-10-20	9.8	CVE-2023-32785 MISC
langchain — langchain	In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.	2023-10-20	7.5	CVE-2023-32786 MISC
m-files — web_companion	Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution	2023-10-20	7.8	CVE-2023-5523 MISC
modoboa — modoboa	Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.	2023-10-20	8.8	CVE-2023-5690 MISC MISC
mosparo — mosparo	Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3.	2023-10-20	8.8	CVE-2023-5687 MISC MISC
netentsec — application_security_gateway	A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /protocol/iscgwtunnel/uploadiscgwrouteconf.php. The manipulation of the argument GWLinkId leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-243138 is the identifier assigned to this vulnerability.	2023-10-23	9.8	CVE-2023-5700 MISC MISC MISC
netentsec — application_security_gateway	A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/list_addr_fwresource_ip.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243057 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-10-20	7.2	CVE-2023-5681 MISC MISC MISC
openimageio — openimageio	An issue in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service via the read_rle_image function of file bifs/unquantize.c	2023-10-23	8.8	CVE-2023-42295 MISC
pleaser — pleaser	please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)	2023-10-20	7.8	CVE-2023-46277 MISC MISC MISC MISC
projectworlds_pvt._limited — leave_management_system_project	Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The ‘setcasualleave’ parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-10-27	9.8	CVE-2023-44480 MISC MISC
qnap — qusbcam2	An OS command injection vulnerability has been reported to affect QUSBCam2. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: QUSBCam2 2.0.3 ( 2023/06/15 ) and later	2023-10-20	8.8	CVE-2023-23373 MISC
radare — radare2	Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.	2023-10-20	8.8	CVE-2023-5686 MISC MISC
reconftw — reconftw	reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities. A vulnerability has been identified in reconftw where inadequate validation of retrieved subdomains may lead to a Remote Code Execution (RCE) attack. An attacker can exploit this vulnerability by crafting a malicious CSP entry on it’s own domain. Successful exploitation can lead to the execution of arbitrary code within the context of the application, potentially compromising the system. This issue has been addressed in version 2.7.1.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-20	8.8	CVE-2023-46117 MISC MISC
secudos — qiata	SECUDOS Qiata (DOMOS OS) 4.13 has Insecure Permissions for the previewRm.sh daily cronjob. To exploit this, an attacker needs access as a low-privileged user to the underlying DOMOS system. Every user on the system has write permission for previewRm.sh, which is executed by the root user.	2023-10-20	7.8	CVE-2023-40361 MISC
silabs — gecko_bootloader	An integer overflow in Silicon Labs Gecko Bootloader version 4.3.1 and earlier allows unbounded memory access when reading from or writing to storage slots.	2023-10-20	7.8	CVE-2023-3487 MISC MISC
sitolog — sitolog_application_connect	Sitolog sitologapplicationconnect v7.8.a and before was discovered to contain a SQL injection vulnerability via the component /activate_hook.php.	2023-10-20	9.8	CVE-2023-37824 MISC
sollace — unicopia	Sollace Unicopia version 1.1.1 and before was discovered to deserialize untrusted data, allowing attackers to execute arbitrary code.	2023-10-20	9.8	CVE-2023-39680 MISC
stb_image.h — stb_image.h	stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn’t give guarantees about the content of output value `delays` upon failure. Although it sets `delays` to zero at the beginning, it doesn’t do it in case the image is not recognized as GIF and a call to `stbi__load_gif_main_outofmem` only frees possibly allocated memory in `delays` without resetting it to zero. It would be fair to say the caller of `stbi__load_gif_main` is responsible to free the allocated memory in `delays` only if `stbi__load_gif_main` returns a non-null value. However, at the same time the function may return null value but fail to free the memory in `*delays` if internally `stbi__convert_format` is called and fails. The issue may lead to a memory leak if the caller chooses to free `delays` only when `stbi__load_gif_main` didn’t fail or to a double-free if the `delays` is always freed	2023-10-21	9.8	CVE-2023-45666 MISC MISC MISC
stb_image.h — stb_image.h	stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free the out variable. This happens in `stbi__load_gif_main` because when the `layers * stride` value is zero the behavior is implementation defined, but common that realloc frees the old memory and returns null pointer. Since it attempts to double-free the memory a few lines below the first “free”, the issue can be potentially exploited only in a multi-threaded environment. In the worst case this may lead to code execution.	2023-10-21	8.8	CVE-2023-45664 MISC MISC
stb_image.h — stb_image.h	stb_image is a single file MIT licensed library for processing images. When `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_comp` is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. A crafted image file can trigger `memcpy` out-of-bounds read because `bytes_per_pixel` used to calculate `bytes_per_row` doesn’t match the real image array dimensions.	2023-10-21	8.1	CVE-2023-45662 MISC MISC
stb_image.h — stb_image.h	stb_image is a single file MIT licensed library for processing images. If `stbi__load_gif_main` in `stbi_load_gif_from_memory` fails, it returns a null pointer and may keep the `z` variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls `stbi__vertical_flip_slices` with the null pointer result value and the uninitialized `z` value. This may result in a program crash.	2023-10-21	7.5	CVE-2023-45667 MISC MISC MISC
stb_image.h — stb_image.h	stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in `stbi__gif_load_next`. This happens because two_back points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory allocation information.	2023-10-21	7.1	CVE-2023-45661 MISC MISC MISC
stb_image.h — stb_vorbis.c	stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[i] = get8_packet(f);`. The root cause is an integer overflow in `setup_malloc`. A sufficiently large value in the variable `sz` overflows with `sz+7` in and the negative value passes the maximum available memory buffer check. This issue may lead to code execution.	2023-10-21	7.8	CVE-2023-45676 MISC MISC MISC
stb_image.h — stb_vorbis.c	stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)’’;`. The root cause is that if `len` read in `start_decoder` is a negative number and `setup_malloc` successfully allocates memory in that case, but memory write is done with a negative index `len`. Similarly if len is INT_MAX the integer overflow len+1 happens in `f->vendor = (char)setup_malloc(f, sizeof(char) (len+1));` and `f->comment_list[i] = (char)setup_malloc(f, sizeof(char) (len+1));`. This issue may lead to code execution.	2023-10-21	7.8	CVE-2023-45677 MISC MISC MISC MISC MISC MISC
stb_image.h — stb_vorbis.c	stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in `start_decoder` because at maximum `m->submaps` can be 16 but `submap_floor` and `submap_residue` are declared as arrays of 15 elements. This issue may lead to code execution.	2023-10-21	7.8	CVE-2023-45678 MISC MISC MISC
stb_image.h — stb_vorbis.c	stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In that case the function returns early, but some of the pointers in `f->comment_list` are left initialized and later `setup_free` is called on these pointers in `vorbis_deinit`. This issue may lead to code execution.	2023-10-21	7.8	CVE-2023-45679 MISC MISC MISC
stb_image.h — stb_vorbis.c	stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential integer overflow in `sizeof(char) (f->comment_list_length)` which may make `setup_malloc` allocate less memory than required. Since there is another integer overflow an attacker may overflow it too to force `setup_malloc` to return 0 and make the exploit more reliable. This issue may lead to code execution.	2023-10-21	7.8	CVE-2023-45681 MISC MISC
stb_image.h — stb_vorbis.c	stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds read in `DECODE` macro when `var` is negative. As it can be seen in the definition of `DECODE_RAW` a negative `var` is a valid value. This issue may be used to leak internal memory allocation information.	2023-10-21	7.1	CVE-2023-45682 MISC MISC MISC MISC
stb_image.h — stb_vorbis.c	stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)’’;`. The root cause is that if the len read in `start_decoder` is `-1` and `len + 1` becomes 0 when passed to `setup_malloc`. The `setup_malloc` behaves differently when `f->alloc.alloc_buffer` is pre-allocated. Instead of returning `NULL` as in `malloc` case it shifts the pre-allocated buffer by zero and returns the currently available memory block. This issue may lead to code execution.	2023-10-21	7.8	CVE-2023-45675 MISC MISC MISC MISC
superwebmailer — superwebmailer	An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Export SQL Injection via the size parameter.	2023-10-21	8.8	CVE-2023-38190 MISC MISC
superwebmailer — superwebmailer	An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Remote Code Execution via a crafted sendmail command line.	2023-10-21	8.8	CVE-2023-38193 MISC MISC
thingnario — photon	An issue in ThingNario Photon v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the ping function to the “thingnario Logger Maintenance Webpage” endpoint.	2023-10-21	8.8	CVE-2023-46055 MISC
tongda — oa	A vulnerability has been found in Tongda OA 2017 and classified as critical. This vulnerability affects unknown code of the file general/hr/training/record/delete.php. The manipulation of the argument RECORD_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-243058 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-10-20	9.8	CVE-2023-5682 MISC MISC MISC
totolink — a3700r_firmware	An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function.	2023-10-25	9.8	CVE-2023-46574 MISC
totolink — x2000r_firmware	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDel.	2023-10-25	9.8	CVE-2023-46554 MISC MISC
totolink — x2000r_firmware	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPortFw.	2023-10-25	9.8	CVE-2023-46555 MISC MISC
totolink — x2000r_firmware	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formFilter.	2023-10-25	9.8	CVE-2023-46556 MISC MISC
totolink — x2000r_firmware	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAPVLAN.	2023-10-25	9.8	CVE-2023-46557 MISC MISC
totolink — x2000r_firmware	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDelDevice.	2023-10-25	9.8	CVE-2023-46558 MISC MISC
totolink — x2000r_firmware	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIPv6Addr.	2023-10-25	9.8	CVE-2023-46559 MISC MISC
totolink — x2000r_firmware	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formTcpipSetup.	2023-10-25	9.8	CVE-2023-46560 MISC MISC
totolink — x2000r_firmware	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDosCfg.	2023-10-25	9.8	CVE-2023-46562 MISC MISC
totolink — x2000r_firmware	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpQoS.	2023-10-25	9.8	CVE-2023-46563 MISC MISC
totolink — x2000r_firmware	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDMZ.	2023-10-25	9.8	CVE-2023-46564 MISC MISC
tp-link — tl-wr886n_firmware	TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function uninstallPluginReqHandle.	2023-10-25	9.8	CVE-2023-46520 MISC MISC
tp-link — tl-wr886n_firmware	TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function RegisterRegister.	2023-10-25	9.8	CVE-2023-46521 MISC MISC
tp-link — tl-wr886n_firmware	TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function deviceInfoRegister.	2023-10-25	9.8	CVE-2023-46522 MISC MISC
tp-link — tl-wr886n_firmware	TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function upgradeInfoRegister.	2023-10-25	9.8	CVE-2023-46523 MISC MISC
tp-link — tl-wr886n_firmware	TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function loginRegister.	2023-10-25	9.8	CVE-2023-46525 MISC MISC
tp-link — tl-wr886n_firmware	TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function resetCloudPwdRegister.	2023-10-25	9.8	CVE-2023-46526 MISC MISC
tp-link — tl-wr886n_firmware	TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function bindRequestHandle.	2023-10-25	9.8	CVE-2023-46527 MISC MISC
tp-link — tl-wr886n_firmware	TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function modifyAccPwdRegister.	2023-10-25	9.8	CVE-2023-46534 MISC MISC
tp-link — tl-wr886n_firmware	TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function getResetVeriRegister.	2023-10-25	9.8	CVE-2023-46535 MISC MISC
tp-link — tl-wr886n_firmware	TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function chkRegVeriRegister.	2023-10-25	9.8	CVE-2023-46536 MISC MISC
tp-link — tl-wr886n_firmware	TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function getRegVeriRegister.	2023-10-25	9.8	CVE-2023-46537 MISC MISC
tp-link — tl-wr886n_firmware	TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function chkResetVeriRegister.	2023-10-25	9.8	CVE-2023-46538 MISC MISC
tp-link — tl-wr886n_firmware	TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function registerRequestHandle.	2023-10-25	9.8	CVE-2023-46539 MISC MISC
trtek_software — education_portal	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in TRtek Software Education Portal allows SQL Injection. This issue affects Education Portal: before 3.2023.29.	2023-10-27	9.8	CVE-2023-5807 MISC
vercel — next.js	Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.	2023-10-22	7.5	CVE-2023-46298 MISC MISC MISC
vmware — fusion	VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the ‘.dmg’ volume) or when installing an upgrade. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time.	2023-10-20	7.8	CVE-2023-34045 MISC
vmware — fusion	VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the ‘.dmg’ volume) or when installing an upgrade. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time.	2023-10-20	7	CVE-2023-34046 MISC
wallix — bastion	WALLIX Bastion 9.x before 9.0.9 and 10.x before 10.0.5 allows unauthenticated access to sensitive information by bypassing access control on a network access administration web interface.	2023-10-23	7.5	CVE-2023-46319 MISC
wordpress — wordpress	The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. This can allow unauthenticated attackers to extract sensitive data including installed plugins (present and active), active theme, various plugin settings, WordPress version, as well as some server settings such as memory limit, installation paths.	2023-10-20	7.5	CVE-2023-4668 MISC MISC
wordpress — wordpress	The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the ‘zeroBSCRM_CSVImporterLitehtml_app’ function in versions up to, and including, 5.3.1. While the function performs a nonce check, steps 2 and 3 of the check do not take any action upon a failed check. These steps then perform a ‘file_exists’ check on the value of ‘zbscrmcsvimpf’. If a phar:// archive is supplied, its contents will be deserialized and an object injected in the execution stream. This allows an unauthenticated attacker to obtain object injection if they are able to upload a phar archive (for instance if the site supports image uploads) and then trick an administrator into performing an action, such as clicking a link.	2023-10-20	8.8	CVE-2022-3342 MISC MISC MISC
wordpress — wordpress	The Brizy plugin for WordPress is vulnerable to authorization bypass due to an incorrect capability check on the is_administrator() function in versions up to, and including, 1.0.125. This makes it possible for authenticated attackers to access and interact with available AJAX functions.	2023-10-20	8.1	CVE-2020-36714 MISC MISC
wordpress — wordpress	The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and including, 2.50. This is due to missing capability checks on several AJAX actions and nonce disclosure in the source page of the administrative dashboard. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to call functions and delete and/or upload files.	2023-10-20	8.8	CVE-2020-36698 MISC MISC MISC
wordpress — wordpress	The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the ‘ctl_sanitize_title’ function in versions up to, and including, 3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This potentially allows authenticated users with the ability to add or modify terms or tags to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A partial patch became available in version 3.6 and the issue was fully patched in version 3.7.	2023-10-20	8.8	CVE-2022-4290 MISC MISC
wordpress — wordpress	The Horizontal scrolling announcement plugin for WordPress is vulnerable to SQL Injection via the plugin’s [horizontal-scrolling] shortcode in versions up to, and including, 9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-20	8.8	CVE-2023-4999 MISC MISC
wordpress — wordpress	The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php file. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.	2023-10-20	9.8	CVE-2023-4488 MISC MISC
wordpress — wordpress	The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the show_es_logs function. This allows administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive information including those belonging to other sites, for example in shared hosting environments.	2023-10-20	7.2	CVE-2023-5414 MISC MISC MISC
wordpress — wordpress	The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the ‘cli_path’ parameter in versions up to and including 1.7.5. This makes it possible for unauthenticated users to run arbitrary commands leading to remote command execution, granted they can trick a site administrator into performing an action such as clicking on a link. This makes it possible for an attacker to create and or modify files hosted on the server which can easily grant attackers backdoor access to the affected server.	2023-10-20	8.8	CVE-2022-2441 MISC MISC MISC MISC MISC MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in PluginEver WC Serial Numbers plugin <= 1.6.3 versions.	2023-10-21	8.8	CVE-2023-46078 MISC
wordpress — wordpress	The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_save_options function. This makes it possible for unauthenticated attackers to modify the plugin’s settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additionally, input sanitization and escaping is insufficient resulting in the possibility of malicious script injection.	2023-10-20	8.8	CVE-2023-4920 MISC MISC MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Qwerty23 Rocket Font plugin <= 1.2.3 versions.	2023-10-21	8.8	CVE-2023-46067 MISC
wordpress — wordpress	The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check on the fpd_update_options function in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify site options, including setting the default role to administrator which can allow privilege escalation.	2023-10-20	8.8	CVE-2021-4334 MISC MISC
wordpress — wordpress	The Simple:Press – WordPress Forum Plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ~/admin/resources/jscript/ajaxupload/sf-uploader.php file in versions up to, and including, 6.6.0. This makes it possible for attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.	2023-10-20	9.8	CVE-2020-36706 MISC MISC MISC MISC
wordpress — wordpress	The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parseRemoteRequest function in versions up to, and including, 6.0.1. This makes it possible for unauthenticated attackers with knowledge of an existing WooCommerce Order ID to expose sensitive WooCommerce order information (e.g., Name, Address, Email Address, and other order metadata).	2023-10-21	7.5	CVE-2023-5132 MISC MISC
wordpress — wordpress	The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the get_posts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.	2023-10-20	8.1	CVE-2023-4386 MISC MISC
wordpress — wordpress	The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the get_products function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.	2023-10-20	9.8	CVE-2023-4402 MISC MISC
wordpress — wordpress	The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 0.9.91 via Google Drive API secrets stored in plaintext in the publicly visible plugin source. This could allow unauthenticated attackers to impersonate the WPVivid Google Drive account via the API if they can trick a user into reauthenticating via another vulnerability or social engineering.	2023-10-20	9.3	CVE-2023-5576 MISC MISC MISC
zscaler — client_connector	An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation. This issue affects Client Connector: before 1.4.0.105	2023-10-23	9.8	CVE-2023-28805 MISC
zscaler — client_connector	The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to execute code with SYSTEM privileges.	2023-10-23	7.8	CVE-2021-26735 MISC
zscaler — client_connector	Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged path. A local adversary may be able to execute code with SYSTEM privileges.	2023-10-23	7.8	CVE-2021-26736 MISC
zscaler — client_connector	Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code with root privileges.	2023-10-23	7.8	CVE-2021-26738 MISC
zscaler — client_connector	Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.	2023-10-23	7.8	CVE-2023-28793 MISC
zscaler — client_connector	Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.	2023-10-23	7.8	CVE-2023-28795 MISC
zscaler — client_connector	Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.	2023-10-23	7.8	CVE-2023-28796 MISC
zscaler — client_connector	Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. A malicious user can replace the folder and execute code as a privileged user.	2023-10-23	7.3	CVE-2023-28797 MISC
zzzcms — zzzcms	File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via modification of the imageext parameter from jpg, jpeg,gif, and png to jpg, jpeg,gif, png, pphphp.	2023-10-25	9.8	CVE-2023-45554 MISC
zzzcms — zzzcms	File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via a crafted file to the down_url function in zzz.php file.	2023-10-25	7.8	CVE-2023-45555 MISC

Medium Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
apache — airflow	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for configuration even when the expose_config option is set to non-sensitive-only. The expose_config option is False by default. It is recommended to upgrade to a version that is not affected if you set expose_config to non-sensitive-only configuration. This is a different error than CVE-2023-45348 which allows authenticated user to retrieve individual configuration values in 2.7.* by specially crafting their request (solved in 2.7.2). Users are recommended to upgrade to version 2.7.2, which fixes the issue and additionally fixes CVE-2023-45348.	2023-10-23	4.3	CVE-2023-46288 MISC MISC
apache — santuario_xml_security_for_java	All versions of Apache Santuario – XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.	2023-10-20	6.5	CVE-2023-44483 MISC MISC
cmsmadesimple — cmsmadesimple	Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in the news menu component.	2023-10-20	5.4	CVE-2023-43353 MISC
cmsmadesimple — cmsmadesimple	Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions -MicroTiny WYSIWYG editor component.	2023-10-20	5.4	CVE-2023-43354 MISC
cmsmadesimple — cmsmadesimple	Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again parameters in the My Preferences – Add user component.	2023-10-20	5.4	CVE-2023-43355 MISC MISC
cmsmadesimple — cmsmadesimple	Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata parameter in the Global Settings Menu component.	2023-10-20	5.4	CVE-2023-43356 MISC
cmsmadesimple — cmsmadesimple	Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the Manage Shortcuts component.	2023-10-20	5.4	CVE-2023-43357 MISC
codeastro — internet_banking_system	A vulnerability was found in CodeAstro Internet Banking System 1.0. It has been classified as problematic. Affected is an unknown function of the file pages_system_settings.php. The manipulation of the argument sys_name with the input leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243132.	2023-10-22	6.1	CVE-2023-5694 MISC MISC MISC
codeastro — internet_banking_system	A vulnerability was found in CodeAstro Internet Banking System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file pages_reset_pwd.php. The manipulation of the argument email with the input testing%40example.com’%26%25 leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243133 was assigned to this vulnerability.	2023-10-22	6.1	CVE-2023-5695 MISC MISC MISC
codeastro — internet_banking_system	A vulnerability was found in CodeAstro Internet Banking System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file pages_transfer_money.php. The manipulation of the argument account_number with the input 357146928–>

alerts

CISA Updates Guidance for Addressing Cisco IOS XE Web UI Vulnerabilities With Additional Releases

Post author By admin
Post date October 27, 2023

Today, CISA updated its guidance addressing two vulnerabilities, CVE-2023-20198 and CVE-2023-20273, affecting Cisco’s Internetworking Operating System (IOS) XE Software Web User Interface (UI).

The guidance now notes that Cisco has fixed these vulnerabilities for the 17.6 Cisco IOS XE software release train with the 17.6.6a update. According to Cisco’s Security Advisory: Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature, fixes are still to be determined for the following Cisco IOS XE software release trains: 17.3, 16.12 (Catalyst 3650 and 3850 only). Cisco previously published the fixed release for 17.9, which is 17.9.4a, on Oct. 22. CISA urges organizations with the 17.9 and 17.6 Cisco IOS XE software release train to immediately update to the 17.9.4a and 17.6.6a releases, respectively.

CISA urges organizations to review:

CISA has added CVE-2023-20198 (on Oct. 16, 2023) and CVE-2023-20273 (on Oct. 23, 2023) to its Known Exploited Vulnerabilities Catalog, which, per Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the specified due date to protect FCEB networks against active threats.

alerts

CISA Announces Launch of Logging Made Easy

Post author By admin
Post date October 27, 2023

Today, CISA announces the launch of a new version of Logging Made Easy (LME), a straightforward log management solution for Windows-based devices that can be downloaded and self-installed for free. CISA’s version reimagines technology developed by the United Kingdom’s National Cyber Security Centre (NCSC), making it available to a wider audience.

Log management makes systems more secure. Until now, it has been a heavy lift for many targeted organizations, especially those with limited resources. CISA’s LME is a turnkey solution for public and private organizations seeking to strengthen their cybersecurity while reducing their log management burden.

As CISA’s newest shared services product offering, LME builds upon the success of the NCSC’s log management solution, which was decommissioned in March 2023. CISA urges organizations to secure their Windows-based devices today by downloading the free LME technical solution.

alerts

NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations

Post author By admin
Post date October 25, 2023

A plea for network defenders and software manufacturers to fix common problems.

EXECUTIVE SUMMARY

The National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint cybersecurity advisory (CSA) to highlight the most common cybersecurity misconfigurations in large organizations, and detail the tactics, techniques, and procedures (TTPs) actors use to exploit these misconfigurations.

Through NSA and CISA Red and Blue team assessments, as well as through the activities of NSA and CISA Hunt and Incident Response teams, the agencies identified the following 10 most common network misconfigurations:

Default configurations of software and applications
Improper separation of user/administrator privilege
Insufficient internal network monitoring
Lack of network segmentation
Poor patch management
Bypass of system access controls
Weak or misconfigured multifactor authentication (MFA) methods
Insufficient access control lists (ACLs) on network shares and services
Poor credential hygiene
Unrestricted code execution

These misconfigurations illustrate (1) a trend of systemic weaknesses in many large organizations, including those with mature cyber postures, and (2) the importance of software manufacturers embracing secure-by-design principles to reduce the burden on network defenders:

Properly trained, staffed, and funded network security teams can implement the known mitigations for these weaknesses.
Software manufacturers must reduce the prevalence of these misconfigurations—thus strengthening the security posture for customers—by incorporating secure-by-design and -default principles and tactics into their software development practices.[1]

NSA and CISA encourage network defenders to implement the recommendations found within the Mitigations section of this advisory—including the following—to reduce the risk of malicious actors exploiting the identified misconfigurations.

Remove default credentials and harden configurations.
Disable unused services and implement access controls.
Update regularly and automate patching, prioritizing patching of known exploited vulnerabilities.[2]
Reduce, restrict, audit, and monitor administrative accounts and privileges.

NSA and CISA urge software manufacturers to take ownership of improving security outcomes of their customers by embracing secure-by-design and-default tactics, including:

Embedding security controls into product architecture from the start of development and throughout the entire software development lifecycle (SDLC).
Eliminating default passwords.
Providing high-quality audit logs to customers at no extra charge.
Mandating MFA, ideally phishing-resistant, for privileged users and making MFA a default rather than opt-in feature.[3]

Download the PDF version of this report: PDF, 660 KB

TECHNICAL DETAILS

Note: This advisory uses the MITRE ATT&CK^® for Enterprise framework, version 13, and the MITRE D3FEND™ cybersecurity countermeasures framework.[4],[5] See the Appendix: MITRE ATT&CK tactics and techniques section for tables summarizing the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques, and the Mitigations section for MITRE D3FEND countermeasures.

For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.[6],[7]

Overview

Over the years, the following NSA and CISA teams have assessed the security posture of many network enclaves across the Department of Defense (DoD); Federal Civilian Executive Branch (FCEB); state, local, tribal, and territorial (SLTT) governments; and the private sector:

Depending on the needs of the assessment, NSA Defensive Network Operations (DNO) teams feature capabilities from Red Team (adversary emulation), Blue Team (strategic vulnerability assessment), Hunt (targeted hunt), and/or Tailored Mitigations (defensive countermeasure development).
CISA Vulnerability Management (VM) teams have assessed the security posture of over 1,000 network enclaves. CISA VM teams include Risk and Vulnerability Assessment (RVA) and CISA Red Team Assessments (RTA).[8] The RVA team conducts remote and onsite assessment services, including penetration testing and configuration review. RTA emulates cyber threat actors in coordination with an organization to assess the organization’s cyber detection and response capabilities.
CISA Hunt and Incident Response teams conduct proactive and reactive engagements, respectively, on organization networks to identify and detect cyber threats to U.S. infrastructure.

During these assessments, NSA and CISA identified the 10 most common network misconfigurations, which are detailed below. These misconfigurations (non-prioritized) are systemic weaknesses across many networks.

Many of the assessments were of Microsoft^® Windows^® and Active Directory^® environments. This advisory provides details about, and mitigations for, specific issues found during these assessments, and so mostly focuses on these products. However, it should be noted that many other environments contain similar misconfigurations. Network owners and operators should examine their networks for similar misconfigurations even when running other software not specifically mentioned below.

1. Default Configurations of Software and Applications

Default configurations of systems, services, and applications can permit unauthorized access or other malicious activity. Common default configurations include:

Default credentials
Default service permissions and configurations settings

Default Credentials

Many software manufacturers release commercial off-the-shelf (COTS) network devices —which provide user access via applications or web portals—containing predefined default credentials for their built-in administrative accounts.[9] Malicious actors and assessment teams regularly abuse default credentials by:

Finding credentials with a simple web search [T1589.001] and using them [T1078.001] to gain authenticated access to a device.
Resetting built-in administrative accounts [T1098] via predictable forgotten passwords questions.
Leveraging default virtual private network (VPN) credentials for internal network access [T1133].
Leveraging publicly available setup information to identify built-in administrative credentials for web applications and gaining access to the application and its underlying database.
Leveraging default credentials on software deployment tools [T1072] for code execution and lateral movement.

In addition to devices that provide network access, printers, scanners, security cameras, conference room audiovisual (AV) equipment, voice over internet protocol (VoIP) phones, and internet of things (IoT) devices commonly contain default credentials that can be used for easy unauthorized access to these devices as well. Further compounding this problem, printers and scanners may have privileged domain accounts loaded so that users can easily scan documents and upload them to a shared drive or email them. Malicious actors who gain access to a printer or scanner using default credentials can use the loaded privileged domain accounts to move laterally from the device and compromise the domain [T1078.002].

Default Service Permissions and Configuration Settings

Certain services may have overly permissive access controls or vulnerable configurations by default. Additionally, even if the providers do not enable these services by default, malicious actors can easily abuse these services if users or administrators enable them.

Assessment teams regularly find the following:

Insecure Active Directory Certificate Services
Insecure legacy protocols/services
Insecure Server Message Block (SMB) service

Insecure Active Directory Certificate Services

Active Directory Certificate Services (ADCS) is a feature used to manage Public Key Infrastructure (PKI) certificates, keys, and encryption inside of Active Directory (AD) environments. ADCS templates are used to build certificates for different types of servers and other entities on an organization’s network.

Malicious actors can exploit ADCS and/or ADCS template misconfigurations to manipulate the certificate infrastructure into issuing fraudulent certificates and/or escalate user privileges to domain administrator privileges. These certificates and domain escalation paths may grant actors unauthorized, persistent access to systems and critical data, the ability to impersonate legitimate entities, and the ability to bypass security measures.

Assessment teams have observed organizations with the following misconfigurations:

ADCS servers running with web-enrollment enabled. If web-enrollment is enabled, unauthenticated actors can coerce a server to authenticate to an actor-controlled computer, which can relay the authentication to the ADCS web-enrollment service and obtain a certificate [T1649] for the server’s account. These fraudulent, trusted certificates enable actors to use adversary-in-the-middle techniques [T1557] to masquerade as trusted entities on the network. The actors can also use the certificate for AD authentication to obtain a Kerberos Ticket Granting Ticket (TGT) [T1558.001], which they can use to compromise the server and usually the entire domain.
ADCS templates where low-privileged users have enrollment rights, and the enrollee supplies a subject alternative name. Misconfiguring various elements of ADCS templates can result in domain escalation by unauthorized users (e.g., granting low-privileged users certificate enrollment rights, allowing requesters to specify a subjectAltName in the certificate signing request [CSR], not requiring authorized signatures for CSRs, granting FullControl or WriteDacl permissions to users). Malicious actors can use a low-privileged user account to request a certificate with a particular Subject Alternative Name (SAN) and gain a certificate where the SAN matches the User Principal Name (UPN) of a privileged account.

Note: For more information on known escalation paths, including PetitPotam NTLM relay techniques, see: Domain Escalation: PetitPotam NTLM Relay to ADCS Endpoints and Certified Pre-Owned, Active Directory Certificate Services.[10],[11],[12]

Insecure legacy protocols/services

Many vulnerable network services are enabled by default, and assessment teams have observed them enabled in production environments. Specifically, assessment teams have observed Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS), which are Microsoft Windows components that serve as alternate methods of host identification. If these services are enabled in a network, actors can use spoofing, poisoning, and relay techniques [T1557.001] to obtain domain hashes, system access, and potential administrative system sessions. Malicious actors frequently exploit these protocols to compromise entire Windows’ environments.

Malicious actors can spoof an authoritative source for name resolution on a target network by responding to passing traffic, effectively poisoning the service so that target computers will communicate with an actor-controlled system instead of the intended one. If the requested system requires identification/authentication, the target computer will send the user’s username and hash to the actor-controlled system. The actors then collect the hash and crack it offline to obtain the plain text password [T1110.002].

Insecure Server Message Block (SMB) service

The Server Message Block service is a Windows component primarily for file sharing. Its default configuration, including in the latest version of Windows, does not require signing network messages to ensure authenticity and integrity. If SMB servers do not enforce SMB signing, malicious actors can use machine-in-the-middle techniques, such as NTLM relay. Further, malicious actors can combine a lack of SMB signing with the name resolution poisoning issue (see above) to gain access to remote systems [T1021.002] without needing to capture and crack any hashes.

2. Improper Separation of User/Administrator Privilege

Administrators often assign multiple roles to one account. These accounts have access to a wide range of devices and services, allowing malicious actors to move through a network quickly with one compromised account without triggering lateral movement and/or privilege escalation detection measures.

Assessment teams have observed the following common account separation misconfigurations:

Excessive account privileges
Elevated service account permissions
Non-essential use of elevated accounts

Excessive Account Privileges

Account privileges are intended to control user access to host or application resources to limit access to sensitive information or enforce a least-privilege security model. When account privileges are overly permissive, users can see and/or do things they should not be able to, which becomes a security issue as it increases risk exposure and attack surface.

Expanding organizations can undergo numerous changes in account management, personnel, and access requirements. These changes commonly lead to privilege creep—the granting of excessive access and unnecessary account privileges. Through the analysis of topical and nested AD groups, a malicious actor can find a user account [T1078] that has been granted account privileges that exceed their need-to-know or least-privilege function. Extraneous access can lead to easy avenues for unauthorized access to data and resources and escalation of privileges in the targeted domain.

Elevated Service Account Permissions

Applications often operate using user accounts to access resources. These user accounts, which are known as service accounts, often require elevated privileges. When a malicious actor compromises an application or service using a service account, they will have the same privileges and access as the service account.

Malicious actors can exploit elevated service permissions within a domain to gain unauthorized access and control over critical systems. Service accounts are enticing targets for malicious actors because such accounts are often granted elevated permissions within the domain due to the nature of the service, and because access to use the service can be requested by any valid domain user. Due to these factors, kerberoasting—a form of credential access achieved by cracking service account credentials—is a common technique used to gain control over service account targets [T1558.003].

Non-Essential Use of Elevated Accounts

IT personnel use domain administrator and other administrator accounts for system and network management due to their inherent elevated privileges. When an administrator account is logged into a compromised host, a malicious actor can steal and use the account’s credentials and an AD-generated authentication token [T1528] to move, using the elevated permissions, throughout the domain [T1550.001]. Using an elevated account for normal day-to-day, non-administrative tasks increases the account’s exposure and, therefore, its risk of compromise and its risk to the network.

Malicious actors prioritize obtaining valid domain credentials upon gaining access to a network. Authentication using valid domain credentials allows the execution of secondary enumeration techniques to gain visibility into the target domain and AD structure, including discovery of elevated accounts and where the elevated accounts are used [T1087].

Targeting elevated accounts (such as domain administrator or system administrators) performing day-to-day activities provides the most direct path to achieve domain escalation. Systems or applications accessed by the targeted elevated accounts significantly increase the attack surface available to adversaries, providing additional paths and escalation options.

After obtaining initial access via an account with administrative permissions, an assessment team compromised a domain in under a business day. The team first gained initial access to the system through phishing [T1566], by which they enticed the end user to download [T1204] and execute malicious payloads. The targeted end-user account had administrative permissions, enabling the team to quickly compromise the entire domain.

3. Insufficient Internal Network Monitoring

Some organizations do not optimally configure host and network sensors for traffic collection and end-host logging. These insufficient configurations could lead to undetected adversarial compromise. Additionally, improper sensor configurations limit the traffic collection capability needed for enhanced baseline development and detract from timely detection of anomalous activity.

Assessment teams have exploited insufficient monitoring to gain access to assessed networks. For example:

An assessment team observed an organization with host-based monitoring, but no network monitoring. Host-based monitoring informs defensive teams about adverse activities on singular hosts and network monitoring informs about adverse activities traversing hosts [TA0008]. In this example, the organization could identify infected hosts but could not identify where the infection was coming from, and thus could not stop future lateral movement and infections.
An assessment team gained persistent deep access to a large organization with a mature cyber posture. The organization did not detect the assessment team’s lateral movement, persistence, and command and control (C2) activity, including when the team attempted noisy activities to trigger a security response. For more information on this activity, see CSA CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks.[13]

4. Lack of Network Segmentation

Network segmentation separates portions of the network with security boundaries. Lack of network segmentation leaves no security boundaries between the user, production, and critical system networks. Insufficient network segmentation allows an actor who has compromised a resource on the network to move laterally across a variety of systems uncontested. Lack of network segregation additionally leaves organizations significantly more vulnerable to potential ransomware attacks and post-exploitation techniques.

Lack of segmentation between IT and operational technology (OT) environments places OT environments at risk. For example, assessment teams have often gained access to OT networks—despite prior assurance that the networks were fully air gapped, with no possible connection to the IT network—by finding special purpose, forgotten, or even accidental network connections [T1199].

5. Poor Patch Management

Vendors release patches and updates to address security vulnerabilities. Poor patch management and network hygiene practices often enable adversaries to discover open attack vectors and exploit critical vulnerabilities. Poor patch management includes:

Lack of regular patching
Use of unsupported operating systems (OSs) and outdated firmware

Lack of Regular Patching

Failure to apply the latest patches can leave a system open to compromise from publicly available exploits. Due to their ease of discovery—via vulnerability scanning [T1595.002] and open source research [T1592]—and exploitation, these systems are immediate targets for adversaries. Allowing critical vulnerabilities to remain on production systems without applying their corresponding patches significantly increases the attack surface. Organizations should prioritize patching known exploited vulnerabilities in their environments.[2]

Assessment teams have observed threat actors exploiting many CVEs in public-facing applications [T1190], including:

CVE-2019-18935 in an unpatched instance of Telerik^® UI for ASP.NET running on a Microsoft IIS server.[14]
CVE-2021-44228 (Log4Shell) in an unpatched VMware^® Horizon server.[15]
CVE-2022-24682, CVE-2022-27924, and CVE-2022-27925 chained with CVE-2022-37042, or CVE-2022-30333 in an unpatched Zimbra^® Collaboration Suite.[16]

Use of Unsupported OSs and Outdated Firmware

Using software or hardware that is no longer supported by the vendor poses a significant security risk because new and existing vulnerabilities are no longer patched. Malicious actors can exploit vulnerabilities in these systems to gain unauthorized access, compromise sensitive data, and disrupt operations [T1210].

Assessment teams frequently observe organizations using unsupported Windows operating systems without updates MS17-010 and MS08-67. These updates, released years ago, address critical remote code execution vulnerabilities.[17],[18]

6. Bypass of System Access Controls

A malicious actor can bypass system access controls by compromising alternate authentication methods in an environment. If a malicious actor can collect hashes in a network, they can use the hashes to authenticate using non-standard means, such as pass-the-hash (PtH) [T1550.002]. By mimicking accounts without the clear-text password, an actor can expand and fortify their access without detection. Kerberoasting is also one of the most time-efficient ways to elevate privileges and move laterally throughout an organization’s network.

7. Weak or Misconfigured MFA Methods

Misconfigured Smart Cards or Tokens

Some networks (generally government or DoD networks) require accounts to use smart cards or tokens. Multifactor requirements can be misconfigured so the password hashes for accounts never change. Even though the password itself is no longer used—because the smart card or token is required instead—there is still a password hash for the account that can be used as an alternative credential for authentication. If the password hash never changes, once a malicious actor has an account’s password hash [T1111], the actor can use it indefinitely, via the PtH technique for as long as that account exists.

Lack of Phishing-Resistant MFA

Some forms of MFA are vulnerable to phishing, “push bombing” [T1621], exploitation of Signaling System 7 (SS7) protocol vulnerabilities, and/or “SIM swap” techniques. These attempts, if successful, may allow a threat actor to gain access to MFA authentication credentials or bypass MFA and access the MFA-protected systems. (See CISA’s Fact Sheet Implementing Phishing-Resistant MFA for more information.)[3]

For example, assessment teams have used voice phishing to convince users to provide missing MFA information [T1598]. In one instance, an assessment team knew a user’s main credentials, but their login attempts were blocked by MFA requirements. The team then masqueraded as IT staff and convinced the user to provide the MFA code over the phone, allowing the team to complete their login attempt and gain access to the user’s email and other organizational resources.

8. Insufficient ACLs on Network Shares and Services

Data shares and repositories are primary targets for malicious actors. Network administrators may improperly configure ACLs to allow for unauthorized users to access sensitive or administrative data on shared drives.

Actors can use commands, open source tools, or custom malware to look for shared folders and drives [T1135].

In one compromise, a team observed actors use the net share command—which displays information about shared resources on the local computer—and the ntfsinfo command to search network shares on compromised computers. In the same compromise, the actors used a custom tool, CovalentStealer, which is designed to identify file shares on a system, categorize the files [T1083], and upload the files to a remote server [TA0010].[19],[20]
Ransomware actors have used the SoftPerfect^® Network Scanner, netscan.exe—which can ping computers [T1018], scan ports [T1046], and discover shared folders—and SharpShares to enumerate accessible network shares in a domain.[21],[22]

Malicious actors can then collect and exfiltrate the data from the shared drives and folders. They can then use the data for a variety of purposes, such as extortion of the organization or as intelligence when formulating intrusion plans for further network compromise. Assessment teams routinely find sensitive information on network shares [T1039] that could facilitate follow-on activity or provide opportunities for extortion. Teams regularly find drives containing cleartext credentials [T1552] for service accounts, web applications, and even domain administrators.

Even when further access is not directly obtained from credentials in file shares, there can be a treasure trove of information for improving situational awareness of the target network, including the network’s topology, service tickets, or vulnerability scan data. In addition, teams regularly identify sensitive data and PII on shared drives (e.g., scanned documents, social security numbers, and tax returns) that could be used for extortion or social engineering of the organization or individuals.

9. Poor Credential Hygiene

Poor credential hygiene facilitates threat actors in obtaining credentials for initial access, persistence, lateral movement, and other follow-on activity, especially if phishing-resistant MFA is not enabled. Poor credential hygiene includes:

Easily crackable passwords
Cleartext password disclosure

Easily Crackable Passwords

Easily crackable passwords are passwords that a malicious actor can guess within a short time using relatively inexpensive computing resources. The presence of easily crackable passwords on a network generally stems from a lack of password length (i.e., shorter than 15 characters) and randomness (i.e., is not unique or can be guessed). This is often due to lax requirements for passwords in organizational policies and user training. A policy that only requires short and simple passwords leaves user passwords susceptible to password cracking. Organizations should provide or allow employee use of password managers to enable the generation and easy use of secure, random passwords for each account.

Often, when a credential is obtained, it is a hash (one-way encryption) of the password and not the password itself. Although some hashes can be used directly with PtH techniques, many hashes need to be cracked to obtain usable credentials. The cracking process takes the captured hash of the user’s plaintext password and leverages dictionary wordlists and rulesets, often using a database of billions of previously compromised passwords, in an attempt to find the matching plaintext password [T1110.002].

One of the primary ways to crack passwords is with the open source tool, Hashcat, combined with password lists obtained from publicly released password breaches. Once a malicious actor has access to a plaintext password, they are usually limited only by the account’s permissions. In some cases, the actor may be restricted or detected by advanced defense-in-depth and zero trust implementations as well, but this has been a rare finding in assessments thus far.

Assessment teams have cracked password hashes for NTLM users, Kerberos service account tickets, NetNTLMv2, and PFX stores [T1555], enabling the team to elevate privileges and move laterally within networks. In 12 hours, one team cracked over 80% of all users’ passwords in an Active Directory, resulting in hundreds of valid credentials.

Cleartext Password Disclosure

Storing passwords in cleartext is a serious security risk. A malicious actor with access to files containing cleartext passwords [T1552.001] could use these credentials to log into the affected applications or systems under the guise of a legitimate user. Accountability is lost in this situation as any system logs would record valid user accounts accessing applications or systems.

Malicious actors search for text files, spreadsheets, documents, and configuration files in hopes of obtaining cleartext passwords. Assessment teams frequently discover cleartext passwords, allowing them to quickly escalate the emulated intrusion from the compromise of a regular domain user account to that of a privileged account, such as a Domain or Enterprise Administrator. A common tool used for locating cleartext passwords is the open source tool, Snaffler.[23]

10. Unrestricted Code Execution

If unverified programs are allowed to execute on hosts, a threat actor can run arbitrary, malicious payloads within a network.

Malicious actors often execute code after gaining initial access to a system. For example, after a user falls for a phishing scam, the actor usually convinces the victim to run code on their workstation to gain remote access to the internal network. This code is usually an unverified program that has no legitimate purpose or business reason for running on the network.

Assessment teams and malicious actors frequently leverage unrestricted code execution in the form of executables, dynamic link libraries (DLLs), HTML applications, and macros (scripts used in office automation documents) [T1059.005] to establish initial access, persistence, and lateral movement. In addition, actors often use scripting languages [T1059] to obscure their actions [T1027.010] and bypass allowlisting—where organizations restrict applications and other forms of code by default and only allow those that are known and trusted. Further, actors may load vulnerable drivers and then exploit the drivers’ known vulnerabilities to execute code in the kernel with the highest level of system privileges to completely compromise the device [T1068].

MITIGATIONS

Network Defenders

NSA and CISA recommend network defenders implement the recommendations that follow to mitigate the issues identified in this advisory. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST) as well as with the MITRE ATT&CK Enterprise Mitigations and MITRE D3FEND frameworks.

The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s Cross-Sector Cybersecurity Performance Goals for more information on the CPGs, including additional recommended baseline protections.[24]

Mitigate Default Configurations of Software and Applications

*Table 1: Recommendations for Network Defenders to Mitigate Default Configurations of Software and Applications*
Misconfiguration	Recommendations for Network Defenders
Default configurations of software and applications	Modify the default configuration of applications and appliances before deployment in a production environment [M1013],[D3-ACH]. Refer to hardening guidelines provided by the vendor and related cybersecurity guidance (e.g., DISA’s Security Technical Implementation Guides (STIGs) and configuration guides).[25],[26],[27]
Default configurations of software and applications: Default Credentials	Change or disable vendor-supplied default usernames and passwords of services, software, and equipment when installing or commissioning [CPG 2.A]. When resetting passwords, enforce the use of “strong” passwords (i.e., passwords that are more than 15 characters and random [CPG 2.B]) and follow hardening guidelines provided by the vendor, STIGs, NSA, and/or NIST [M1027],[D3-SPP].[25],[26],[28],[29]
Default service permissions and configuration settings: Insecure Active Directory Certificate Services	Ensure the secure configuration of ADCS implementations. Regularly update and patch the controlling infrastructure (e.g., for CVE-2021-36942), employ monitoring and auditing mechanisms, and implement strong access controls to protect the infrastructure. If not needed, disable web-enrollment in ADCS servers. See Microsoft: Uninstall-AdcsWebEnrollment (ADCSDeployment) for guidance.[30] If web enrollment is needed on ADCS servers: Enable Extended Protection for Authentication (EPA) for Client Authority Web Enrollment. This is done by choosing the “Required” option. For guidance, see Microsoft: KB5021989: Extended Protection for Authentication.[31] Enable “Require SSL” on the ADCS server. Disable NTLM on all ADCS servers. For guidance, see Microsoft: Network security Restrict NTLM in this domain – Windows Security \| Microsoft Learn and Network security Restrict NTLM Incoming NTLM traffic – Windows Security.[32],[33] Disable SAN for UPN Mapping. For guidance see, Microsoft: How to disable the SAN for UPN mapping – Windows Server. Instead, smart card authentication can use the `altSecurityIdentities` attribute for explicit mapping of certificates to accounts more securely.[34] Review all permissions on the ADCS templates on applicable servers. Restrict enrollment rights to only those users or groups that require it. Disable the `CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT` flag from templates to prevent users from supplying and editing sensitive security settings within these templates. Enforce manager approval for requested certificates. Remove `FullControl`, `WriteDacl`, and `Write` property permissions from low-privileged groups, such as domain users, to certificate template objects.
Default service permissions and configuration settings: Insecure legacy protocols/services	Determine if LLMNR and NetBIOS are required for essential business operations. If not required, disable LLMNR and NetBIOS in local computer security settings or by group policy.
Default service permissions and configuration settings: Insecure SMB service	Require SMB signing for both SMB client and server on all systems.[25] This should prevent certain adversary-in-the-middle and pass-the-hash techniques. For more information on SMB signing, see Microsoft: Overview of Server Message Block Signing. [35] Note: Beginning in Microsoft Windows 11 Insider Preview Build 25381, Windows requires SMB signing for all communications.[36]

Mitigate Improper Separation of User/Administrator Privilege

*Table 2: Recommendations for Network Defenders to Mitigate Improper Separation of User/Administrator Privilege*
Misconfiguration	Recommendations for Network Defenders
Improper separation of user/administrator privilege: Excessive account privileges, Elevated service account permissions, and Non-essential use of elevated accounts	Implement authentication, authorization, and accounting (AAA) systems [M1018] to limit actions users can perform, and review logs of user actions to detect unauthorized use and abuse. Apply least privilege principles to user accounts and groups allowing only the performance of authorized actions. Audit user accounts and remove those that are inactive or unnecessary on a routine basis [CPG 2.D]. Limit the ability for user accounts to create additional accounts. Restrict use of privileged accounts to perform general tasks, such as accessing emails and browsing the Internet [CPG 2.E],[D3-UAP]. See NSA Cybersecurity Information Sheet (CSI) Defend Privileges and Accounts for more information.[37] Limit the number of users within the organization with an identity and access management (IAM) role that has administrator privileges. Strive to reduce all permanent privileged role assignments, and conduct periodic entitlement reviews on IAM users, roles, and policies. Implement time-based access for privileged accounts. For example, the just-in-time access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the Zero Trust model) by setting network-wide policy to automatically disable admin accounts at the Active Directory level. As needed, individual users can submit requests through an automated process that enables access to a system for a set timeframe. In cloud environments, just-in-time elevation is also appropriate and may be implemented using per-session federated claims or privileged access management tools. Restrict domain users from being in the local administrator group on multiple systems. Run daemonized applications (services) with non-administrator accounts when possible. Only configure service accounts with the permissions necessary for the services they control to operate. Disable unused services and implement ACLs to protect services.

Mitigate Insufficient Internal Network Monitoring

*Table 3: Recommendations for Network Defenders to Mitigate Insufficient Internal Network Monitoring*
Misconfiguration	Recommendations for Network Defenders
Insufficient internal network monitoring	Establish a baseline of applications and services, and routinely audit their access and use, especially for administrative activity [D3-ANAA]. For instance, administrators should routinely audit the access lists and permissions for of all web applications and services [CPG 2.O],[M1047]. Look for suspicious accounts, investigate them, and remove accounts and credentials, as appropriate, such as accounts of former staff.[39] Establish a baseline that represents an organization’s normal traffic activity, network performance, host application activity, and user behavior; investigate any deviations from that baseline [D3-NTCD],[D3-CSPP],[D3-UBA].[40] Use auditing tools capable of detecting privilege and service abuse opportunities on systems within an enterprise and correct them [M1047]. Implement a security information and event management (SIEM) system to provide log aggregation, correlation, querying, visualization, and alerting from network endpoints, logging systems, endpoint and detection response (EDR) systems and intrusion detection systems (IDS) [CPG 2.T],[D3-NTA].

Mitigate Lack of Network Segmentation

*Table 4: Recommendations for Network Defenders to Mitigate Lack of Network Segmentation*
Misconfiguration	Recommendations for Network Defenders
Lack of network segmentation	Implement next-generation firewalls to perform deep packet filtering, stateful inspection, and application-level packet inspection [D3-NTF]. Deny or drop improperly formatted traffic that is incongruent with application-specific traffic permitted on the network. This practice limits an actor’s ability to abuse allowed application protocols. The practice of allowlisting network applications does not rely on generic ports as filtering criteria, enhancing filtering fidelity. For more information on application-aware defenses, see NSA CSI Segment Networks and Deploy Application-Aware Defenses.[41] Engineer network segments to isolate critical systems, functions, and resources [CPG 2.F],[D3-NI]. Establish physical and logical segmentation controls, such as virtual local area network (VLAN) configurations and properly configured access control lists (ACLs) on infrastructure devices [M1030]. These devices should be baselined and audited to prevent access to potentially sensitive systems and information. Leverage properly configured Demilitarized Zones (DMZs) to reduce service exposure to the Internet.[42],[43],[44] Implement separate Virtual Private Cloud (VPC) instances to isolate essential cloud systems. Where possible, implement Virtual Machines (VM) and Network Function Virtualization (NFV) to enable micro-segmentation of networks in virtualized environments and cloud data centers. Employ secure VM firewall configurations in tandem with macro segmentation.

Mitigate Poor Patch Management

*Table 5: Recommendations for Network Defenders to Mitigate Poor Patch Management*
Misconfiguration	Recommendations for Network Defenders
Poor patch management: Lack of regular patching	Ensure organizations implement and maintain an efficient patch management process that enforces the use of up-to-date, stable versions of OSs, browsers, and software [M1051],[D3-SU].[45] Update software regularly by employing patch management for externally exposed applications, internal enterprise endpoints, and servers. Prioritize patching known exploited vulnerabilities.[2] Automate the update process as much as possible and use vendor-provided updates. Consider using automated patch management tools and software update tools. Where patching is not possible due to limitations, segment networks to limit exposure of the vulnerable system or host.
Poor patch management: Use of unsupported OSs and outdated firmware	Evaluate the use of unsupported hardware and software and discontinue use as soon as possible. If discontinuing is not possible, implement additional network protections to mitigate the risk.[45] Patch the Basic Input/Output System (BIOS) and other firmware to prevent exploitation of known vulnerabilities.

Mitigate Bypass of System Access Controls

*Table 6: Recommendations for Network Defenders to Mitigate Bypass of System Access Controls*
Misconfiguration	Recommendations for Network Defenders
Bypass of system access controls	Limit credential overlap across systems to prevent credential compromise and reduce a malicious actor’s ability to move laterally between systems [M1026],[D3-CH]. Implement a method for monitoring non-standard logon events through host log monitoring [CPG 2.G]. Implement an effective and routine patch management process. Mitigate PtH techniques by applying patch KB2871997 to Windows 7 and newer versions to limit default access of accounts in the local administrator group [M1051],[D3-SU].[46] Enable the PtH mitigations to apply User Account Control (UAC) restrictions to local accounts upon network logon [M1052],[D3-UAP]. Deny domain users the ability to be in the local administrator group on multiple systems [M1018],[D3-UAP]. Limit workstation-to-workstation communications. All workstation communications should occur through a server to prevent lateral movement [M1018],[D3-UAP]. Use privileged accounts only on systems requiring those privileges [M1018],[D3-UAP]. Consider using dedicated Privileged Access Workstations for privileged accounts to better isolate and protect them.[37]

Mitigate Weak or Misconfigured MFA Methods

*Table 7: Recommendations for Network Defenders to Mitigate Weak or Misconfigured MFA Methods*
Misconfiguration	Recommendations for Network Defenders
Weak or misconfigured MFA methods: Misconfigured smart cards or tokens	In Windows environments: Disable the use of New Technology LAN Manager (NTLM) and other legacy authentication protocols that are susceptible to PtH due to their use of password hashes [M1032],[D3-MFA]. For guidance, see Microsoft: Network security Restrict NTLM in this domain – Windows Security \| Microsoft Learn and Network security Restrict NTLM Incoming NTLM traffic – Windows Security.[32],[33] Use built-in functionality via Windows Hello for Business or Group Policy Objects (GPOs) to regularly re-randomize password hashes associated with smartcard-required accounts. Ensure that the hashes are changed at least as often as organizational policy requires passwords to be changed [M1027],[D3-CRO]. Prioritize upgrading any environments that cannot utilize this built-in functionality. As a longer-term effort, implement cloud-primary authentication solution using modern open standards. See CISA’s Secure Cloud Business Applications (SCuBA) Hybrid Identity Solutions Architecture for more information.[47] Note: this document is part of CISA’s Secure Cloud Business Applications (SCuBA) project, which provides guidance for FCEB agencies to secure their cloud business application environments and to protect federal information that is created, accessed, shared, and stored in those environments. Although tailored to FCEB agencies, the project’s guidance is applicable to all organizations.[48]
Weak or misconfigured MFA methods: Lack of phishing-resistant MFA	Enforce phishing-resistant MFA universally for access to sensitive data and on as many other resources and services as possible [CPG 2.H].[3],[49]

Mitigate Insufficient ACLs on Network Shares and Services

*Table 8: Recommendations for Network Defenders to Mitigate Insufficient ACLs on Network Shares and Services*
Misconfiguration	Recommendations for Network Defenders
Insufficient ACLs on network shares and services	Implement secure configurations for all storage devices and network shares that grant access to authorized users only. Apply the principal of least privilege to important information resources to reduce risk of unauthorized data access and manipulation. Apply restrictive permissions to files and directories, and prevent adversaries from modifying ACLs [M1022],[D3-LFP]. Set restrictive permissions on files and folders containing sensitive private keys to prevent unintended access [M1022],[D3-LFP]. Enable the Windows Group Policy security setting, “Do Not Allow Anonymous Enumeration of Security Account Manager (SAM) Accounts and Shares,” to limit users who can enumerate network shares.

Mitigate Poor Credential Hygiene

*Table 9: Recommendations for Network Defenders to Mitigate Poor Credential Hygiene*
Misconfiguration	Recommendations for Network Defenders
Poor credential hygiene: easily crackable passwords	Follow National Institute of Standards and Technologies (NIST) guidelines when creating password policies to enforce use of “strong” passwords that cannot be cracked [M1027],[D3-SPP].[29] Consider using password managers to generate and store passwords. Do not reuse local administrator account passwords across systems. Ensure that passwords are “strong” and unique [CPG 2.B],[M1027],[D3-SPP]. Use “strong” passphrases for private keys to make cracking resource intensive. Do not store credentials within the registry in Windows systems. Establish an organizational policy that prohibits password storage in files. Ensure adequate password length (ideally 25+ characters) and complexity requirements for Windows service accounts and implement passwords with periodic expiration on these accounts [CPG 2.B],[M1027],[D3-SPP]. Use Managed Service Accounts, when possible, to manage service account passwords automatically.
Poor credential hygiene: cleartext password disclosure	Implement a review process for files and systems to look for cleartext account credentials. When credentials are found, remove, change, or encrypt them [D3-FE]. Conduct periodic scans of server machines using automated tools to determine whether sensitive data (e.g., personally identifiable information, protected health information) or credentials are stored. Weigh the risk of storing credentials in password stores and web browsers. If system, software, or web browser credential disclosure is of significant concern, technical controls, policy, and user training may prevent storage of credentials in improper locations. Store hashed passwords using Committee on National Security Systems Policy (CNSSP)-15 and Commercial National Security Algorithm Suite (CNSA) approved algorithms.[50],[51] Consider using group Managed Service Accounts (gMSAs) or third-party software to implement secure password-storage applications.

Mitigate Unrestricted Code Execution

*Table 10: Recommendations for Network Defenders to Mitigate Unrestricted Code Execution*
Misconfiguration	Recommendations for Network Defenders
Unrestricted code execution	Enable system settings that prevent the ability to run applications downloaded from untrusted sources.[52] Use application control tools that restrict program execution by default, also known as allowlisting [D3-EAL]. Ensure that the tools examine digital signatures and other key attributes, rather than just relying on filenames, especially since malware often attempts to masquerade as common Operating System (OS) utilities [M1038]. Explicitly allow certain .exe files to run, while blocking all others by default. Block or prevent the execution of known vulnerable drivers that adversaries may exploit to execute code in kernel mode. Validate driver block rules in audit mode to ensure stability prior to production deployment [D3-OSM]. Constrain scripting languages to prevent malicious activities, audit script logs, and restrict scripting languages that are not used in the environment [D3-SEA]. See joint Cybersecurity Information Sheet: Keeping PowerShell: Security Measures to Use and Embrace.[53] Use read-only containers and minimal images, when possible, to prevent the running of commands. Regularly analyze border and host-level protections, including spam-filtering capabilities, to ensure their continued effectiveness in blocking the delivery and execution of malware [D3-MA]. Assess whether HTML Application (HTA) files are used for business purposes in your environment; if HTAs are not used, remap the default program for opening them from mshta.exe to notepad.exe.

Software Manufacturers

NSA and CISA recommend software manufacturers implement the recommendations in Table 11 to reduce the prevalence of misconfigurations identified in this advisory. These mitigations align with tactics provided in joint guide Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Security-by-Design and -Default. NSA and CISA strongly encourage software manufacturers apply these recommendations to ensure their products are secure “out of the box” and do not require customers to spend additional resources making configuration changes, performing monitoring, and conducting routine updates to keep their systems secure.[1]

*Table 11: Recommendations for Software Manufacturers to Mitigate Identified Misconfigurations*
Misconfiguration	Recommendations for Software Manufacturers
Default configurations of software and applications	Embed security controls into product architecture from the start of development and throughout the entire SDLC by following best practices in NIST’s Secure Software Development Framework (SSDF), SP 800-218.[54] Provide software with security features enabled “out of the box” and accompanied with “loosening” guides instead of hardening guides. “Loosening” guides should explain the business risk of decisions in plain, understandable language.
Default configurations of software and applications: Default credentials	Eliminate default passwords: Do not provide software with default passwords that are universally shared. To eliminate default passwords, require administrators to set a “strong” password [CPG 2.B] during installation and configuration.
Default configurations of software and applications: Default service permissions and configuration settings	Consider the user experience consequences of security settings: Each new setting increases the cognitive burden on end users and should be assessed in conjunction with the business benefit it derives. Ideally, a setting should not exist; instead, the most secure setting should be integrated into the product by default. When configuration is necessary, the default option should be broadly secure against common threats.
Improper separation of user/administrator privilege: Excessive account privileges, Elevated service account permissions, and Non-essential use of elevated accounts	Design products so that the compromise of a single security control does not result in compromise of the entire system. For example, ensuring that user privileges are narrowly provisioned by default and ACLs are employed can reduce the impact of a compromised account. Also, software sandboxing techniques can quarantine a vulnerability to limit compromise of an entire application. Automatically generate reports for: Administrators of inactive accounts. Prompt administrators to set a maximum inactive time and automatically suspend accounts that exceed that threshold. Administrators of accounts with administrator privileges and suggest ways to reduce privilege sprawl. Automatically alert administrators of infrequently used services and provide recommendations for disabling them or implementing ACLs.
Insufficient internal network monitoring	Provide high-quality audit logs to customers at no extra charge. Audit logs are crucial for detecting and escalating potential security incidents. They are also crucial during an investigation of a suspected or confirmed security incident. Consider best practices such as providing easy integration with a security information and event management (SIEM) system with application programming interface (API) access that uses coordinated universal time (UTC), standard time zone formatting, and robust documentation techniques.
Lack of network segmentation	Ensure products are compatible with and tested in segmented network environments.
Poor patch management: Lack of regular patching	Take steps to eliminate entire classes of vulnerabilities by embedding security controls into product architecture from the start of development and throughout the SDLC by following best practices in NIST’s SSDF, SP 800-218.[54] Pay special attention to: Following secure coding practices [SSDF PW 5.1]. Use memory-safe programming languages where possible, parametrized queries, and web template languages. Conducting code reviews [SSDF PW 7.2, RV 1.2] against peer coding standards, checking for backdoors, malicious content, and logic flaws. Testing code to identify vulnerabilities and verify compliance with security requirements [SSDF PW 8.2]. Ensure that published CVEs include root cause or common weakness enumeration (CWE) to enable industry-wide analysis of software security design flaws.
Poor patch management: Use of unsupported operating OSs and outdated firmware	Communicate the business risk of using unsupported OSs and firmware in plain, understandable language.
Bypass of system access controls	Provide sufficient detail in audit records to detect bypass of system controls and queries to monitor audit logs for traces of such suspicious activity (e.g., for when an essential step of an authentication or authorization flow is missing).
Weak or Misconfigured MFA Methods: Misconfigured Smart Cards or Tokens	Fully support MFA for all users, making MFA the default rather than an opt-in feature. Utilize threat modeling for authentication assertions and alternate credentials to examine how they could be abused to bypass MFA requirements.
Weak or Misconfigured MFA Methods: Lack of phishing-resistant MFA	Mandate MFA, ideally phishing-resistant, for privileged users and make MFA a default rather than an opt-in feature.[3]
Insufficient ACL on network shares and services	Enforce use of ACLs with default ACLs only allowing the minimum access needed, along with easy-to-use tools to regularly audit and adjust ACLs to the minimum access needed.
Poor credential hygiene: easily crackable passwords	Allow administrators to configure a password policy consistent with NIST’s guidelines—do not require counterproductive restrictions such as enforcing character types or the periodic rotation of passwords.[29] Allow users to use password managers to effortlessly generate and use secure, random passwords within products.
Poor credential hygiene: cleartext password disclosure	Salt and hash passwords using a secure hashing algorithm with high computational cost to make brute force cracking more difficult.
Unrestricted code execution	Support execution controls within operating systems and applications “out of the box” by default at no extra charge for all customers, to limit malicious actors’ ability to abuse functionality or launch unusual applications without administrator or informed user approval.

VALIDATE SECURITY CONTROLS

In addition to applying mitigations, NSA and CISA recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. NSA and CISA recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.

To get started:

Select an ATT&CK technique described in this advisory (see Table 12–Table 21).
Align your security technologies against the technique.
Test your technologies against the technique.
Analyze your detection and prevention technologies’ performance.
Repeat the process for all security technologies to obtain a set of comprehensive performance data.
Tune your security program, including people, processes, and technologies, based on the data generated by this process.

CISA and NSA recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

LEARN FROM HISTORY

The misconfigurations described above are all too common in assessments and the techniques listed are standard ones leveraged by multiple malicious actors, resulting in numerous real network compromises. Learn from the weaknesses of others and implement the mitigations above properly to protect the network, its sensitive information, and critical missions.

WORKS CITED

Disclaimer of Endorsement

The information and opinions contained in this document are provided “as is” and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

Trademarks

Active Directory, Microsoft, and Windows are registered trademarks of Microsoft Corporation.
MITRE ATT&CK is registered trademark and MITRE D3FEND is a trademark of The MITRE Corporation.
SoftPerfect is a registered trademark of SoftPerfect Proprietary Limited Company.
Telerik is a registered trademark of Progress Software Corporation.
VMware is a registered trademark of VMWare, Inc.
Zimbra is a registered trademark of Synacor, Inc.

Purpose

This document was developed in furtherance of the authoring cybersecurity organizations’ missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

Contact

Cybersecurity Report Feedback: CybersecurityReports@nsa.gov
General Cybersecurity Inquiries: Cybersecurity_Requests@nsa.gov
Defense Industrial Base Inquiries and Cybersecurity Services: DIB_Defense@cyber.nsa.gov
Media Inquiries / Press Desk: 443-634-0721, MediaRelations@nsa.gov

To report suspicious activity contact CISA’s 24/7 Operations Center at report@cisa.gov or (888) 282-0870. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact.

Appendix: MITRE ATT&CK Tactics and Techniques

See Table 12–Table 21 for all referenced threat actor tactics and techniques in this advisory.

*Table 12: ATT&CK Techniques for Enterprise – Reconnaissance*
Technique Title	ID	Use
Active Scanning: Vulnerability Scanning	T1595.002	Malicious actors scan victims for vulnerabilities that be exploited for initial access.
Gather Victim Host Information	T1592	Malicious actors gather information on victim client configurations and/or vulnerabilities through vulnerabilities scans and searching the web.
Gather Victim Identity Information: Credentials	T1589.001	Malicious actors find default credentials through searching the web.
Phishing for Information	T1598	Malicious actors masquerade as IT staff and convince a target user to provide their MFA code over the phone to gain access to email and other organizational resources.

*Table 13: ATT&CK Techniques for Enterprise – Initial Access*
Technique Title	ID	Use
External Remote Services	T1133	Malicious actors use default credentials for VPN access to internal networks.
Valid Accounts: Default Accounts	T1078.001	Malicious actors gain authenticated access to devices by finding default credentials through searching the web. Malicious actors use default credentials for VPN access to internal networks, and default administrative credentials to gain access to web applications and databases.
Exploit Public-Facing Application	T1190	Malicious actors exploit CVEs in Telerik UI, VM Horizon, Zimbra Collaboration Suite, and other applications for initial access to victim organizations.
Phishing	T1566	Malicious actors gain initial access to systems by phishing to entice end users to download and execute malicious payloads.
Trust Relationship	T1199	Malicious actors gain access to OT networks despite prior assurance that the networks were fully air gapped, with no possible connection to the IT network, by finding special purpose, forgotten, or even accidental network connections.

*Table 14: ATT&CK Techniques for Enterprise – Execution*
Technique Title	ID	Use
Software Deployment Tools	T1072	Malicious actors use default or captured credentials on software deployment tools to execute code and move laterally.
User Execution	T1204	Malicious actors gain initial access to systems by phishing to entice end users to download and execute malicious payloads or to run code on their workstations.
Command and Scripting Interpreter	T1059	Malicious actors use scripting languages to obscure their actions and bypass allowlisting.
Command and Scripting Interpreter: Visual Basic	T1059.005	Malicious actors use macros for initial access, persistence, and lateral movement.

*Table 15: ATT&CK Techniques for Enterprise – Persistence*
Technique Title	ID	Use
Account Manipulation	T1098	Malicious actors reset built-in administrative accounts via predictable, forgotten password questions.

*Table 16: ATT&CK Techniques for Enterprise – Privilege Escalation*
Technique Title	ID	Use
Valid Accounts	T1078	Malicious actors analyze topical and nested Active Directory groups to find privileged accounts to target.
Valid Accounts: Domain Accounts	T1078.002	Malicious actors obtain loaded domain credentials from printers and scanners and use them to move laterally from the network device.
Exploitation for Privilege Escalation	T1068	Malicious actors load vulnerable drivers and then exploit their known vulnerabilities to execute code in the kernel with the highest level of system privileges to completely compromise the device.

*Table 17: ATT&CK Techniques for Enterprise – Defense Evasion*
Technique Title	ID	Use
Obfuscated Files or Information: Command Obfuscation	T1027.010	Malicious actors often use scripting languages to obscure their actions.

*Table 18: ATT&CK Techniques for Enterprise – Credential Access*
Technique Title	ID	Use
Adversary-in-the-Middle	T1557	Malicious actors force a device to communicate through actor-controlled systems, so they can collect information or perform additional actions.
Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay	T1557.001	Malicious actors execute spoofing, poisoning, and relay techniques if Link-Local Multicast Name Resolution (LLMNR), NetBIOS Name Service (NBT-NS), and Server Message Block (SMB) services are enabled in a network.
Brute Force: Password Cracking	T1110.002	Malicious actors capture user hashes and leverage dictionary wordlists and rulesets to extract cleartext passwords.
Credentials from Password Stores	T1555	Malicious actors gain access to and crack credentials from PFX stores, enabling elevation of privileges and lateral movement within networks.
Multi-Factor Authentication Interception	T1111	Malicious actors can obtain password hashes for accounts enabled for MFA with smart codes or tokens and use the hash via PtH techniques.
Multi-Factor Authentication Request Generation	T1621	Malicious actors use “push bombing” against non-phishing resistant MFA to induce “MFA fatigue” in victims, gaining access to MFA authentication credentials or bypassing MFA, and accessing the MFA-protected system.
Steal Application Access Token	T1528	Malicious actors can steal administrator account credentials and the authentication token generated by Active Directory when the account is logged into a compromised host.
Steal or Forge Authentication Certificates	T1649	Unauthenticated malicious actors coerce an ADCS server to authenticate to an actor-controlled server, and then relay that authentication to the web certificate enrollment application to obtain a trusted illegitimate certificate.
Steal or Forge Kerberos Tickets: Golden Ticket	T1558.001	Malicious actors who have obtained authentication certificates can use the certificate for Active Directory authentication to obtain a Kerberos TGT.
Steal or Forge Kerberos Tickets: Kerberoasting	T1558.003	Malicious actors obtain and abuse valid Kerberos TGTs to elevate privileges and laterally move throughout an organization’s network.
Unsecured Credentials: Credentials in Files	T1552.001	Malicious actors find cleartext credentials that organizations or individual users store in spreadsheets, configuration files, and other documents.

*Table 19: ATT&CK Techniques for Enterprise – Discovery*
Technique Title	ID	Use
Account Discovery	T1087	Malicious actors with valid domain credentials enumerate the AD to discover elevated accounts and where they are used.
File and Directory Discovery	T1083	Malicious actors use commands, such as `net share`, open source tools, such as SoftPerfect Network Scanner, or custom malware, such as CovalentStealer to discover and categorize files. Malicious actors search for text files, spreadsheets, documents, and configuration files in hopes of obtaining desired information, such as cleartext passwords.
Network Share Discovery	T1135	Malicious actors use commands, such as net share, open source tools, such as SoftPerfect Network Scanner, or custom malware, such as CovalentStealer, to look for shared folders and drives.

*Table 20: ATT&CK Techniques for Enterprise – Lateral Movement*
Technique Title	ID	Use
Exploitation of Remote Services	T1210	Malicious actors can exploit OS and firmware vulnerabilities to gain unauthorized network access, compromise sensitive data, and disrupt operations.
Remote Services: SMB/Windows Admin Shares	T1021.002	If SMB signing is not enforced, malicious actors can use name resolution poisoning to access remote systems.
Use Alternate Authentication Material: Application Access Token	T1550.001	Malicious actors with stolen administrator account credentials and AD authentication tokens can use them to operate with elevated permissions throughout the domain.
Use Alternate Authentication Material: Pass the Hash	T1550.002	Malicious actors collect hashes in a network and authenticate as a user without having access to the user’s cleartext password.

*Table 21: ATT&CK Techniques for Enterprise – Collection*
Technique Title	ID	Use
Data from Network Shared Drive	T1039	Malicious actors find sensitive information on network shares that could facilitate follow-on activity or provide opportunities for extortion.

alerts

Vulnerability Summary for the Week of October 16, 2023

Post author By admin
Post date October 23, 2023

High Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
1e — platform	Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Application of the relevant hotfix remediates this issue. for v8.1.2 apply hotfix Q23166 for v8.4.1 apply hotfix Q23164 for v9.0.1 apply hotfix Q23169 SaaS implementations on v23.7.1 will automatically have hotfix Q23173 applied. Customers with SaaS versions below this are urged to upgrade urgently – please contact 1E to arrange this	2023-10-13	9.8	CVE-2023-45162 MISC
advantech — webaccess	Advantech WebAccess version 9.1.3 contains an exposure of sensitive information to an unauthorized actor vulnerability that could leak user credentials.	2023-10-17	7.5	CVE-2023-4215 MISC
apache — inlong	Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive params checks will be bypassed, like “autoDeserizalize”,”allowLoadLocalInfile”…. Users are advised to upgrade to Apache InLong’s 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8604	2023-10-16	9.8	CVE-2023-43668 MISC
apache — inlong	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false records, making it harder to audit and trace malicious activities. Users are advised to upgrade to Apache InLong’s 1.8.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8628	2023-10-16	7.5	CVE-2023-43667 MISC
apache — traffic_server	Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 9.2.3, which fixes the issue.	2023-10-17	7.5	CVE-2023-39456 MISC MISC MISC
apache — traffic_server	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue.	2023-10-17	7.5	CVE-2023-41752 MISC MISC MISC
axis — axis_os	GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on the Axis device. The application handling service in AXIS OS was vulnerable to command injection allowing an attacker to run arbitrary code. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.	2023-10-16	7.2	CVE-2023-21413 MISC
axis — axis_os_2022	Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.	2023-10-16	8.1	CVE-2023-21415 MISC
dell — emc_openmanage_server_administrator	Dell OpenManage Server Administrator, versions 11.0.0.0 and prior, contains an Improper Access Control vulnerability. A local low-privileged malicious user could potentially exploit this vulnerability to execute arbitrary code in order to elevate privileges on the system. Exploitation may lead to a complete system compromise.	2023-10-13	7.8	CVE-2023-43079 MISC
devolutions — devolutions_server	Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and earlier allows an attack with permission to manage PAM propagation scripts to retrieve passwords stored in it via a GET request.	2023-10-13	7.5	CVE-2023-5240 MISC
discourse — discourse	Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. It is possible to temporarily work around this problem by reducing the `client_max_body_size nginx directive`. `client_max_body_size` will limit the size of uploads that can be uploaded directly to the server.	2023-10-16	7.5	CVE-2023-44388 MISC MISC
discourse — discourse	Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-16	7.5	CVE-2023-45131 MISC
d-link — dar-7000_firmware	D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php.	2023-10-17	9.8	CVE-2023-44693 MISC
d-link — dar-7000_firmware	D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /log/mailrecvview.php.	2023-10-17	9.8	CVE-2023-44694 MISC
d-link — di-7003g_firmware	Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the fn parameter of the tgfile.htm function.	2023-10-16	9.8	CVE-2023-45572 MISC
d-link — di-7003g_firmware	Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the n parameter of the mrclfile_del.asp function.	2023-10-16	9.8	CVE-2023-45573 MISC
d-link — di-7003g_firmware	Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the fn parameter of the file.data function.	2023-10-16	9.8	CVE-2023-45574 MISC MISC
d-link — di-7003g_firmware	Stack Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the ip parameter of the ip_position.asp function.	2023-10-16	9.8	CVE-2023-45575 MISC
d-link — di-7003g_firmware	Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the remove_ext_proto/remove_ext_port parameter of the upnp_ctrl.asp function.	2023-10-16	9.8	CVE-2023-45576 MISC
d-link — di-7003g_firmware	Stack Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the wanid parameter of the H5/speedlimit.data function.	2023-10-16	9.8	CVE-2023-45577 MISC
d-link — di-7003g_firmware	Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the pap_en/chap_en parameter of the pppoe_base.asp function.	2023-10-16	9.8	CVE-2023-45578 MISC
d-link — di-7003g_firmware	Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the ip/type parameter of the jingx.asp function.	2023-10-16	9.8	CVE-2023-45579 MISC
d-link — di-7003g_firmware	Buffer Overflow vulnerability in D-Link device DI-7003GV2.D1 v.23.08.25D1 and before, DI-7100G+V2.D1 v.23.08.23D1 and before, DI-7100GV2.D1 v.23.08.23D1, DI-7200G+V2.D1 v.23.08.23D1 and before, DI-7200GV2.E1 v.23.08.23E1 and before, DI-7300G+V2.D1 v.23.08.23D1, and DI-7400G+V2.D1 v.23.08.23D1 and before allows a remote attacker to execute arbitrary code via the wild/mx and other parameters of the ddns.asp function	2023-10-16	9.8	CVE-2023-45580 MISC
d-link — dir-820l_firmware	D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_4507CC function.	2023-10-16	9.8	CVE-2023-44808 MISC
d-link — dir-820l_firmware	D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions.	2023-10-16	9.8	CVE-2023-44809 MISC
dreamer_cms — dreamer_cms	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/category/add.	2023-10-17	8.8	CVE-2023-45901 MISC
dreamer_cms — dreamer_cms	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/attachment/delete.	2023-10-17	8.8	CVE-2023-45902 MISC
dreamer_cms — dreamer_cms	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/label/delete.	2023-10-17	8.8	CVE-2023-45903 MISC
dreamer_cms — dreamer_cms	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /variable/update.	2023-10-17	8.8	CVE-2023-45904 MISC
dreamer_cms — dreamer_cms	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/add.	2023-10-17	8.8	CVE-2023-45905 MISC
dreamer_cms — dreamer_cms	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/user/add.	2023-10-17	8.8	CVE-2023-45906 MISC
dreamer_cms — dreamer_cms	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/delete.	2023-10-17	8.8	CVE-2023-45907 MISC
easyuse — mailhunter_ultimate	Unrestricted upload of file with dangerous type vulnerability in create template function in EasyUse MailHunter Ultimate 2023 and earlier allows remote authenticated users to perform arbitrary system commands with ‘NT AuthoritySYSTEM’ privilege via a crafted ZIP archive.	2023-10-17	8.8	CVE-2023-34207 MISC
easyuse — mailhunter_ultimate	SQL Injection in create customer group function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to execute arbitrary SQL commands via the ctl00$ContentPlaceHolder1$txtCustSQL parameter.	2023-10-17	8.8	CVE-2023-34210 MISC
fiber — fiber	Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to inject arbitrary values without any authentication or perform various malicious actions on behalf of an authenticated user, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This issue has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes as defense in depth measures. There are no known workarounds for this vulnerability.	2023-10-16	9.8	CVE-2023-45128 MISC MISC
fortinet — fortiedr	A insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands via api request	2023-10-13	8.1	CVE-2023-33303 MISC
fortinet — fortisandbox	A improper limitation of a pathname to a restricted directory (‘path traversal’) in Fortinet FortiSandbox version 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 2.5.0 through 2.5.2 and 2.4.1 and 2.4.0 allows attacker to denial of service via crafted http requests.	2023-10-13	7.5	CVE-2023-41682 MISC
freshtomato — freshtomato	An OS command injection vulnerability exists in the httpd iperfrun.cgi functionality of FreshTomato 2023.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.	2023-10-16	9.8	CVE-2023-3991 MISC
gnome — tracker_miners	A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.	2023-10-13	7.7	CVE-2023-5557 MISC MISC
gpac — gpac	NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3.0-DEV.	2023-10-15	7.8	CVE-2023-5586 MISC MISC
grafana — grafana	Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations. It also allows an Organization Admin to assign or revoke any permissions that they have to any user globally. Any Organization Admin can elevate their own permissions or elevate or restrict the permissions of any other user. The vulnerability does not allow a user to become a member of an organization that they are not already a member of, or to add any other users to an organization that the current user is not a member of.	2023-10-16	7.2	CVE-2023-4822 MISC
grafana — grafana	Grafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable to an information disclosure vulnerability. The plugin did not properly sanitize error messages, making it potentially expose the Google Sheet API-key that is configured for the data source. This vulnerability was fixed in version 1.2.2.	2023-10-16	7.5	CVE-2023-4457 MISC
hp — thinupdate	A potential security vulnerability has been identified in the HP ThinUpdate utility (also known as HP Recovery Image and Software Download Tool) which may lead to information disclosure. HP is releasing mitigation for the potential vulnerability.	2023-10-13	7.5	CVE-2023-4499 MISC
ibm — cloud_pak_for_business_automation	IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 258349.	2023-10-14	7.6	CVE-2023-35024 MISC MISC
ibm — db2	IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain databases. IBM X-Force ID: 253440.	2023-10-16	7.5	CVE-2023-30987 MISC MISC
ibm — db2	IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 254037.	2023-10-16	7.5	CVE-2023-30991 MISC MISC
ibm — db2	IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 and 11.5 is vulnerable to denial of service with a specially crafted ALTER TABLE statement. IBM X-Force ID: 261616.	2023-10-16	7.5	CVE-2023-38720 MISC MISC
ibm — db2	IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted XML query statement. IBM X-Force ID: 262258.	2023-10-16	7.5	CVE-2023-38728 MISC MISC MISC
ibm — db2	IBM Db2 for Linux, UNIX, and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted SQL statement. IBM X-Force ID: 262613.	2023-10-16	7.5	CVE-2023-38740 MISC MISC MISC
ibm — db2	IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted SQL statement using External Tables. IBM X-Force ID: 263499.	2023-10-17	7.5	CVE-2023-40372 MISC MISC
ibm — db2	IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to denial of service with a specially crafted query containing common table expressions. IBM X-Force ID: 263574.	2023-10-17	7.5	CVE-2023-40373 MISC MISC
ibm — db2	IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted query statement. IBM X-Force ID: 263575.	2023-10-16	7.5	CVE-2023-40374 MISC MISC
ibm — hardware_management_console	IBM HMC (Hardware Management Console) 10.1.1010.0 and 10.2.1030.0 could allow a local user to escalate their privileges to root access on a restricted shell. IBM X-Force ID: 260740.	2023-10-16	7.8	CVE-2023-38280 MISC MISC
ibm — i	Backup, Recovery, and Media Services (BRMS) for IBM i 7.2, 7.3, and 7.4 contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain component access to the host operating system. IBM X-Force ID: 263583.	2023-10-16	7.8	CVE-2023-40377 MISC MISC
ibm — i	IBM Directory Server for IBM i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain component access to the host operating system. IBM X-Force ID: 263584.	2023-10-15	7.8	CVE-2023-40378 MISC MISC
ibm — qradar_security_information_and_event_manager	IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 254138	2023-10-14	7.5	CVE-2023-30994 MISC MISC
ibm — security_directory_integrator	IBM Security Directory Server 6.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing “dot dot” sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 228582.	2023-10-14	7.5	CVE-2022-33165 MISC MISC MISC
ibm — security_directory_server	IBM Security Directory Server 6.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228505.	2023-10-14	9.1	CVE-2022-32755 MISC MISC
ibm — security_verify_access_oidc_provider	IBM Security Verify Access OIDC Provider could allow a remote user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 238921.	2023-10-14	7.5	CVE-2022-43740 MISC MISC
ibm — security_verify_governance	IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 256016.	2023-10-16	9.8	CVE-2023-33836 MISC MISC
ibm — security_verify_governance	IBM Security Verify Governance 10.0 could allow a privileged use to upload arbitrary files due to improper file validation. IBM X-Force ID: 259382.	2023-10-16	7.2	CVE-2023-35018 MISC MISC
ibm — security_verify_privilege_on-premises	IBM Security Verify Privilege On-Premises 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 221681.	2023-10-17	8.8	CVE-2022-22375 MISC MISC
ibm — security_verify_privilege_on-premises	IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information to an attacked due to the transmission of data in clear text. IBM X-Force ID: 221962.	2023-10-17	7.5	CVE-2022-22385 MISC MISC
ibm — security_verify_privilege_on-premises	IBM Security Verify Privilege On-Premise 11.5 could allow an authenticated user to obtain sensitive information or perform unauthorized actions due to improper input validation. IBM X-Force ID: 207898.	2023-10-17	7.1	CVE-2021-29913 MISC MISC
juniper — junos	An Unchecked Return Value vulnerability in the user interfaces to the Juniper Networks Junos OS and Junos OS Evolved, the CLI, the XML API, the XML Management Protocol, the NETCONF Management Protocol, the gNMI interfaces, and the J-Web User Interfaces causes unintended effects such as demotion or elevation of privileges associated with an operator’s actions to occur. Multiple scenarios may occur; for example: privilege escalation over the device or another account, access to files that should not otherwise be accessible, files not being accessible where they should be accessible, code expected to run as non-root may run as root, and so forth. This issue affects: Juniper Networks Junos OS * All versions prior to 20.4R3-S7; * 21.1 versions prior to 21.1R3-S5; * 21.2 versions prior to 21.2R3-S5; * 21.3 versions prior to 21.3R3-S4; * 21.4 versions prior to 21.4R3-S3; * 22.1 versions prior to 22.1R3-S2; * 22.2 versions prior to 22.2R2-S2, 22.2R3; * 22.3 versions prior to 22.3R1-S2, 22.3R2. Juniper Networks Junos OS Evolved * All versions prior to 21.4R3-S3-EVO; * 22.1-EVO version 22.1R1-EVO and later versions prior to 22.2R2-S2-EVO, 22.2R3-EVO; * 22.3-EVO versions prior to 22.3R1-S2-EVO, 22.3R2-EVO.	2023-10-13	8.8	CVE-2023-44182 MISC MISC MISC
juniper — junos	An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS allows an unauthenticated attacker with local access to the device to create a backdoor with root privileges. The issue is caused by improper directory permissions on a certain system directory, allowing an attacker with access to this directory to create a backdoor with root privileges. This issue affects Juniper Networks Junos OS: * All versions prior to 20.4R3-S5; * 21.1 versions prior to 21.1R3-S4; * 21.2 versions prior to 21.2R3-S4; * 21.3 versions prior to 21.3R3-S3; * 21.4 versions prior to 21.4R3-S1.	2023-10-13	7.8	CVE-2023-44194 MISC
juniper — junos	An Improperly Implemented Security Check for Standard vulnerability in storm control of Juniper Networks Junos OS QFX5k devices allows packets to be punted to ARP queue causing a l2 loop resulting in a DDOS violations and DDOS syslog. This issue is triggered when Storm control is enabled and ICMPv6 packets are present on device. This issue affects Juniper Networks: Junos OS * All versions prior to 20.2R3-S6 on QFX5k; * 20.3 versions prior to 20.3R3-S5 on QFX5k; * 20.4 versions prior to 20.4R3-S5 on QFX5k; * 21.1 versions prior to 21.1R3-S4 on QFX5k; * 21.2 versions prior to 21.2R3-S3 on QFX5k; * 21.3 versions prior to 21.3R3-S2 on QFX5k; * 21.4 versions prior to 21.4R3 on QFX5k; * 22.1 versions prior to 22.1R3 on QFX5k; * 22.2 versions prior to 22.2R2 on QFX5k.	2023-10-13	7.5	CVE-2023-44181 MISC MISC
juniper — junos	An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks allows an attacker to cause a Denial of Service (DoS) to the device upon receiving and processing a specific malformed ISO VPN BGP UPDATE packet. Continued receipt of this packet will cause a sustained Denial of Service condition. This issue affects: * Juniper Networks Junos OS: * All versions prior to 20.4R3-S6; * 21.1 versions prior to 21.1R3-S5; * 21.2 versions prior to 21.2R3-S4; * 21.3 versions prior to 21.3R3-S3; * 21.4 versions prior to 21.4R3-S3; * 22.1 versions prior to 22.1R2-S2, 22.1R3; * 22.2 versions prior to 22.2R2-S1, 22.2R3; * 22.3 versions prior to 22.3R1-S2, 22.3R2. Juniper Networks Junos OS Evolved: * All versions prior to 20.4R3-S6-EVO; * 21.1-EVO version 21.1R1-EVO and later versions prior to 21.2R3-S4-EVO; * 21.3-EVO versions prior to 21.3R3-S3-EVO; * 21.4-EVO versions prior to 21.4R3-S3-EVO; * 22.1-EVO versions prior to 22.1R3-EVO; * 22.2-EVO versions prior to 22.2R2-S1-EVO, 22.2R3-EVO; * 22.3-EVO versions prior to 22.3R1-S2-EVO, 22.3R2-EVO.	2023-10-13	7.5	CVE-2023-44185 MISC
juniper — junos	An Allocation of Resources Without Limits or Throttling vulnerability in Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service (DoS). On all Junos OS QFX5000 Series and EX4000 Series platforms, when a high number of VLANs are configured, a specific DHCP packet will cause PFE hogging which will lead to dropping of socket connections. This issue affects: Juniper Networks Junos OS on QFX5000 Series and EX4000 Series * 21.1 versions prior to 21.1R3-S5; * 21.2 versions prior to 21.2R3-S5; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S4; * 22.1 versions prior to 22.1R3-S3; * 22.2 versions prior to 22.2R3-S1; * 22.3 versions prior to 22.3R2-S2, 22.3R3; * 22.4 versions prior to 22.4R2. This issue does not affect Juniper Networks Junos OS versions prior to 21.1R1	2023-10-13	7.5	CVE-2023-44191 MISC
juniper — junos	An Improper Input Validation vulnerability in the Packet Forwarding Engine of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause memory leak, leading to Denial of Service (DoS). On all Junos OS QFX5000 Series platforms, when pseudo-VTEP (Virtual Tunnel End Point) is configured under EVPN-VXLAN scenario, and specific DHCP packets are transmitted, DMA memory leak is observed. Continuous receipt of these specific DHCP packets will cause memory leak to reach 99% and then cause the protocols to stop working and traffic is impacted, leading to Denial of Service (DoS) condition. A manual reboot of the system recovers from the memory leak. To confirm the memory leak, monitor for “sheaf:possible leak” and “vtep not found” messages in the logs. This issue affects: Juniper Networks Junos OS QFX5000 Series: * All versions prior to 20.4R3-S6; * 21.1 versions prior to 21.1R3-S5; * 21.2 versions prior to 21.2R3-S5; * 21.3 versions prior to 21.3R3-S4; * 21.4 versions prior to 21.4R3-S3; * 22.1 versions prior to 22.1R3-S2; * 22.2 versions prior to 22.2R2-S2, 22.2R3; * 22.3 versions prior to 22.3R2-S1, 22.3R3; * 22.4 versions prior to 22.4R1-S2, 22.4R2.	2023-10-13	7.5	CVE-2023-44192 MISC
juniper — junos	An Out-of-Bounds Write vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). On all Junos OS and Junos OS Evolved devices an rpd crash and restart can occur while processing BGP route updates received over an established BGP session. This specific issue is observed for BGP routes learned via a peer which is configured with a BGP import policy that has hundreds of terms matching IPv4 and/or IPv6 prefixes. This issue affects Juniper Networks Junos OS: * All versions prior to 20.4R3-S8; * 21.1 version 21.1R1 and later versions; * 21.2 versions prior to 21.2R3-S2; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R2-S1, 21.4R3-S5. This issue affects Juniper Networks Junos OS Evolved: * All versions prior to 20.4R3-S8-EVO; * 21.1-EVO version 21.1R1-EVO and later versions; * 21.2-EVO versions prior to 21.2R3-S2-EVO; * 21.3-EVO version 21.3R1-EVO and later versions; * 21.4-EVO versions prior to 21.4R2-S1-EVO, 21.4R3-S5-EVO.	2023-10-13	7.5	CVE-2023-44197 MISC
juniper — junos	An Improper Check for Unusual or Exceptional Conditions vulnerability in the SIP ALG of Juniper Networks Junos OS on SRX Series and MX Series allows an unauthenticated network-based attacker to cause an integrity impact in connected networks. If the SIP ALG is configured and a device receives a specifically malformed SIP packet, the device prevents this packet from being forwarded, but any subsequently received retransmissions of the same packet are forwarded as if they were valid. This issue affects Juniper Networks Junos OS on SRX Series and MX Series: * 20.4 versions prior to 20.4R3-S5; * 21.1 versions prior to 21.1R3-S4; * 21.2 versions prior to 21.2R3-S4; * 21.3 versions prior to 21.3R3-S3; * 21.4 versions prior to 21.4R3-S2; * 22.1 versions prior to 22.1R2-S2, 22.1R3; * 22.2 versions prior to 22.2R2-S1, 22.2R3; * 22.3 versions prior to 22.3R1-S2, 22.3R2. This issue doesn’t not affected releases prior to 20.4R1.	2023-10-13	7.5	CVE-2023-44198 MISC
juniper — junos	An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). On Junos MX Series platforms with Precision Time Protocol (PTP) configured, a prolonged routing protocol churn can lead to an FPC crash and restart. This issue affects Juniper Networks Junos OS on MX Series: * All versions prior to 20.4R3-S4; * 21.1 version 21.1R1 and later versions; * 21.2 versions prior to 21.2R3-S2; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3; * 22.1 versions prior to 22.1R3; * 22.2 versions prior to 22.2R1-S1, 22.2R2.	2023-10-13	7.5	CVE-2023-44199 MISC
linux — kernel	An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU.	2023-10-15	9.8	CVE-2023-45871 MISC MISC
linux — kernel	extract_user_to_sg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation, as demonstrated by a WARNING for try_grab_page.	2023-10-16	9.1	CVE-2023-40791 MISC MISC MISC MISC
linux — kernel	The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_status.c, related to ext4_es_insert_extent.	2023-10-16	7.8	CVE-2023-45898 MISC MISC MISC MISC MISC
linux — kernel	An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation.	2023-10-14	7.5	CVE-2023-45862 MISC MISC
netis-systems — n3m_firmware	Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings.	2023-10-13	9.8	CVE-2023-45465 MISC
netis-systems — n3m_firmware	Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the Time Settings.	2023-10-13	9.8	CVE-2023-45467 MISC
netis-systems — n3m_firmware	Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the hostName parameter in the FUN_0040dabc function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.	2023-10-13	7.5	CVE-2023-45463 MISC
netis-systems — n3m_firmware	Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the servDomain parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.	2023-10-13	7.5	CVE-2023-45464 MISC
netis-systems — n3m_firmware	Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the pingWdogIp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.	2023-10-13	7.5	CVE-2023-45468 MISC
netis-systems — n3mv2_firmware	Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin_host parameter in the WPS Settings.	2023-10-13	9.8	CVE-2023-45466 MISC
nextcloud — nextcloud_server	Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their Nextcloud Server to version 25.0.8, 26.0.3 or 27.0.1. There are no known workarounds for this vulnerability.	2023-10-16	8.8	CVE-2023-45151 MISC MISC MISC
nextcloud — nextcloud_server	Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and 26.0.4 and Nextcloud Enterprise Server 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4 contain patches for this issue. No known workarounds are available.	2023-10-13	7.5	CVE-2023-39960 MISC MISC MISC
node-qpdf — node-qpdf	All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they can specify the input pdf file path.	2023-10-14	9.8	CVE-2023-26155 MISC MISC
oracle — fusion_middleware	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).	2023-10-17	9.8	CVE-2023-22072 MISC
oracle — fusion_middleware	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).	2023-10-17	9.8	CVE-2023-22069 MISC
oracle — fusion_middleware	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).	2023-10-17	9.8	CVE-2023-22089 MISC
oracle — fusion_middleware	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).	2023-10-17	8.1	CVE-2023-22101 MISC
oracle — fusion_middleware	Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).	2023-10-17	7.5	CVE-2023-22019 MISC
oracle — fusion_middleware	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).	2023-10-17	7.5	CVE-2023-22086 MISC
oracle — fusion_middleware	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).	2023-10-17	7.5	CVE-2023-22108 MISC
oracle — hospitality_applications	Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). The supported version that is affected is 5.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in takeover of Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).	2023-10-17	8.8	CVE-2023-22085 MISC
oracle — hospitality_applications	Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). The supported version that is affected is 5.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in takeover of Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).	2023-10-17	8.8	CVE-2023-22087 MISC
oracle — mysql	Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).	2023-10-17	8.3	CVE-2023-22102 MISC
oracle — mysql	Vulnerability in the MySQL Installer product of Oracle MySQL (component: Installer: General). Supported versions that are affected are Prior to 1.6.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Installer executes to compromise MySQL Installer. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Installer, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Installer accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Installer. Note: This patch is used in MySQL Server bundled version 8.0.35 and 5.7.44. CVSS 3.1 Base Score 7.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H).	2023-10-17	7.9	CVE-2023-22094 MISC
oracle — virtualization	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. Note: Only applicable to 7.0.x platform. CVSS 3.1 Base Score 7.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H).	2023-10-17	7.9	CVE-2023-22100 MISC
oracle — virtualization	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. Note: Only applicable to 7.0.x platform. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).	2023-10-17	7.3	CVE-2023-22098 MISC
oracle — virtualization	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. Note: Only applicable to 7.0.x platform. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).	2023-10-17	7.3	CVE-2023-22099 MISC
otrs — otrs	The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSL_get_verify_result() function is not used the certificated is trusted always and it cannot be ensured that the certificate satisfies all necessary security requirements. This could allow an attacker to use an invalid certificate to claim to be a trusted host, use expired certificates, or conduct other attacks that could be detected if the certificate is properly validated. This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.	2023-10-16	9.1	CVE-2023-5422 MISC
prestashop — prestashop	Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via `id_customer`, `id_conf`, `id_product` and `token` parameters in `aftermailajax.php via the ‘id_product’ parameter in hooks DisplayRightColumnProduct and DisplayProductButtons.	2023-10-14	9.8	CVE-2023-30154 MISC
qdpm — qdpm	qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI.	2023-10-14	9.8	CVE-2023-45856 MISC MISC
qdpm — qdpm	qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.	2023-10-14	7.5	CVE-2023-45855 MISC MISC
qnap — container_station	An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following version: Container Station 2.6.7.44 and later	2023-10-13	7.2	CVE-2023-32976 MISC
qnap — quts_hero	A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.0.2444 build 20230629 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTScloud c5.1.0.2498 and later	2023-10-13	7.5	CVE-2023-32974 MISC
qnap — quts_hero	A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h4.5.4.2476 build 20230728 and later QuTScloud c5.1.0.2498 and later	2023-10-13	7.2	CVE-2023-32973 MISC
qnap — video_station	A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.0 ( 2023/07/27 ) and later	2023-10-13	8.8	CVE-2023-34975 MISC
qnap — video_station	A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.0 ( 2023/07/27 ) and later	2023-10-13	8.8	CVE-2023-34976 MISC
rockwell_automation — factorytalk_linx	FactoryTalk Linx, in the Rockwell Automation PanelView Plus, allows an unauthenticated threat actor to read data from memory via crafted malicious packets. Sending a size larger than the buffer size results in leakage of data from memory resulting in an information disclosure. If the size is large enough, it causes communications over the common industrial protocol to become unresponsive to any type of packet, resulting in a denial-of-service to FactoryTalk Linx over the common industrial protocol.	2023-10-13	9.1	CVE-2023-29464 MISC
selenium — selenium	NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.0.	2023-10-15	7.5	CVE-2023-5590 MISC MISC
solarwinds — access_rights_manager	The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability can be abused by unauthenticated users on SolarWinds ARM Server.	2023-10-19	8.8	CVE-2023-35182 MISC MISC
solarwinds — access_rights_manager	The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse a SolarWinds service resulting in a remote code execution.	2023-10-19	8.8	CVE-2023-35184 MISC MISC
solarwinds — access_rights_manager	The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability using SYSTEM privileges.	2023-10-19	8.8	CVE-2023-35185 MISC MISC
solarwinds — access_rights_manager	The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability allows an unauthenticated user to achieve the Remote Code Execution.	2023-10-19	8.8	CVE-2023-35187 MISC MISC
solarwinds — access_rights_manager	The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows authenticated users to abuse SolarWinds ARM API.	2023-10-19	8	CVE-2023-35180 MISC MISC
solarwinds — access_rights_manager	The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution.	2023-10-19	8	CVE-2023-35186 MISC MISC
solarwinds — access_rights_manager	The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows users to abuse incorrect folder permission resulting in Privilege Escalation.	2023-10-19	7.8	CVE-2023-35181 MISC
solarwinds — access_rights_manager	The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows authenticated users to abuse local resources to Privilege Escalation.	2023-10-19	7.8	CVE-2023-35183 MISC MISC
sonicwall — sonicos	SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileges inside the tunnel.	2023-10-17	8.8	CVE-2023-41715 MISC
sonicwall — sonicos	SonicOS Use of Hard-coded Password vulnerability in the ‘dynHandleBuyToolbar’ demo function.	2023-10-17	7.5	CVE-2023-41713 MISC
sourcecodester — library_system	A vulnerability classified as critical has been found in SourceCodester Library System 1.0. This affects an unknown part of the file index.php. The manipulation of the argument category leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-242145 was assigned to this vulnerability.	2023-10-14	9.8	CVE-2023-5580 MISC MISC MISC
totolink — cp300+_firmware	TOTOLINK CP300+ V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the pingIp parameter in the function setDiagnosisCfg.	2023-10-16	9.8	CVE-2023-36952 MISC
totolink — cp300+_firmware	TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.	2023-10-16	9.8	CVE-2023-36953 MISC
totolink — cp300+_firmware	TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.	2023-10-16	9.8	CVE-2023-36954 MISC
totolink — cp300+_firmware	TOTOLINK CP300+ <=V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.	2023-10-16	9.8	CVE-2023-36955 MISC
totolink — nr1800x_firmware	TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.	2023-10-16	9.8	CVE-2023-36340 MISC
totolink — x5000r_firmware	TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.	2023-10-16	9.8	CVE-2023-36947 MISC
totolink — x5000r_firmware	TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.	2023-10-16	9.8	CVE-2023-36950 MISC
totolink — x5000r_firmware	TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the lang parameter in the function setLanguageCfg.	2023-10-16	9.8	CVE-2023-45984 MISC
totolink — x5000r_firmware	TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 were discovered to contain a stack overflow in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.	2023-10-16	7.5	CVE-2023-45985 MISC
user_registration_&_login_and_user_management_system — user_registration_&_login_and_user_management_system	SQL Injection vulnerability in Phpgurukul User Registration & Login and User Management System With admin panel 3.0 allows attackers to obtain sensitive information via crafted string in the admin username field on the admin log in page.	2023-10-16	9.8	CVE-2023-40852 MISC
valvesoftware — counter-strike	A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client (with remote control access to a game server) to read arbitrary files from the underlying server via the motdfile console variable.	2023-10-15	7.5	CVE-2023-38312 MISC
viessmann — vitogate_300_firmware	In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method.	2023-10-14	9.8	CVE-2023-45852 MISC MISC
vrite — vrite	Server-Side Request Forgery (SSRF) in GitHub repository vriteio/vrite prior to 0.3.0.	2023-10-13	9.8	CVE-2023-5572 MISC MISC
vrite — vrite	Improper Input Validation in GitHub repository vriteio/vrite prior to 0.3.0.	2023-10-13	7.5	CVE-2023-5571 MISC MISC
web2py — web2py	An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.	2023-10-16	9.8	CVE-2023-45158 MISC MISC MISC MISC
wordpress — wordpress	A vulnerability was found in reciply Plugin up to 1.1.7 on WordPress. It has been rated as critical. This issue affects some unknown processing of the file uploadImage.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. Upgrading to version 1.1.8 is able to address this issue. The identifier of the patch is e3ff616dc08d3aadff9253f1085e13f677d0c676. It is recommended to upgrade the affected component. The identifier VDB-242189 was assigned to this vulnerability.	2023-10-17	9.8	CVE-2011-10004 MISC MISC MISC
wordpress — wordpress	The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE	2023-10-16	9.8	CVE-2023-4666 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in GoodBarber plugin <= 1.0.22 versions.	2023-10-13	8.8	CVE-2023-45107 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Mailrelay plugin <= 2.1.1 versions.	2023-10-13	8.8	CVE-2023-45108 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in ZAKSTAN WhitePage plugin <= 1.1.5 versions.	2023-10-13	8.8	CVE-2023-45109 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Zizou1988 IRivYou plugin <= 2.2.1 versions.	2023-10-13	8.8	CVE-2023-45267 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Hitsteps Hitsteps Web Analytics plugin <= 5.86 versions.	2023-10-13	8.8	CVE-2023-45268 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in PINPOINT.WORLD Pinpoint Booking System plugin <= 2.9.9.4.0 versions.	2023-10-13	8.8	CVE-2023-45270 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Matt McKenny Stout Google Calendar plugin <= 1.2.3 versions.	2023-10-16	8.8	CVE-2023-45273 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in SendPulse SendPulse Free Web Push plugin <= 1.3.1 versions.	2023-10-16	8.8	CVE-2023-45274 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in automatededitor.Com Automated Editor plugin <= 1.3 versions.	2023-10-13	8.8	CVE-2023-45276 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Christopher Finke Feed Statistics plugin <= 4.1 versions.	2023-10-16	8.8	CVE-2023-45605 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Lasso Simple URLs plugin <= 120 versions.	2023-10-16	8.8	CVE-2023-45606 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions.	2023-10-16	8.8	CVE-2023-45629 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in euPago Eupago Gateway For Woocommerce plugin <= 3.1.9 versions.	2023-10-16	8.8	CVE-2023-45638 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Codex-m Sort SearchResult By Title plugin <= 10.0 versions.	2023-10-16	8.8	CVE-2023-45639 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Caret Inc. Caret Country Access Limit plugin <= 1.0.2 versions.	2023-10-16	8.8	CVE-2023-45641 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Hassan Ali Snap Pixel plugin <= 1.5.7 versions.	2023-10-16	8.8	CVE-2023-45642 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin <= 1.0 versions.	2023-10-16	8.8	CVE-2023-45643 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in InfoD74 WP Open Street Map plugin <= 1.25 versions.	2023-10-16	8.8	CVE-2023-45645 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in MailMunch Constant Contact Forms by MailMunch plugin <= 2.0.10 versions.	2023-10-16	8.8	CVE-2023-45647 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Fla-shop.Com HTML5 Maps plugin <= 1.7.1.4 versions.	2023-10-16	8.8	CVE-2023-45650 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi WP Attachments plugin <= 5.0.6 versions.	2023-10-16	8.8	CVE-2023-45651 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Galaxy Weblinks Video Playlist For YouTube plugin <= 6.0 versions.	2023-10-16	8.8	CVE-2023-45653 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions.	2023-10-16	8.8	CVE-2023-45654 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in PixelGrade PixFields plugin <= 0.7.0 versions.	2023-10-16	8.8	CVE-2023-45655 MISC MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Kevin Weber Lazy Load for Videos plugin <= 2.18.2 versions.	2023-10-16	8.8	CVE-2023-45656 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailChimp Forms by MailMunch plugin <= 3.1.4 versions.	2023-10-16	8.8	CVE-2023-45748 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Alexey Golubnichenko AGP Font Awesome Collection plugin <= 3.2.4 versions.	2023-10-16	8.8	CVE-2023-45749 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in 10 Quality Post Gallery plugin <= 2.3.12 versions.	2023-10-16	8.8	CVE-2023-45752 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Gilles Dumas which template file plugin <= 4.6.0 versions.	2023-10-16	8.8	CVE-2023-45753 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Taggbox plugin <= 2.9 versions.	2023-10-16	8.8	CVE-2023-45763 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Pixelative, Mohsin Rafique AMP WP – Google AMP For WordPress plugin <= 1.5.15 versions.	2023-10-16	8.8	CVE-2023-45831 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in XYDAC Ultimate Taxonomy Manager plugin <= 2.0 versions.	2023-10-16	8.8	CVE-2023-45836 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Mahlamusa Who Hit The Page – Hit Counter plugin <= 1.4.14.3 versions.	2023-10-16	8.8	CVE-2023-46087 MISC
wordpress — wordpress	The Enable Media Replace WordPress plugin before 4.1.3 deserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog	2023-10-16	8.8	CVE-2023-4643 MISC
wordpress — wordpress	The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers.	2023-10-16	8.8	CVE-2023-4776 MISC
wordpress — wordpress	The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell.	2023-10-16	8.8	CVE-2023-4827 MISC
wordpress — wordpress	A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress. Affected is an unknown function of the file simple-download-button_dl.php of the component Download Handler. The manipulation of the argument file leads to information disclosure. It is possible to launch the attack remotely. Upgrading to version 1.1 is able to address this issue. The patch is identified as e648a8706818297cf02a665ae0bae1c069dea5f1. It is recommended to upgrade the affected component. VDB-242190 is the identifier assigned to this vulnerability.	2023-10-17	7.5	CVE-2012-10016 MISC MISC MISC
wordpress — wordpress	The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to PHAR Deserialization due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.	2023-10-16	7.5	CVE-2023-3154 MISC
wordpress — wordpress	The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so.	2023-10-16	7.5	CVE-2023-5003 MISC
wordpress — wordpress	This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.	2023-10-16	7.5	CVE-2023-5133 MISC
wordpress — wordpress	The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.	2023-10-16	7.2	CVE-2023-3155 MISC
wordpress — wordpress	The Read More & Accordion WordPress plugin before 3.2.7 deserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.	2023-10-16	7.2	CVE-2023-3392 MISC
wordpress — wordpress	The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin	2023-10-16	7.2	CVE-2023-4691 MISC
wordpress — wordpress	The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code execution.	2023-10-16	7.2	CVE-2023-4861 MISC
wordpress — wordpress	The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user imports a malicious file and a suitable gadget chain is present on the blog.	2023-10-16	7.2	CVE-2023-4971 MISC
xwiki — oauth_identity	com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting (XSS) and XWiki syntax injection. This allows remote code execution via the groovy macro and thus affects the confidentiality, integrity and availability of the whole XWiki installation. The issue has been fixed in Identity OAuth version 1.6. There are no known workarounds for this vulnerability and users are advised to upgrade.	2023-10-16	9.6	CVE-2023-45144 MISC MISC MISC MISC MISC
zephyr — zephyr	Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows.	2023-10-13	9.8	CVE-2023-4257 MISC
zephyr — zephyr	Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver	2023-10-13	8.8	CVE-2023-4263 MISC
zephyrproject — zephyr	The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception.	2023-10-13	7.5	CVE-2023-5563 MISC
zlib — zlib	MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product.	2023-10-14	9.8	CVE-2023-45853 MISC MISC MISC MISC MISC MLIST
zpesystems — nodegrid_os	An issue in ZPE Systems, Inc Nodegrid OS v.5.8.10 thru v.5.8.13 and v.5.10.3 thru v.5.10.5 allows a remote attacker to obtain sensitive information via the TACACS+ server component.	2023-10-14	7.5	CVE-2023-44037 CONFIRM

Medium Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
apache — airflow	Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.	2023-10-14	6.5	CVE-2023-42663 MISC MISC
apache — airflow	Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.	2023-10-14	6.5	CVE-2023-42780 MISC MISC
apache — airflow	Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn’t. Users of Apache Airflow are strongly advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.	2023-10-14	6.5	CVE-2023-42792 MISC MISC
apache — airflow	Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the “expose_config” option is set to “non-sensitive-only”. The `expose_config` option is False by default. It is recommended to upgrade to a version that is not affected.	2023-10-14	4.3	CVE-2023-45348 MISC MISC
apache — brpc	Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the built-in rpcz page. An attacker that can send http request to bRPC server with rpcz enabled can inject arbitrary XSS code to the built-in rpcz page. Solution (choose one of three): 1. upgrade to bRPC > 1.6.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.6.1/ 2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2411 3. disable rpcz feature.	2023-10-16	6.1	CVE-2023-45757 MISC MISC
apache — inlong	Insufficient Verification of Data Authenticity vulnerability in Apache InLong. This issue affects Apache InLong from 1.4.0 through 1.8.0. General user can view all user data like Admin account. Users are advised to upgrade to Apache InLong’s 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8623	2023-10-16	6.5	CVE-2023-43666 MISC
axis — axis_os	NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. The protection for device tampering (commonly known as Secure Boot) contains a flaw which provides an opportunity for a sophisticated attack to bypass this protection. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.	2023-10-16	6.8	CVE-2023-21414 MISC
classlink — oneclick	A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.7 allows remote attackers to inject JavaScript into any webpage, because a regular expression (validating whether a URL is controlled by ClassLink) is not present in all applicable places.	2023-10-16	6.1	CVE-2022-48612 MISC
devolutions — devolutions_server	Improper access control in the permission inheritance in Devolutions Server 2022.3.13.0 and earlier allows an attacker that compromised a low privileged user to access entries via a specific combination of permissions in the entry and in its parent.	2023-10-16	6.5	CVE-2023-5575 MISC
discourse — discourse	Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the 3.2.0.beta1 release. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.	2023-10-16	5.4	CVE-2023-43659 MISC MISC
discourse — discourse	Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when `hide_user_profiles_from_public` is enabled. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-16	5.3	CVE-2023-44391 MISC
discourse — discourse	dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Improper escaping of event titles could lead to Cross-site Scripting (XSS) within the ’email preview’ UI when a site has CSP disabled. Having CSP disabled is a non-default configuration, so the vast majority of sites are unaffected. This problem is resolved in the latest version of the discourse-calendar plugin. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.	2023-10-16	6.1	CVE-2023-43658 MISC MISC MISC
easyuse — mailhunter_ultimate	Path Traversal in create template function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to extract files into arbitrary directories via a crafted ZIP archive.	2023-10-17	6.5	CVE-2023-34208 MISC
easyuse — mailhunter_ultimate	Exposure of Sensitive System Information to an Unauthorized Control Sphere in create template function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to obtain the absolute path via unencrypted VIEWSTATE parameter.	2023-10-17	4.3	CVE-2023-34209 MISC
farmbot — farmbot	Farmbot-Web-App is a web control interface for the Farmbot farm automation platform. An SQL injection vulnerability was found in FarmBot’s web app that allows authenticated attackers to extract arbitrary data from its database (including the user table). This issue may lead to Information Disclosure. This issue has been patched in version 15.8.4. Users are advised to upgrade. There are no known workarounds for this issue.	2023-10-14	6.5	CVE-2023-45674 MISC
fortinet — fortisandbox	A improper neutralization of input during web page generation (‘cross-site scripting’) in Fortinet FortiSandbox version 4.4.1 and 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.7 and 2.5.0 through 2.5.2 and 2.4.1 allows attacker to execute unauthorized code or commands via crafted HTTP requests.	2023-10-13	6.1	CVE-2023-41680 MISC
fortinet — fortisandbox	A improper neutralization of input during web page generation (‘cross-site scripting’) in Fortinet FortiSandbox version 4.4.1 and 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.7 and 2.5.0 through 2.5.2 and 2.4.1 allows attacker to execute unauthorized code or commands via crafted HTTP requests.	2023-10-13	6.1	CVE-2023-41681 MISC
fortinet — fortisandbox	An improper neutralization of input during web page generation (‘cross-site scripting’) in Fortinet FortiSandbox version 4.4.0 and 4.2.0 through 4.2.4, and 4.0.0 through 4.0.4 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.4 through 3.0.7 allows attacker to execute unauthorized code or commands via crafted HTTP requests.	2023-10-13	6.1	CVE-2023-41836 MISC
fortinet — fortisandbox	A improper neutralization of input during web page generation (‘cross-site scripting’) in Fortinet FortiSandbox version 4.4.1 and 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 allows attacker to execute unauthorized code or commands via crafted HTTP requests.	2023-10-13	5.4	CVE-2023-41843 MISC
froxlor — froxlor	Cross-site Scripting (XSS) – Stored in GitHub repository froxlor/froxlor prior to 2.0.22.	2023-10-13	5.4	CVE-2023-4829 MISC MISC
froxlor — froxlor	Cross-site Scripting (XSS) – Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1.	2023-10-13	4.8	CVE-2023-5564 MISC MISC
gpac — gpac	Denial of Service in GitHub repository gpac/gpac prior to 2.3.0-DEV.	2023-10-16	5.5	CVE-2023-5595 MISC MISC
grandingteco — utime_master	An indirect object reference (IDOR) in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to access sensitive information via a crafted cookie.	2023-10-13	6.5	CVE-2023-45393 MISC
grandingteco — utime_master	A stored cross-site scripting (XSS) vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter.	2023-10-13	4.8	CVE-2023-45391 MISC
hestiacp — hestiacp	Cross-site Scripting (XSS) – Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.	2023-10-13	5.4	CVE-2023-4517 MISC MISC
hp — t430_thin_client_firmware	HP is aware of a potential security vulnerability in HP t430 and t638 Thin Client PCs. These models may be susceptible to a physical attack, allowing an untrusted source to tamper with the system firmware using a publicly disclosed private key. HP is providing recommended guidance for customers to reduce exposure to the potential vulnerability.	2023-10-13	6.8	CVE-2023-5409 MISC
ibm — app_connect_enterprise	IBM App Connect Enterprise 12.0.1.0 through 12.0.8.0 contains an unspecified vulnerability that could allow a local privileged user to obtain sensitive information from API logs. IBM X-Force ID: 263833.	2023-10-13	4.4	CVE-2023-40682 MISC MISC
ibm — db2	IBM Db2 11.5 could allow a local user with special privileges to cause a denial of service during database deactivation on DPF. IBM X-Force ID: 261607.	2023-10-17	4.4	CVE-2023-38719 MISC MISC
ibm — integration_bus	IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.10.0 and IBM Integration Bus 10.1 through 10.1.0.1 are vulnerable to a denial of service for integration nodes on Windows. IBM X-Force ID: 247998.	2023-10-14	5.5	CVE-2023-45176 MISC MISC
ibm — qradar_security_information_and_event_manager	IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 263376.	2023-10-14	5.4	CVE-2023-40367 MISC MISC
ibm — security_directory_server	IBM Security Directory Server 6.4.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. X-Force ID: 228569.	2023-10-14	5.9	CVE-2022-33161 MISC MISC MISC
ibm — security_verify_access_oidc_provider	IBM Security Verify Access OIDC Provider could disclose directory information that could aid attackers in further attacks against the system. IBM X-Force ID: 239445.	2023-10-14	5.3	CVE-2022-43868 MISC MISC
ibm — security_verify_governance	IBM Security Verify Governance 10.0, Identity Manager could allow a local privileged user to obtain sensitive information from source code. IBM X-Force ID: 257769.	2023-10-16	4.4	CVE-2023-35013 MISC MISC
ibm — security_verify_privilege_on-premises	IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 221963.	2023-10-17	5.9	CVE-2022-22386 MISC MISC
ibm — security_verify_privilege_on-premises	IBM Security Verify Privilege On-Premises 11.5 could allow a user to obtain version number information using a specially crafted HTTP request that could be used in further attacks against the system. IBM X-Force ID: 207899.	2023-10-17	5.3	CVE-2021-38859 MISC MISC
ibm — security_verify_privilege_on-premises	IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 221827.	2023-10-17	5.3	CVE-2022-22377 MISC MISC
ibm — security_verify_privilege_on-premises	IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information through an HTTP request that could aid an attacker in further attacks against the system. IBM X-Force ID: 240452.	2023-10-17	5.3	CVE-2022-43889 MISC MISC
ibm — security_verify_privilege_on-premises	IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 240454.	2023-10-17	5.3	CVE-2022-43891 MISC MISC
ibm — security_verify_privilege_on-premises	IBM Security Verify Privilege On-Premises 11.5 does not validate, or incorrectly validates, a certificate which could disclose sensitive information which could aid further attacks against the system. IBM X-Force ID: 240455.	2023-10-17	5.3	CVE-2022-43892 MISC MISC
ibm — security_verify_privilege_on-premises	IBM Security Verify Privilege On-Premises 11.5 could allow a privileged user to cause by using a malicious payload. IBM X-Force ID: 240634.	2023-10-17	4.4	CVE-2022-43893 MISC MISC
ibm — security_verify_privilege_on-premises	IBM Security Verify Privilege On-Premises 11.5 could allow a user to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 199324.	2023-10-17	4.3	CVE-2021-20581 MISC MISC
ibm — security_verify_privilege_on-premises	IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to spoof a trusted entity due to improperly validating certificates. IBM X-Force ID: 221957.	2023-10-17	4.3	CVE-2022-22380 MISC MISC
ibm — security_verify_privilege_on-premises	IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to modify messages returned from the server due to hazardous input validation. IBM X-Force ID: 221961.	2023-10-17	4.3	CVE-2022-22384 MISC MISC
jorani — leave_management_system	An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page.	2023-10-16	6.5	CVE-2023-45540 MISC
juniper — junos	An Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the management daemon (mgd) process of Juniper Networks Junos OS and Junos OS Evolved allows a network-based authenticated low-privileged attacker, by executing a specific command via NETCONF, to cause a CPU Denial of Service to the device’s control plane. This issue affects: Juniper Networks Junos OS * All versions prior to 20.4R3-S7; * 21.2 versions prior to 21.2R3-S5; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S4; * 22.1 versions prior to 22.1R3-S2; * 22.2 versions prior to 22.2R3; * 22.3 versions prior to 22.3R2-S1, 22.3R3; * 22.4 versions prior to 22.4R1-S2, 22.4R2. Juniper Networks Junos OS Evolved * All versions prior to 21.4R3-S4-EVO; * 22.1 versions prior to 22.1R3-S2-EVO; * 22.2 versions prior to 22.2R3-EVO; * 22.3 versions prior to 22.3R3-EVO; * 22.4 versions prior to 22.4R2-EVO. An indicator of compromise can be seen by first determining if the NETCONF client is logged in and fails to log out after a reasonable period of time and secondly reviewing the WCPU percentage for the mgd process by running the following command: mgd process example: user@device-re#> show system processes extensive \| match “mgd\|PID” \| except last PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND 92476 root 100 0 500M 89024K CPU3 3 57.5H 89.60% mgd <<<<<<<<<<< review the high cpu percentage. Example to check for NETCONF activity: While there is no specific command that shows a specific session in use for NETCONF, you can review logs for UI_LOG_EVENT with “client-mode ‘netconf'” For example: mgd[38121]: UI_LOGIN_EVENT: User ‘root’ login, class ‘super-user’ [38121], ssh-connection ‘10.1.1.1 201 55480 10.1.1.2 22’, client-mode ‘netconf’	2023-10-13	6.5	CVE-2023-44184 MISC
juniper — junos	An Improper Check or Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on QFX5000 Series, EX2300, EX3400, EX4100, EX4400 and EX4600 allows a adjacent attacker to send specific traffic, which leads to packet flooding, resulting in a Denial of Service (DoS). When a specific IGMP packet is received in an isolated VLAN, it is duplicated to all other ports under the primary VLAN, which causes a flood. This issue affects QFX5000 series, EX2300, EX3400, EX4100, EX4400 and EX4600 platforms only. This issue affects Juniper Junos OS on on QFX5000 Series, EX2300, EX3400, EX4100, EX4400 and EX4600: * All versions prior to 20.4R3-S5; * 21.1 versions prior to 21.1R3-S4; * 21.2 versions prior to 21.2R3-S3; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S2; * 22.1 versions prior to 22.1R3; * 22.2 versions prior to 22.2R3; * 22.3 versions prior to 22.3R2.	2023-10-13	6.5	CVE-2023-44203 MISC
juniper — junos	An Improper Validation of Syntactic Correctness of Input vulnerability in Routing Protocol Daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When a malformed BGP UPDATE packet is received over an established BGP session, the rpd crashes and restarts. This issue affects both eBGP and iBGP implementations. This issue affects: Juniper Networks Junos OS * 21.4 versions prior to 21.4R3-S4; * 22.1 versions prior to 22.1R3-S3; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3; * 22.4 versions prior to 22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1, 23.2R2; Juniper Networks Junos OS Evolved * 21.4 versions prior to 21.4R3-S5-EVO; * 22.1 versions prior to 22.1R3-S3-EVO; * 22.2 versions prior to 22.2R3-S3-EVO; * 22.3 versions prior to 22.3R2-S2-EVO; * 22.4 versions prior to 22.4R3-EVO; * 23.2 versions prior to 23.2R2-EVO;	2023-10-13	6.5	CVE-2023-44204 MISC
juniper — junos	A Stack-based Buffer Overflow vulnerability in the CLI command of Juniper Networks Junos OS allows a low privileged attacker to execute a specific CLI commands leading to Denial of Service. Repeated actions by the attacker will create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks: Junos OS: * All versions prior to 20.4R3-S8; * 21.2 versions prior to 21.2R3-S6; * 21.3 versions prior to 21.3R3-S5; * 22.1 versions prior to 22.1R3-S3; * 22.3 versions prior to 22.3R3; * 22.4 versions prior to 22.4R3.	2023-10-13	5.5	CVE-2023-44176 MISC
juniper — junos	A Stack-based Buffer Overflow vulnerability in the CLI command of Juniper Networks Junos and Junos EVO allows a low privileged attacker to execute a specific CLI commands leading to Denial of Service. Repeated actions by the attacker will create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks: Junos OS: * All versions prior to 19.1R3-S10; * 19.2 versions prior to 19.2R3-S7; * 19.3 versions prior to 19.3R3-S8; * 19.4 versions prior to 19.4R3-S12; * 20.2 versions prior to 20.2R3-S8; * 20.4 versions prior to 20.4R3-S8; * 21.2 versions prior to 21.2R3-S6; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S4; * 22.1 versions prior to 22.1R3-S3; * 22.2 versions prior to 22.2R3-S1; * 22.3 versions prior to 22.3R3; * 22.4 versions prior to 22.4R2. Junos OS Evolved: * All versions prior to 20.4R3-S8-EVO; * 21.2 versions prior to 21.2R3-S6-EVO; * 21.3 versions prior to 21.3R3-S5-EVO; * 21.4 versions prior to 21.4R3-S4-EVO; * 22.1 versions prior to 22.1R3-S3-EVO; * 22.2 versions prior to 22.2R3-S1-EVO; * 22.3 versions prior to 22.3R3-EVO; * 22.4 versions prior to 22.4R2-EVO.	2023-10-13	5.5	CVE-2023-44177 MISC
juniper — junos	A Stack-based Buffer Overflow vulnerability in the CLI command of Juniper Networks Junos OS allows a low privileged attacker to execute a specific CLI commands leading to Denial of Service. Repeated actions by the attacker will create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks: Junos OS * All versions prior to 19.1R3-S10; * 19.2 versions prior to 19.2R3-S7; * 19.3 versions prior to 19.3R3-S8; * 19.4 versions prior to 19.4R3-S12; * 20.2 versions prior to 20.2R3-S8; * 20.4 versions prior to 20.4R3-S8; * 21.2 versions prior to 21.2R3-S6; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S3; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R3-S1; * 22.4 versions prior to 22.4R2-S1; * 23.2 versions prior to 23.2R2.	2023-10-13	5.5	CVE-2023-44178 MISC
juniper — junos	An Improper Release of Memory Before Removing Last Reference vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a local, low privileged attacker to cause an FPC crash, leading to Denial of Service (DoS). On all Junos MX Series with MPC1 – MPC9, LC480, LC2101, MX10003, and MX80, when Connectivity-Fault-Management (CFM) is enabled in a VPLS scenario, and a specific LDP related command is run, an FPC will crash and reboot. Continued execution of this specific LDP command can lead to sustained Denial of Service condition. This issue affects: Juniper Networks Junos OS on MX Series: * All versions prior to 20.4R3-S7; * 21.1 versions prior to 21.1R3-S5; * 21.2 versions prior to 21.2R3-S4; * 21.3 versions prior to 21.3R3-S4; * 21.4 versions prior to 21.4R3-S3; * 22.1 versions prior to 22.1R3-S1; * 22.2 versions prior to 22.2R2-S1, 22.2R3; * 22.3 versions prior to 22.3R1-S2, 22.3R2.	2023-10-13	5.5	CVE-2023-44193 MISC
juniper — junos	An Incorrect Permission Assignment for Critical Resource vulnerability in a specific file of Juniper Networks Junos OS and Junos OS Evolved allows a local authenticated attacker to read configuration changes without having the permissions. When a user with the respective permissions commits a configuration change, a specific file is created. That file is readable even by users with no permissions to access the configuration. This can lead to privilege escalation as the user can read the password hash when a password change is being committed. This issue affects: Juniper Networks Junos OS * All versions prior to 20.4R3-S4; * 21.1 versions prior to 21.1R3-S4; * 21.2 versions prior to 21.2R3-S2; * 21.3 versions prior to 21.3R2-S2, 21.3R3-S1; * 21.4 versions prior to 21.4R2-S1, 21.4R3. Juniper Networks Junos OS Evolved * All versions prior to 20.4R3-S4-EVO; * 21.1 versions prior to 21.1R3-S2-EVO; * 21.2 versions prior to 21.2R3-S2-EVO; * 21.3 versions prior to 21.3R3-S1-EVO; * 21.4 versions prior to 21.4R2-S2-EVO.	2023-10-13	5.5	CVE-2023-44201 MISC
juniper — junos	An Improper Input Validation vulnerability in the VxLAN packet forwarding engine (PFE) of Juniper Networks Junos OS on QFX5000 Series, EX4600 Series devices allows an unauthenticated, adjacent attacker, sending two or more genuine packets in the same VxLAN topology to possibly cause a DMA memory leak to occur under various specific operational conditions. The scenario described here is the worst-case scenario. There are other scenarios that require operator action to occur. An indicator of compromise may be seen when multiple devices indicate that FPC0 has gone missing when issuing a show chassis fpc command for about 10 to 20 minutes, and a number of interfaces have also gone missing. Use the following command to determine if FPC0 has gone missing from the device. show chassis fpc detail This issue affects: Juniper Networks Junos OS on QFX5000 Series, EX4600 Series: * 18.4 version 18.4R2 and later versions prior to 20.4R3-S8; * 21.1 version 21.1R1 and later versions prior to 21.2R3-S6; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S4; * 22.1 versions prior to 22.1R3-S3; * 22.2 versions prior to 22.2R3-S1; * 22.3 versions prior to 22.3R2-S2, 22.3R3; * 22.4 versions prior to 22.4R2.	2023-10-13	5.3	CVE-2023-44183 MISC MISC MISC
juniper — junos_os_evolved	An Improper Check for Unusual or Exceptional Conditions in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS Evolved on PTX10003 Series allows an unauthenticated adjacent attacker to cause an impact to the integrity of the system. When specific transit MPLS packets are received by the PFE, these packets are internally forwarded to the RE. This issue is a prerequisite for CVE-2023-44195. This issue affects Juniper Networks Junos OS Evolved: * All versions prior to 20.4R3-S8-EVO; * 21.1-EVO version 21.1R1-EVO and later; * 21.2-EVO versions prior to 21.2R3-S6-EVO; * 21.3-EVO version 21.3R1-EVO and later; * 21.4-EVO versions prior to 21.4R3-S3-EVO; * 22.1-EVO versions prior to 22.1R3-S4-EVO; * 22.2-EVO versions prior to 22.2R3-S3-EVO; * 22.3-EVO versions prior to 22.3R2-S2-EVO, 22.3R3-EVO; * 22.4-EVO versions prior to 22.4R2-EVO.	2023-10-13	6.5	CVE-2023-44196 MISC
librenms — librenms	SQL Injection in GitHub repository librenms/librenms prior to 23.10.0.	2023-10-16	6.5	CVE-2023-5591 MISC MISC
linux — kernel	An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.	2023-10-14	6.4	CVE-2023-45863 MISC MISC
linux — kernel	An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating `skb_shared_info` in the userspace, which is exploitable in systems without SMAP protection since `skb_shared_info` contains references to function pointers.	2023-10-13	5.5	CVE-2023-42752 MISC MISC MISC MISC
microsoft — edge_chromium	Microsoft Edge (Chromium-based) Spoofing Vulnerability	2023-10-13	4.2	CVE-2023-36559 MISC
moosocial — moosocial	Cross Site Scripting vulnerability in mooSocial 3.1.8 allows a remote attacker to obtain sensitive information via a crafted script to the q parameter in the Search function.	2023-10-16	6.1	CVE-2023-45542 MISC
nextcloud — calendar	Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended that the Nextcloud Calendar app is upgraded to 4.4.4. The only workaround for users unable to upgrade is to disable the calendar app.	2023-10-16	4.3	CVE-2023-45150 MISC MISC MISC
nextcloud — mail	Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0. There are no known workarounds for this vulnerability.	2023-10-16	4.3	CVE-2023-45660 MISC MISC MISC
nextcloud — nextcloud_server	Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgrade should change their config setting `memcache.distributed` to `OCMemcacheRedis` and install Redis instead of Memcached.	2023-10-16	4.3	CVE-2023-45148 MISC MISC MISC
nextcloud — talk	Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation passwords can be bypassed, as there was an endpoint validating the conversation password without registering bruteforce attempts. It is recommended that the Nextcloud Talk app is upgraded to 15.0.8, 16.0.6 or 17.1.1. There are no known workarounds for this vulnerability.	2023-10-16	4.3	CVE-2023-45149 MISC MISC MISC
opart — multi_html_block	Multiple Stored Cross Site Scripting (XSS) vulnerabilities in Opart opartmultihtmlblock before version 2.0.12 and Opart multihtmlblock* version 1.0.0, allows remote authenticated users to inject arbitrary web script or HTML via the body_text or body_text_rude field in /sourcefiles/BlockhtmlClass.php and /sourcefiles/blockhtml.php.	2023-10-14	5.4	CVE-2023-30148 MISC
opensearch — opensearch	OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable. This issue does not affect index data, only metadata. Dashboards correctly enforces read-only permissions when indexing and updating documents. This issue does not provide additional read access to data users don’t already have. This issue can be mitigated by disabling the tenant’s functionality for the cluster. Versions 1.3.14 and 2.11.0 contain a fix for this issue.	2023-10-16	5.4	CVE-2023-45807 MISC
oracle — analytics	Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Pod Admin). Supported versions that are affected are 6.4.0.0.0 and 7.0.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).	2023-10-17	5.4	CVE-2023-22082 MISC
oracle — analytics	Vulnerability in the BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 6.4.0.0.0 and 7.0.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher accessible data as well as unauthorized read access to a subset of BI Publisher accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).	2023-10-17	5.4	CVE-2023-22105 MISC
oracle — analytics	Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Dashboards). Supported versions that are affected are 6.4.0.0.0, 7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N).	2023-10-17	4.6	CVE-2023-22109 MISC
oracle — commerce	Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Workbench). The supported version that is affected is 11.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Guided Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Guided Search accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).	2023-10-17	6.1	CVE-2023-22029 MISC
oracle — communications	Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: Web UI). Supported versions that are affected are 9.0-9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Session Border Controller. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Enterprise Session Border Controller accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).	2023-10-17	4.3	CVE-2023-22083 MISC
oracle — communications	Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: User Management). Supported versions that are affected are 7.4.0 and 7.4.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Order and Service Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Order and Service Management accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).	2023-10-17	4.3	CVE-2023-22088 MISC
oracle — database_server	Vulnerability in the PL/SQL component of Oracle Database Server. Supported versions that are affected are 19.3-19.20 and 21.3-21.11. Easily exploitable vulnerability allows high privileged attacker having Create Session, Execute on sys.utl_http privilege with network access via Oracle Net to compromise PL/SQL. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PL/SQL, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PL/SQL accessible data as well as unauthorized read access to a subset of PL/SQL accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PL/SQL. CVSS 3.1 Base Score 5.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L).	2023-10-17	5.9	CVE-2023-22071 MISC
oracle — database_server	Vulnerability in the Oracle Database Recovery Manager component of Oracle Database Server. Supported versions that are affected are 19.3-19.20 and 21.3-21.11. Easily exploitable vulnerability allows high privileged attacker having DBA account privilege with network access via Oracle Net to compromise Oracle Database Recovery Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Database Recovery Manager. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22077 MISC
oracle — database_server	Vulnerability in the Oracle Notification Server component of Oracle Database Server. Supported versions that are affected are 19.3-19.20 and 21.3-21.11. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Notification Server executes to compromise Oracle Notification Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Notification Server accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).	2023-10-17	4.3	CVE-2023-22073 MISC
oracle — database_server	Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.20 and 21.3-21.11. Easily exploitable vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java VM accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).	2023-10-17	4.3	CVE-2023-22096 MISC
oracle — e-business_suite	Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Requisition and Vacancy). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iRecruitment. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iRecruitment accessible data as well as unauthorized read access to a subset of Oracle iRecruitment accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).	2023-10-17	6.5	CVE-2023-22093 MISC
oracle — e-business_suite	Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: API). Supported versions that are affected are ECC: 8, 9 and 10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Command Center Framework accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).	2023-10-17	6.5	CVE-2023-22106 MISC
oracle — e-business_suite	Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data as well as unauthorized read access to a subset of Oracle Applications Framework accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).	2023-10-17	6.1	CVE-2023-22076 MISC
oracle — e-business_suite	Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: UI Components). Supported versions that are affected are ECC: 8, 9 and 10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Command Center Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Command Center Framework accessible data as well as unauthorized read access to a subset of Oracle Enterprise Command Center Framework accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).	2023-10-17	6.1	CVE-2023-22107 MISC
oracle — financial_services_applications	Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.3, 12.4, 14.0-14.3 and 14.5-14.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Universal Banking. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).	2023-10-17	6.5	CVE-2023-22118 MISC
oracle — financial_services_applications	Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.3, 12.4, 14.0-14.3 and 14.5-14.7. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Universal Banking. CVSS 3.1 Base Score 5.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L).	2023-10-17	5.9	CVE-2023-22119 MISC
oracle — financial_services_applications	Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 14.5-14.7. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Banking Trade Finance accessible data as well as unauthorized update, insert or delete access to some of Oracle Banking Trade Finance accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Banking Trade Finance. CVSS 3.1 Base Score 5.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L).	2023-10-17	5.9	CVE-2023-22122 MISC
oracle — financial_services_applications	Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 12.3, 12.4, 14.0-14.3 and 14.5-14.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Universal Banking, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).	2023-10-17	5.4	CVE-2023-22117 MISC
oracle — financial_services_applications	Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 14.5-14.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Trade Finance accessible data as well as unauthorized read access to a subset of Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).	2023-10-17	5.4	CVE-2023-22121 MISC
oracle — financial_services_applications	Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 14.5-14.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Trade Finance, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Trade Finance accessible data as well as unauthorized read access to a subset of Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).	2023-10-17	5.4	CVE-2023-22123 MISC
oracle — financial_services_applications	Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 14.5-14.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Trade Finance, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Trade Finance accessible data as well as unauthorized read access to a subset of Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).	2023-10-17	5.4	CVE-2023-22124 MISC
oracle — financial_services_applications	Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 14.5-14.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Trade Finance, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Trade Finance accessible data as well as unauthorized read access to a subset of Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).	2023-10-17	5.4	CVE-2023-22125 MISC
oracle — fusion_middleware	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).	2023-10-17	5.3	CVE-2023-22126 MISC
oracle — fusion_middleware	Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Content Access SDK, Image Export SDK, PDF Export SDK, HTML Export SDK). The supported version that is affected is 8.5.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).	2023-10-17	6.3	CVE-2023-22127 MISC
oracle — java_se	Vulnerability in Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u381 and 8u381-perf. Easily exploitable vulnerability allows unauthenticated attacker with network access via CORBA to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).	2023-10-17	5.3	CVE-2023-22067 MISC
oracle — java_se	Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8 and 21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).	2023-10-17	5.3	CVE-2023-22081 MISC
oracle — java_se	Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle GraalVM for JDK: 17.0.8 and 21. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GraalVM for JDK accessible data as well as unauthorized read access to a subset of Oracle GraalVM for JDK accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).	2023-10-17	4.8	CVE-2023-22091 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	6.5	CVE-2023-22059 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	6.5	CVE-2023-22079 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). The supported version that is affected is 8.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	6.5	CVE-2023-22095 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.42 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22015 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.42 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22026 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.43 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22028 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22032 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22064 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22065 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22066 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22068 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22070 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22078 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.43 and prior, 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22084 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22092 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22097 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22103 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22104 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22110 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22111 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22112 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22114 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	4.9	CVE-2023-22115 MISC
oracle — peoplesoft	Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Events & Notifications). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).	2023-10-17	6.5	CVE-2023-22090 MISC
oracle — peoplesoft	Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).	2023-10-17	6.1	CVE-2023-22080 MISC
oracle — systems	Vulnerability in the Sun ZFS Storage Appliance product of Oracle Systems (component: Core). The supported version that is affected is 8.8.60. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Sun ZFS Storage Appliance. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	5.9	CVE-2023-22130 MISC
oracle — systems	Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. Note: This vunlerability only affects SPARC Systems. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).	2023-10-17	5.5	CVE-2023-22129 MISC
otrs — otrs	An attacker who is logged into OTRS as a user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved.The issue onlyoccurs if the configuration for AdminCustomerUser::UseAutoComplete was changed before. This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.	2023-10-16	5.5	CVE-2023-5421 MISC
otrs — otrs	The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retrieve the IP of the user. This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.	2023-10-16	5.3	CVE-2023-38059 MISC
pleroma — pleroma	A vulnerability was found in kphrx pleroma. It has been classified as problematic. This affects the function Pleroma.Emoji.Pack of the file lib/pleroma/emoji/pack.ex. The manipulation of the argument name leads to path traversal. The complexity of an attack is rather high. The exploitability is told to be difficult. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 2c795094535537a8607cc0d3b7f076a609636f40. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-242187.	2023-10-15	5.3	CVE-2023-5588 MISC MISC MISC MISC
portábilis — i-educar	A vulnerability was found in Portábilis i-Educar up to 2.7.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file intranetagenda_imprimir.php of the component HTTP GET Request Handler. The manipulation of the argument cod_agenda with the input “);’> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-242143. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-10-14	5.4	CVE-2023-5578 MISC MISC
qnap — quts_hero	A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network. QES is not affected. We have already fixed the vulnerability in the following versions: QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.0.2453 build 20230708 and later QuTS hero h4.5.4.2476 build 20230728 and later QuTScloud c5.1.0.2498 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later	2023-10-13	4.9	CVE-2023-32970 MISC
red_lion_europe/helmholz — multiple_products	In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limited, non-critical device information in his account he should not have access to.	2023-10-16	4.3	CVE-2023-4834 MISC MISC
saml — saml	github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting (XSS) in the IdP context during the redirection at the end of a SAML SSO Flow. Consequently, an attacker may perform any authenticated action as the victim once the victim’s browser loaded the SAML IdP initiated SSO link for the malicious service provider. Note: SP registration is commonly an unrestricted operation in IdPs, hence not requiring particular permissions or publicly accessible to ease the IdP interoperability. This issue is fixed in version 0.4.14. Users unable to upgrade may perform external validation of URLs provided in SAML metadata or restrict the ability for end-users to upload arbitrary metadata.	2023-10-16	6.1	CVE-2023-45683 MISC MISC
sonicwall — sonicos	SonicOS post-authentication stack-based buffer overflow vulnerability in the getBookmarkList.json URL endpoint leads to a firewall crash.	2023-10-17	6.5	CVE-2023-39276 MISC
sonicwall — sonicos	SonicOS post-authentication stack-based buffer overflow vulnerability in the sonicflow.csv and appflowsessions.csv URL endpoints leads to a firewall crash.	2023-10-17	6.5	CVE-2023-39277 MISC
sonicwall — sonicos	SonicOS post-authentication user assertion failure leads to Stack-Based Buffer Overflow vulnerability via main.cgi leads to a firewall crash.	2023-10-17	6.5	CVE-2023-39278 MISC
sonicwall — sonicos	SonicOS post-authentication Stack-Based Buffer Overflow vulnerability in the getPacketReplayData.json URL endpoint leads to a firewall crash.	2023-10-17	6.5	CVE-2023-39279 MISC
sonicwall — sonicos	SonicOS p ost-authentication Stack-Based Buffer Overflow vulnerability in the ssoStats-s.xml, ssoStats-s.wri URL endpoints leads to a firewall crash.	2023-10-17	6.5	CVE-2023-39280 MISC
sonicwall — sonicos	SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the sonicwall.exp, prefs.exp URL endpoints lead to a firewall crash.	2023-10-17	6.5	CVE-2023-41711 MISC
sonicwall — sonicos	SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the SSL VPN plainprefs.exp URL endpoint leads to a firewall crash.	2023-10-17	6.5	CVE-2023-41712 MISC
sourcecodester — medicine_tracker_system	A vulnerability classified as problematic was found in SourceCodester Medicine Tracker System 1.0. This vulnerability affects unknown code of the file index.php. The manipulation of the argument page leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-242146 is the identifier assigned to this vulnerability.	2023-10-14	6.1	CVE-2023-5581 MISC MISC MISC
sourcecodester– online_motorcycle_rental_system	A vulnerability was found in SourceCodester Online Motorcycle Rental System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/?page=bike of the component Bike List. The manipulation of the argument Model with the input “> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-242170 is the identifier assigned to this vulnerability.	2023-10-15	6.1	CVE-2023-5585 MISC MISC
spring — security	WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature counter value handling. A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected. This issue has been addressed in version `0.9.1.RELEASE`. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-16	5.3	CVE-2023-45669 MISC MISC MISC
urllib3 — urllib3	urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).	2023-10-15	6.1	CVE-2018-25091 MISC MISC MISC
user_registration_&_login_and_user_management_system — user_registration_&_login_and_user_management_system	Cross Site Scripting (XSS) vulnerability in Phpgurukul User Registration & Login and User Management System With admin panel 3.0 allows attackers to run arbitrary code via fname, lname, email, and contact fields of the user registration page.	2023-10-16	5.4	CVE-2023-40851 MISC
vrite — vrite	Allocation of Resources Without Limits or Throttling in GitHub repository vriteio/vrite prior to 0.3.0.	2023-10-13	6.5	CVE-2023-5573 MISC MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Arrow Plugins Social Feed \| Custom Feed for Social Media Networks plugin <= 2.2.0 versions.	2023-10-17	6.1	CVE-2023-45003 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Castos Seriously Simple Stats plugin <= 1.5.1 versions.	2023-10-17	6.1	CVE-2023-45005 MISC
wordpress — wordpress	The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users.	2023-10-16	6.5	CVE-2023-4800 MISC
wordpress — wordpress	The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin	2023-10-16	6.1	CVE-2023-4290 MISC
wordpress — wordpress	The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators	2023-10-16	6.1	CVE-2023-4620 MISC
wordpress — wordpress	The Page Builder: Pagelayer WordPress plugin before 1.7.7 doesn’t prevent unauthenticated attackers from updating a post’s header or footer code on scheduled posts.	2023-10-16	6.1	CVE-2023-4687 MISC
wordpress — wordpress	The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts.	2023-10-16	6.1	CVE-2023-4819 MISC
wordpress — wordpress	The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitize and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks	2023-10-16	6.1	CVE-2023-4950 MISC
wordpress — wordpress	The Hotjar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the hotjar_site_id in versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	2023-10-14	5.5	CVE-2023-1259 MISC MISC
wordpress — wordpress	The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks	2023-10-16	5.4	CVE-2023-3746 MISC
wordpress — wordpress	Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.	2023-10-13	5.4	CVE-2023-38000 MISC MISC MISC
wordpress — wordpress	The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks	2023-10-16	5.4	CVE-2023-4289 MISC
wordpress — wordpress	Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Robin Wilson bbp style pack plugin <= 5.6.7 versions.	2023-10-16	5.4	CVE-2023-44984 MISC
wordpress — wordpress	Auth. (contributo+) Stored Cross-Site Scripting (XSS) vulnerability in Cytech BuddyMeet plugin <= 2.2.0 versions.	2023-10-16	5.4	CVE-2023-44985 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 2.0.23 versions.	2023-10-13	5.4	CVE-2023-45269 MISC
wordpress — wordpress	Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Codedrafty Mediabay – Media Library Folders plugin <= 1.6 versions.	2023-10-16	5.4	CVE-2023-46066 MISC
wordpress — wordpress	The Simple Posts Ticker WordPress plugin before 1.1.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.	2023-10-16	5.4	CVE-2023-4646 MISC
wordpress — wordpress	The Magee Shortcodes WordPress plugin through 2.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.	2023-10-16	5.4	CVE-2023-4783 MISC
wordpress — wordpress	The Testimonial Slider Shortcode WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin	2023-10-16	5.4	CVE-2023-4795 MISC
wordpress — wordpress	The Tutor LMS WordPress plugin before 2.3.0 does not sanitize and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)	2023-10-16	5.4	CVE-2023-4805 MISC
wordpress — wordpress	The WordPress File Upload WordPress plugin before 4.23.3 does not sanitize and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.	2023-10-16	5.4	CVE-2023-4811 MISC
wordpress — wordpress	The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.	2023-10-16	5.4	CVE-2023-4820 MISC
wordpress — wordpress	The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.1 does not filter all potentially dangerous file extensions. Therefore, an attacker can upload unsafe .shtml or .svg files containing malicious scripts.	2023-10-16	5.4	CVE-2023-4821 MISC
wordpress — wordpress	The Embed Calendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘calendly’ shortcode in versions up to, and including, 3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-13	5.4	CVE-2023-4995 MISC MISC
wordpress — wordpress	The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contributor and above to perform Stored XSS attacks	2023-10-16	5.4	CVE-2023-5057 MISC
wordpress — wordpress	The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn’t prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post’s header or footer code.	2023-10-16	5.4	CVE-2023-5087 MISC
wordpress — wordpress	The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard, which may allow visitors to conduct Stored Cross-Site Scripting attacks.	2023-10-16	5.4	CVE-2023-5167 MISC
wordpress — wordpress	The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.	2023-10-16	5.3	CVE-2023-4933 MISC
wordpress — wordpress	The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.	2023-10-16	5.3	CVE-2023-5089 MISC MISC
wordpress — wordpress	The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 exposes the full path of a file when putting in a non-existent file in a parameter of the shortcode.	2023-10-16	5.3	CVE-2023-5177 MISC
wordpress — wordpress	The Popup Builder WordPress plugin through 4.1.15 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	2023-10-16	5.3	CVE-2023-5561 MISC MISC
wordpress — wordpress	The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks	2023-10-16	4.9	CVE-2023-3279 MISC
wordpress — wordpress	The EventON WordPress plugin before 2.2 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)	2023-10-16	4.8	CVE-2023-4388 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Tiny Carousel Horizontal Slider plugin <= 8.1 versions.	2023-10-16	4.8	CVE-2023-44229 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tyche Software’s Abandoned Cart Lite for WooCommerce plugin <= 5.15.2 versions.	2023-10-16	4.8	CVE-2023-44986 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Timely – Appointment software Timely Booking Button plugin <= 2.0.2 versions.	2023-10-16	4.8	CVE-2023-44987 MISC
wordpress — wordpress	The Simple Posts Ticker WordPress plugin before 1.1.6 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)	2023-10-16	4.8	CVE-2023-4725 MISC
wordpress — wordpress	The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users.	2023-10-16	4.8	CVE-2023-4862 MISC
wordpress — wordpress	The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post (such as draft and private) via an IDOR vector	2023-10-16	4.3	CVE-2023-3706 MISC
wordpress — wordpress	The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the content of arbitrary post (such as draft and private) via an IDOR vector. Password protected posts are not affected by this issue.	2023-10-16	4.3	CVE-2023-3707 MISC
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38.	2023-10-13	4.3	CVE-2023-39999 MISC MISC
yzh66 — sandbox	A vulnerability was found in yhz66 Sandbox 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /im/user/ of the component User Data Handler. The manipulation leads to information disclosure. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-242144.	2023-10-14	6.5	CVE-2023-5579 MISC MISC MISC
zzzcms — zzzcms	A vulnerability, which was classified as problematic, has been found in ZZZCMS 2.2.0. This issue affects some unknown processing of the component Personal Profile Page. The manipulation leads to basic cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-242147.	2023-10-14	5.4	CVE-2023-5582 MISC MISC MISC

Low Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
discourse — discourse	Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` endpoint to view the content of options in the poll and the number of votes for groups of poll participants. This impacts private polls where the results were intended to only be viewable by authorized users. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. There is no workaround for this issue apart from upgrading to the fixed version.	2023-10-16	3.7	CVE-2023-43814 MISC
hp — e22_g4_fhd_firmware	A potential security vulnerability has been identified in certain HP Displays supporting the Theft Deterrence feature which may allow a monitor’s Theft Deterrence to be deactivated.	2023-10-13	3.3	CVE-2023-5449 MISC
oracle — database_server	Vulnerability in the Oracle Database Sharding component of Oracle Database Server. Supported versions that are affected are 19.3-19.20 and 21.3-21.11. Easily exploitable vulnerability allows high privileged attacker having Create Session, Select Any Dictionary privilege with network access via Oracle Net to compromise Oracle Database Sharding. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Database Sharding. CVSS 3.1 Base Score 2.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L).	2023-10-17	2.4	CVE-2023-22074 MISC
oracle — database_server	Vulnerability in the Oracle Database Sharding component of Oracle Database Server. Supported versions that are affected are 19.3-19.20 and 21.3-21.11. Easily exploitable vulnerability allows high privileged attacker having Create Session, Create Any View, Select Any Table privilege with network access via Oracle Net to compromise Oracle Database Sharding. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Database Sharding. CVSS 3.1 Base Score 2.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L).	2023-10-17	2.4	CVE-2023-22075 MISC
oracle — java_se	Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u381-perf, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8 and 21. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).	2023-10-17	3.7	CVE-2023-22025 MISC
oracle — mysql	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).	2023-10-17	2.7	CVE-2023-22113 MISC
oracle — systems	Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via rquota to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).	2023-10-17	3.1	CVE-2023-22128 MISC
wago — multiple_products	On affected Wago products a remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.	2023-10-17	2.7	CVE-2023-4089 MISC

Severity Not Yet Assigned

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
advantech — r-seenet	Advantech R-SeeNet v2.4.23 allows an unauthenticated remote attacker to read from and write to the snmpmon.ini file, which contains sensitive information.	2023-10-18	not yet calculated	CVE-2023-5642 MISC
amd — radeon(tm)_graphics_driver	An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over arbitrary hardware ports or physical addresses resulting in a potential arbitrary code execution.	2023-10-17	not yet calculated	CVE-2023-20598 MISC
apache — inlong	Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can use t to bypass. Users are advised to upgrade to Apache InLong’s 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8814	2023-10-19	not yet calculated	CVE-2023-46227 MISC
apache — santuario-xml_security_for_java	All versions of Apache Santuario – XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.	2023-10-20	not yet calculated	CVE-2023-44483 MISC MISC
apache — shenyu	There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arbitrary requests and retrieve corresponding responses by inputting any URL into the requestUrl parameter. Of particular concern is our ability to exert control over the HTTP method, cookies, IP address, and headers. This effectively grants us the capability to dispatch complete HTTP requests to hosts of our choosing. This issue affects Apache ShenYu: 2.5.1. Upgrade to Apache ShenYu 2.6.0 or apply patch https://github.com/apache/shenyu/pull/4776.	2023-10-19	not yet calculated	CVE-2023-25753 MISC
apollo_router — apollo_router	The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response.	2023-10-18	not yet calculated	CVE-2023-45812 MISC MISC
archer_technologies_llc. — archer_platform	Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensitive information via a popup warning message. 6.14 (6.14.0) is also a fixed release.	2023-10-17	not yet calculated	CVE-2023-45357 MISC
archer_technologies_llc. — archer_platform	Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 (6.14.0) is also a fixed release.	2023-10-17	not yet calculated	CVE-2023-45358 MISC
archivebox — archivebox	ArchiveBox is an open source self-hosted web archiving system. Any users who are using the `wget` extractor and view the content it outputs. The impact is potentially severe if you are logged in to the ArchiveBox admin site in the same browser session and view an archived malicious page designed to target your ArchiveBox instance. Malicious Javascript could potentially act using your logged-in admin credentials and add/remove/modify snapshots, add/remove/modify ArchiveBox users, and generally do anything an admin user could do. The impact is less severe for non-logged-in users, as malicious Javascript cannot modify any archives, but it can still read all the other archived content by fetching the snapshot index and iterating through it. Because all of ArchiveBox’s archived content is served from the same host and port as the admin panel, when archived pages are viewed the JS executes in the same context as all the other archived pages (and the admin panel), defeating most of the browser’s usual CORS/CSRF security protections and leading to this issue. A patch is being developed in https://github.com/ArchiveBox/ArchiveBox/issues/239. As a mitigation for this issue would be to disable the wget extractor by setting `archivebox config –set SAVE_WGET=False`, ensure you are always logged out, or serve only a [static HTML version](https://github.com/ArchiveBox/ArchiveBox/wiki/Publishing-Your-Archive#2-export-and-host-it-as-static-html) of your archive.	2023-10-19	not yet calculated	CVE-2023-45815 MISC MISC
arduino — arduino-create-agent	Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this issue.	2023-10-18	not yet calculated	CVE-2023-43800 MISC
arduino — arduino-create-agent	Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP DELETE request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this issue.	2023-10-18	not yet calculated	CVE-2023-43801 MISC
arduino — arduino-create-agent	Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/upload` which handles request with the `filename` parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate their privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-18	not yet calculated	CVE-2023-43802 MISC
arduino — arduino-create-agent	Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-18	not yet calculated	CVE-2023-43803 MISC
artifact_hub — artifact_hub	Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub’s code base a security researcher identified a bug in which the `registryIsDockerHub` function was only checking that the registry domain had the `docker.io` suffix. Artifact Hub allows providing some Docker credentials that are used to increase the rate limit applied when interacting with the Docker Hub registry API to read publicly available content. Due to the incorrect check described above, it’d be possible to hijack those credentials by purchasing a domain which ends with `docker.io` and deploying a fake OCI registry on it. uses some credentials that only have permissions to read public content available in the Docker Hub. However, even though credentials for private repositories (disabled on `artifacthub.io`) are handled in a different way, other Artifact Hub deployments could have been using them for a different purpose. This issue has been resolved in version `1.16.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-19	not yet calculated	CVE-2023-45821 MISC MISC
artifact_hub — artifact_hub	Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub’s code base a security researcher identified a bug in which a default unsafe rego built-in was allowed to be used when defining authorization policies. Artifact Hub includes a fine-grained authorization mechanism that allows organizations to define what actions can be performed by their members. It is based on customizable authorization policies that are enforced by the `Open Policy Agent`. Policies are written using `rego` and their data files are expected to be json documents. By default, `rego` allows policies to make HTTP requests, which can be abused to send requests to internal resources and forward the responses to an external entity. In the context of Artifact Hub, this capability should have been disabled. This issue has been resolved in version `1.16.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-19	not yet calculated	CVE-2023-45822 MISC MISC MISC MISC
artifact_hub — artifact_hub	Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub’s code base a security researcher identified a bug in which by using symbolic links in certain kinds of repositories loaded into Artifact Hub, it was possible to read internal files. Artifact Hub indexes content from a variety of sources, including git repositories. When processing git based repositories, Artifact Hub clones the repository and, depending on the artifact kind, reads some files from it. During this process, in some cases, no validation was done to check if the file was a symbolic link. This made possible to read arbitrary files in the system, potentially leaking sensitive information. This issue has been resolved in version `1.16.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-19	not yet calculated	CVE-2023-45823 MISC MISC
baker_hughes_co. — bently_nevada_3500_system	Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device.	2023-10-19	not yet calculated	CVE-2023-34437 MISC
baker_hughes_co. — bently_nevada_3500_system	Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests.	2023-10-19	not yet calculated	CVE-2023-34441 MISC
baker_hughes_co. — bently_nevada_3500_system	Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a replay vulnerability which could allow an attacker to replay older captured packets of traffic to the device to gain access.	2023-10-19	not yet calculated	CVE-2023-36857 MISC
bunkum — bunkum	Bunkum is an open-source protocol-agnostic request server for custom game servers. First, a little bit of background. So, in the beginning, Bunkum’s `AuthenticationService` only supported injecting `IUser`s. However, as Refresh and SoundShapesServer implemented permissions systems support for injecting `IToken`s into endpoints was added. All was well until 4.0. Bunkum 4.0 then changed to enforce relations between `IToken`s and `IUser`s. This wasn’t implemented in a very good way in the `AuthenticationService` and ended up breaking caching in such a way that cached tokens would persist after the lifetime of the request – since we tried to cache both tokens and users. From that point until now, from what I understand, Bunkum was attempting to use that cached token at the start of the next request once cached. Naturally, when that token expired, downstream projects like Refresh would remove the object from Realm – and cause the object in the cache to be in a detached state, causing an exception from invalid use of `IToken.User`. A use-after-free since Realm can’t manage the lifetime of the cached token. Security-wise, the scope is fairly limited, can only be pulled off on a couple endpoints given a few conditions, and you can’t guarantee which token you’re going to get. Also, the token would get invalidated properly if the endpoint had either a `IToken` usage or a `IUser` usage. The fix is to just wipe the token cache after the request was handled, which is now in `4.2.1`. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-18	not yet calculated	CVE-2023-45814 MISC MISC
byzoro — smart_s45f_firmware	A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btn_file_renew leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243059. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-10-21	not yet calculated	CVE-2023-5683 MISC MISC MISC
byzoro — smart_s45f_firmware	A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /importexport.php. The manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243061 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-10-21	not yet calculated	CVE-2023-5684 MISC MISC MISC
cisco — catalyst_sd-wan_manager	A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve arbitrary files from an affected system. This vulnerability is due to improper validation of parameters that are sent to the web UI. An attacker could exploit this vulnerability by logging in to Cisco Catalyst SD-WAN Manager and issuing crafted requests using the web UI. A successful exploit could allow the attacker to obtain arbitrary files from the underlying Linux file system of an affected system. To exploit this vulnerability, the attacker must be an authenticated user.	2023-10-18	not yet calculated	CVE-2023-20261 MISC
cisco — ios_xe	Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software when exposed to the internet or to untrusted networks. This vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access. The attacker can then use that account to gain control of the affected system. For steps to close the attack vector for this vulnerability, see the Recommendations section of this advisory. Cisco will provide updates on the status of this investigation and when a software patch is available.	2023-10-16	not yet calculated	CVE-2023-20198 MISC MISC MISC
cmsmadesimple — cmsmadesimple	Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in the news menu component.	2023-10-20	not yet calculated	CVE-2023-43353 MISC
cmsmadesimple — cmsmadesimple	Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions -MicroTiny WYSIWYG editor component.	2023-10-20	not yet calculated	CVE-2023-43354 MISC
cmsmadesimple — cmsmadesimple	Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again parameters in the My Preferences – Add user component.	2023-10-20	not yet calculated	CVE-2023-43355 MISC MISC
cmsmadesimple — cmsmadesimple	Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata parameter in the Global Settings Menu component.	2023-10-20	not yet calculated	CVE-2023-43356 MISC
cmsmadesimple — cmsmadesimple	Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the Manage Shortcuts component.	2023-10-20	not yet calculated	CVE-2023-43357 MISC
cmsmadesimple — cmsmadesimple	Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data parameters in the Content Manager Menu component.	2023-10-19	not yet calculated	CVE-2023-43359 MISC
connected_vehicle_systems_alliance — connected_vehicle_systems_alliance	Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 was discovered to contain a buffer overflow via the component /shared/dlt_common.c.	2023-10-17	not yet calculated	CVE-2023-36321 MISC MISC
curl — curl	This flaw makes curl overflow a heap-based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means “let the host resolve the name” could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap-based buffer, and the host name coming from the URL that curl has been told to operate with.	2023-10-18	not yet calculated	CVE-2023-38545 MISC
curl — curl	This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates “easy handles” that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned – but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` – if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.	2023-10-18	not yet calculated	CVE-2023-38546 MISC
dexma — dexgate	The affected product is vulnerable to a cross-site scripting vulnerability, which could allow an attacker to access the web application to introduce arbitrary Java Script by injecting an XSS payload into the ‘hostname’ parameter of the vulnerable software.	2023-10-19	not yet calculated	CVE-2023-40153 MISC
dexma — dexgate	The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker with access to the network, where clients have access to the DexGate server, could capture traffic. The attacker can later us the information within it to access the application.	2023-10-19	not yet calculated	CVE-2023-41088 MISC
dexma — dexgate	The affected product is vulnerable to an improper authentication vulnerability, which may allow an attacker to impersonate a legitimate user as long as the device keeps the session active, since the attack takes advantage of the cookie header to generate “legitimate” requests.	2023-10-19	not yet calculated	CVE-2023-41089 MISC
dexma — dexgate	The affected product is vulnerable to a cross-site request forgery vulnerability, which may allow an attacker to perform actions with the permissions of a victim user.	2023-10-19	not yet calculated	CVE-2023-42435 MISC
dexma — dexgate	The affected product is vulnerable to an exposure of sensitive information to an unauthorized actor vulnerability, which may allow an attacker to create malicious requests for obtaining the information of the version about the web server used.	2023-10-19	not yet calculated	CVE-2023-42666 MISC
directus– directus	Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus. This issue has been addressed in version 10.6.2. Users are advised to upgrade. Users unable to upgrade should avoid using websockets.	2023-10-19	not yet calculated	CVE-2023-45820 MISC MISC
discourse — discourse	Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins use topic custom fields. For a default Discourse installation with the default plugins, this vulnerability has no impact. The problem has been patched in the latest version of Discourse. Users are advised to update to version 3.1.1 if they are on the stable branch or 3.2.0.beta2 if they are on the beta branch. Users unable to upgrade should disable any plugins that access topic custom fields.	2023-10-16	not yet calculated	CVE-2023-45147 MISC
dotcms — dotcms	In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses for XSS and access controls. An example affected URL is https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp , which should return a 404 response but didn’t. The oversight in the default invalid URL character list can be viewed at the provided GitHub link https://github.com/dotCMS/core/blob/master/dotCMS/src/main/java/com/dotcms/filters/NormalizationFilter.java#L37. To mitigate, users can block URLs with double slashes at firewalls or utilize dotCMS config variables. Specifically, they can use the DOT_URI_NORMALIZATION_FORBIDDEN_STRINGS environmental variable to add // to the list of invalid strings. Additionally, the DOT_URI_NORMALIZATION_FORBIDDEN_REGEX variable offers more detailed control, for instance, to block //html.* URLs. Fix Version:23.06+, LTS 22.03.7+, LTS 23.01.4+	2023-10-17	not yet calculated	CVE-2023-3042 MISC
eaton — easye4_plc	Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card (*.PRG file ending).	2023-10-17	not yet calculated	CVE-2023-43776 MISC
eaton — easysoft	Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. This software has a password protection functionality to secure the project file from unauthorized access. This password was being stored insecurely and could be retrieved by skilled adversaries.	2023-10-17	not yet calculated	CVE-2023-43777 MISC
eclipse — mosquito	In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6	2023-10-18	not yet calculated	CVE-2023-5632 MISC MISC
engelsystem — engelsystem	Engelsystem is a shift planning system for chaos events. If a users’ password is compromised and an attacker gained access to a users’ account, i.e., logged in and obtained a session, an attackers’ session is not terminated if the users’ account password is reset. This vulnerability has been fixed in the commit `dbb089315ff3d`. Users are advised to update their installations. There are no known workarounds for this vulnerability.	2023-10-17	not yet calculated	CVE-2023-45659 MISC MISC
engelsystem — engelsystem	Engelsystem is a shift planning system for chaos events. A Blind SSRF in the “Import schedule” functionality makes it possible to perform a port scan against the local environment. This vulnerability has been fixed in commit ee7d30b33. If a patch cannot be deployed, operators should ensure that no HTTP(s) services listen on localhost and/or systems only reachable from the host running the engelsystem software. If such services are necessary, they should utilize additional authentication.	2023-10-17	not yet calculated	CVE-2023-45152 MISC MISC
eprosima — fast_dds	Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA sub messages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attacker’s control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-16	not yet calculated	CVE-2023-42459 MISC MISC MISC
esst_monitoring — esst_monitoring	A lack of input sanitizing in the file download feature of eSST Monitoring v2.147.1 allows attackers to execute a path traversal.	2023-10-17	not yet calculated	CVE-2023-41629 MISC
esst_monitoring — esst_monitoring	eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the Gii code generator component.	2023-10-17	not yet calculated	CVE-2023-41630 MISC
esst_monitoring — esst_monitoring	eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the file upload function.	2023-10-17	not yet calculated	CVE-2023-41631 MISC
etsi — tetra_standard	A flaw in the TETRA authentication procedure allows a MITM adversary that can predict the MS challenge RAND2 to set session key DCK to zero.	2023-10-19	not yet calculated	CVE-2022-24400 MISC
etsi — tetra_standard	Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame counters, which are frequently broadcast by the infrastructure in an unauthenticated manner. An active adversary can manipulate the view of these counters in a mobile station, provoking keystream re-use. By sending crafted messages to the MS and analyzing MS responses, keystream for arbitrary frames can be recovered.	2023-10-19	not yet calculated	CVE-2022-24401 MISC
etsi — tetra_standard	The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystream generation phase, which is insufficient to safeguard against exhaustive search attacks.	2023-10-19	not yet calculated	CVE-2022-24402 MISC
etsi — tetra_standard	Lack of cryptographic integrity check on TETRA air-interface encrypted traffic. Since a stream cipher is employed, this allows an active adversary to manipulate cleartext data in a bit-by-bit fashion.	2023-10-19	not yet calculated	CVE-2022-24404 MISC
evolution _evo — evolution _evo	Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter.	2023-10-19	not yet calculated	CVE-2023-43341 MISC MISC
evolution — evolution	Cross-site scripting (XSS) vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword and cmspasswordconfim parameters	2023-10-19	not yet calculated	CVE-2023-43340 MISC MISC
expense_management_system — expense_management_system	An issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploaded to the sign-up.php component.	2023-10-17	not yet calculated	CVE-2023-44824 MISC MISC
extreme_networks_switch_engine — extreme_networks_switch_engine	Cross Site Request Forgery (CSRF) vulnerability in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 allows attackers to run arbitrary code and cause other unspecified impacts via /jsonrpc API.	2023-10-16	not yet calculated	CVE-2023-43118 MISC
extreme_networks_switch_engine — extreme_networks_switch_engine	An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to gain escalated privileges using crafted telnet commands via Redis server.	2023-10-16	not yet calculated	CVE-2023-43119 MISC
extreme_networks_switch_engine — extreme_networks_switch_engine	An issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7 and before 31.7.1 allows attackers to gain escalated privileges via crafted HTTP request.	2023-10-16	not yet calculated	CVE-2023-43120 MISC
extreme_networks_switch_engine — extreme_networks_switch_engine	A Directory Traversal vulnerability discovered in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7, and before 31.7.2 allows attackers to read arbitrary files.	2023-10-16	not yet calculated	CVE-2023-43121 MISC
fiber — fiber	Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user’s behalf, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This vulnerability has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes.	2023-10-16	not yet calculated	CVE-2023-45141 MISC
fortinet — fortianalyzer/fortimanager	A server-side request forgery vulnerability [CWE-918] in Fortinet FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 and FortiManager version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 allows a remote attacker with low privileges to view sensitive data from internal servers or perform a local port scan via a crafted HTTP request.	2023-10-20	not yet calculated	CVE-2023-44256 MISC MISC
getsimplecms — getsimplecms	An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo().	2023-10-19	not yet calculated	CVE-2023-46042 MISC
gifsicle-1.94 — gifsicle-1.94	gifsicle-1.94 was found to have a floating point exception (FPE) vulnerability via resize_stream at src/xform.c.	2023-10-18	not yet calculated	CVE-2023-46009 MISC
go-ethereum — go-ethereum	Geth (aka go-ethereum) through 1.13.4, when –http –graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor’s position is that the “graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic.	2023-10-18	not yet calculated	CVE-2023-42319 MISC MISC
google — android	In multiple functions of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-18	not yet calculated	CVE-2023-35656 MISC
google — android	In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.	2023-10-18	not yet calculated	CVE-2023-35663 MISC
grafana — grafana	Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts. However, the restriction can be bypassed used punycode encoding of the characters in the request address.	2023-10-17	not yet calculated	CVE-2023-4399 MISC
hcl_software — hcl_appscan	An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gain elevated privileges.	2023-10-17	not yet calculated	CVE-2023-37537 MISC
hcl_software — hcl_compass	HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user’s web browser.	2023-10-18	not yet calculated	CVE-2023-37502 MISC
hcl_software — hcl_compass	HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.	2023-10-19	not yet calculated	CVE-2023-37503 MISC
hcl_software — hcl_compass	HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called. If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.	2023-10-19	not yet calculated	CVE-2023-37504 MISC
hewlett_packard_enterprise — hpe_integrated_lights-out	HPE Integrated Lights-Out 5, and Integrated Lights-Out 6 using iLOrest may cause denial of service.	2023-10-18	not yet calculated	CVE-2023-30911 MISC
home_assistant — home_assistant	Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `client_id` are alterable when logging in. Consequently, the code parameter utilized to fetch the `access_token` post-authentication will be sent to the URL specified in the aforementioned parameters. Since an arbitrary URL is permitted and `homeassistant.local` represents the preferred, default domain likely used and trusted by many users, an attacker could leverage this weakness to manipulate a user and retrieve account access. Notably, this attack strategy is plausible if the victim has exposed their Home Assistant to the Internet, since after acquiring the victim’s `access_token` the adversary would need to utilize it directly towards the instance to achieve any pertinent malicious actions. To achieve this compromise attempt, the attacker must send a link with a `redirect_uri` that they control to the victim’s own Home Assistant instance. In the eventuality the victim authenticates via said link, the attacker would obtain code sent to the specified URL in `redirect_uri`, which can then be leveraged to fetch an `access_token`. Pertinently, an attacker could increase the efficacy of this strategy by registering a near identical domain to `homeassistant.local`, which at first glance may appear legitimate and thereby obfuscate any malicious intentions. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-20	not yet calculated	CVE-2023-41893 MISC MISC
home_assistant — home_assistant	Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable via the `*.ui.nabu.casa` URL without authentication, even when the webhook is marked as Only accessible from the local network. This issue is facilitated by the SniTun proxy, which sets the source address to 127.0.0.1 on all requests sent to the public URL and forwarded to the local Home Assistant. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-20	not yet calculated	CVE-2023-41894 MISC MISC
home_assistant — home_assistant	Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials and log in to another website that specifies the `redirect_uri` and `client_id` parameters. Although the `redirect_uri` validation typically ensures that it matches the `client_id` and the scheme represents either `http` or `https`, Home Assistant will fetch the `client_id` and check for `` HTML tags on the page. These URLs are not subjected to the same scheme validation and thus allow for arbitrary JavaScript execution on the Home Assistant administration page via usage of `javascript:` scheme URIs. This Cross-site Scripting (XSS) vulnerability can be executed on the Home Assistant frontend domain, which may be used for a full takeover of the Home Assistant account and installation. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-19	not yet calculated	CVE-2023-41895 MISC
home_assistant — home_assistant	Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_callback=1`, which is leveraged by the WebSocket authentication logic in tandem with the `state` parameter. The state parameter contains the `hassUrl`, which is subsequently utilized to establish a WebSocket connection. This behavior permits an attacker to create a malicious Home Assistant link with a modified state parameter that forces the frontend to connect to an alternative WebSocket backend. Henceforth, the attacker can spoof any WebSocket responses and trigger cross site scripting (XSS). Since the XSS is executed on the actual Home Assistant frontend domain, it can connect to the real Home Assistant backend, which essentially represents a comprehensive takeover scenario. Permitting the site to be iframed by other origins, as discussed in GHSA-935v-rmg9-44mw, renders this exploit substantially covert since a malicious website can obfuscate the compromise strategy in the background. However, even without this, the attacker can still send the `auth_callback` link directly to the victim user. To mitigate this issue, Cure53 advises modifying the WebSocket code’s authentication flow. An optimal implementation in this regard would not trust the `hassUrl` passed in by a GET parameter. Cure53 must stipulate the significant time required of the Cure53 consultants to identify an XSS vector, despite holding full control over the WebSocket responses. In many areas, data from the WebSocket was properly sanitized, which hinders post-exploitation. The audit team eventually detected the `js_url` for custom panels, though generally, the frontend exhibited reasonable security hardening. This issue has been addressed in Home Assistant Core version 2023.8.0 and in the npm package home-assistant-js-websocket in version 8.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-19	not yet calculated	CVE-2023-41896 MISC MISC
home_assistant — home_assistant	Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which specifies whether the web page is allowed to be framed. The omission of this and correlating headers facilitates covert clickjacking attacks and alternative exploit opportunities, such as the vector described in this security advisory. This fault incurs major risk, considering the ability to trick users into installing an external and malicious add-on with minimal user interaction, which would enable Remote Code Execution (RCE) within the Home Assistant application. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-19	not yet calculated	CVE-2023-41897 MISC MISC MISC
home_assistant — home_assistant	Home assistant is an open source home automation. In affected versions the `hassio.addon_stdin` is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service (e.g.: through GHSA-h2jp-7grc-9xpp) may be able to invoke any Supervisor REST API endpoints with a POST request. An attacker able to exploit will be able to control the data dictionary, including its addon and input key/values. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-162`.	2023-10-19	not yet calculated	CVE-2023-41899 MISC MISC
home_assistant — home_assistant_companion_for_android	Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-142`.	2023-10-19	not yet calculated	CVE-2023-41898 MISC
home_assistant — home_assistant_companion_for_ios	The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistant installation. Combined with this security advisory, may result in full compromise and remote code execution (RCE). Version 2023.7 addresses this issue and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: GHSL-2023-161.	2023-10-19	not yet calculated	CVE-2023-44385 MISC
hp_inc. — multiple_products	A potential security vulnerability has been identified in the system BIOS for certain HP PC products which might allow escalation of privilege. HP is releasing firmware updates to mitigate the potential vulnerability.	2023-10-18	not yet calculated	CVE-2023-26300 MISC
i-doit_pro — i-doit_pro	I-doit pro 25 and below is vulnerable to Cross Site Scripting (XSS) via index.php.	2023-10-21	not yet calculated	CVE-2023-46003 MISC MISC
ichitaro_2023 — ichitaro_2023	An out-of-bounds write vulnerability exists within the parsers for both the “DocumentViewStyles” and “DocumentEditStyles” streams of Ichitaro 2023 1.0.1.59372 when processing types 0x0000-0x0009 of a style record with the type 0x2008. A specially crafted document can cause memory corruption, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.	2023-10-19	not yet calculated	CVE-2023-35126 MISC MISC MISC
ichitaro_2023 — ichitaro_2023	An integer overflow exists in the “HyperLinkFrame” stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause the parser to make an under-sized allocation, which can later allow for memory corruption, potentially resulting in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.	2023-10-19	not yet calculated	CVE-2023-38127 MISC MISC
ichitaro_2023 — ichitaro_2023	An out-of-bounds write vulnerability exists in the “HyperLinkFrame” stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause a type confusion, which can lead to memory corruption and eventually arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.	2023-10-19	not yet calculated	CVE-2023-38128 MISC MISC MISC
ichitaro_2023 — ichitaro_2023	A use-after-free vulnerability exists in the Figure stream parsing functionality of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause memory corruption, resulting in arbitrary code execution. Victim would need to open a malicious file to trigger this vulnerability.	2023-10-19	not yet calculated	CVE-2023-34366 MISC MISC
insyde — insydeh2o	An issue was discovered in TrEEConfigDriver in Insyde InsydeH2O with kernel 5.0 through 5.5. It can report false TPM PCR values, and thus mask malware activity. Devices use Platform Configuration Registers (PCRs) to record information about device and software configuration to ensure that the boot process is secure. (For example, Windows uses these PCR measurements to determine device health.) A vulnerable device can masquerade as a healthy device by extending arbitrary values into Platform Configuration Register (PCR) banks. This requires physical access to a target victim’s device, or compromise of user credentials for a device. This issue is similar to CVE-2021-42299 (on Surface Pro devices).	2023-10-19	not yet calculated	CVE-2023-30633 MISC MISC
ivanti — endpoint_manager	Allows an authenticated attacker with network access to read arbitrary files on Endpoint Manager recently discovered on 2022 SU3 and all previous versions potentially leading to the leakage of sensitive information.	2023-10-18	not yet calculated	CVE-2023-35083 MISC
ivanti — endpoint_manager	Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which could allow an attacker to execute commands remotely.	2023-10-18	not yet calculated	CVE-2023-35084 MISC
ixp_data — easy_install	An issue found in IXP Data Easy Install 6.6.148840 allows a remote attacker to escalate privileges via insecure PRNG.	2023-10-19	not yet calculated	CVE-2023-27791 MISC
ixp_data — easy_install	An issue found in IXP Data Easy Install v.6.6.14884.0 allows an attacker to escalate privileges via lack of permissions applied to sub directories.	2023-10-19	not yet calculated	CVE-2023-27792 MISC
ixp_data — easy_install	An issue discovered in IXP Data Easy Install v.6.6.14884.0 allows local attackers to gain escalated privileges via weak encoding of sensitive information.	2023-10-19	not yet calculated	CVE-2023-27793 MISC
ixp_data — easy_install	An issue found in IXP Data Easy Install v.6.6.14884.0 allows a local attacker to gain privileges via a static XOR key.	2023-10-19	not yet calculated	CVE-2023-27795 MISC
ixp_data — easy_install	An issue discovered in IXP EasyInstall 6.6.14884.0 allows attackers to run arbitrary commands, gain escalated privilege, and cause other unspecified impacts via unauthenticated API calls.	2023-10-19	not yet calculated	CVE-2023-30131 MISC
ixp_data — easy_install	An issue discovered in IXP Data EasyInstall 6.6.14907.0 allows attackers to gain escalated privileges via static Cryptographic Key.	2023-10-19	not yet calculated	CVE-2023-30132 MISC
kaibutsunosato — kaibutsunosato	The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.	2023-10-20	not yet calculated	CVE-2023-39731 MISC
knowband — supercheckout	KnowBand supercheckout > 5.0.7 and < 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module “Module One Page Checkout, Social Login & Mailchimp” (supercheckout), a guest can upload files with extensions .php	2023-10-19	not yet calculated	CVE-2023-45384 MISC MISC
langchain — langchain	In Langchain through 0.0.155, prompt injection allows execution of arbitrary code against the SQL service provided by the chain.	2023-10-20	not yet calculated	CVE-2023-32785 MISC
langchain — langchain	In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.	2023-10-20	not yet calculated	CVE-2023-32786 MISC
langchain — langchain	LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.	2023-10-19	not yet calculated	CVE-2023-46229 MISC MISC
leantime — leantime	Leantime is an open source project management system. A ‘userId’ variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-19	not yet calculated	CVE-2023-45826 MISC MISC
liferay_inc. — portal/dxp	Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_translation_web_internal_portlet_TranslationPortlet_redirect` parameter.	2023-10-17	not yet calculated	CVE-2023-42497 MISC
liferay_inc. — portal/dxp	Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping Address 3, (6) Shipping Zip, (7) Shipping City, (8) Shipping Region (9), Shipping Country, (10) Billing Name, (11) Billing Phone Number, (12) Billing Address, (13) Billing Address 2, (14) Billing Address 3, (15) Billing Zip, (16) Billing City, (17) Billing Region, (18) Billing Country, or (19) Region Code.	2023-10-17	not yet calculated	CVE-2023-42627 MISC
liferay_inc. — portal/dxp	Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page’s ‘Content’ text field.	2023-10-17	not yet calculated	CVE-2023-42628 MISC
liferay_inc. — portal/dxp	Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary’s ‘description’ text field.	2023-10-17	not yet calculated	CVE-2023-42629 MISC
liferay_inc. — portal/dxp	Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into any non-HTML field of a linked source asset.	2023-10-17	not yet calculated	CVE-2023-44309 MISC
liferay_inc. — portal/dxp	Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page’s “Name” text field.	2023-10-17	not yet calculated	CVE-2023-44310 MISC
liferay_inc. — portal/dxp	Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module’s OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.	2023-10-17	not yet calculated	CVE-2023-44311 MISC
lylme_spage — lylme_spage	lylme_spage v1.7.0 was discovered to contain a SQL injection vulnerability via the userip parameter at function.php.	2023-10-17	not yet calculated	CVE-2023-45951 MISC
lylme_spage — lylme_spage	An arbitrary file upload vulnerability in the component ajax_link.php of lylme_spage v1.7.0 allows attackers to execute arbitrary code via uploading a crafted file.	2023-10-17	not yet calculated	CVE-2023-45952 MISC
m-files — web_companion	Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution	2023-10-20	not yet calculated	CVE-2023-5523 MISC
m-files — web_companion	Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution via specific file types	2023-10-20	not yet calculated	CVE-2023-5524 MISC
m-files– web	Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on user’s browser via stored HTML document.	2023-10-20	not yet calculated	CVE-2023-2325 MISC
mantisbt — mantisbt	MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects’ names, by accessing wiki.php with sequentially incremented IDs. This issue has been addressed in commit `65c44883f` which has been included in release `2.258`. Users are advised to upgrade. Users unable to upgrade should disable wiki integration ( `$g_wiki_enable = OFF;`).	2023-10-16	not yet calculated	CVE-2023-44394 MISC MISC MISC
mattermost — mattermost	Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password entry being logged.	2023-10-17	not yet calculated	CVE-2023-5339 MISC
mattermost — mattermost	Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and freeze the mobile app of users when viewing that particular channel.	2023-10-17	not yet calculated	CVE-2023-5522 MISC
meta — react_developer_tools	The React Developer Tools extension registers a message listener with window.addEventListener(‘message’, ) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitized before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim’s browser.	2023-10-19	not yet calculated	CVE-2023-5654 MISC
mintty — mintty	Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal.	2023-10-19	not yet calculated	CVE-2022-47583 MISC MISC
modoboa — modoboa	Cross-site Scripting (XSS) – DOM in GitHub repository modoboa/modoboa prior to 2.2.2.	2023-10-20	not yet calculated	CVE-2023-5688 MISC MISC
modoboa — modoboa	Cross-site Scripting (XSS) – DOM in GitHub repository modoboa/modoboa prior to 2.2.2.	2023-10-20	not yet calculated	CVE-2023-5689 MISC MISC
modoboa — modoboa	Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.	2023-10-20	not yet calculated	CVE-2023-5690 MISC MISC
mosparo — mosparo	Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3.	2023-10-20	not yet calculated	CVE-2023-5687 MISC MISC
motorola — mobile_radio	A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is improperly handled, allowing for a write-anything-anywhere scenario. This can be leveraged to obtain arbitrary code execution inside the teds_app binary, which runs with root privileges.	2023-10-19	not yet calculated	CVE-2022-26941 MISC
motorola — mobile_radio	The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives.	2023-10-19	not yet calculated	CVE-2022-26942 MISC
motorola — mobile_radio	The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count register as its sole entropy source. Low boottime entropy and limited re-seeding of the pool renders the authentication challenge vulnerable to two attacks. First, due to the limited boottime pool entropy, an adversary can derive the contents of the entropy pool by an exhaustive search of possible values, based on an observed authentication challenge. Second, an adversary can use knowledge of the entropy pool to predict authentication challenges. As such, the unit is vulnerable to CVE-2022-24400.	2023-10-19	not yet calculated	CVE-2022-26943 MISC
motorola — mobile_radio	Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoC provides two memory protection units, MPU1 and MPU2, to enforce the trust boundary between the two cores. Since both units are left unconfigured by the firmwares, an adversary with control over either core can trivially gain code execution on the other, by overwriting code located in shared RAM or DDR2 memory regions.	2023-10-19	not yet calculated	CVE-2022-27813 MISC
mycli — mycli	Inadequate encryption strength in mycli 1.27.0 allows attackers to view sensitive information via /mycli/config.py	2023-10-19	not yet calculated	CVE-2023-44690 MISC
nagvis — nagvis	XSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php.	2023-10-20	not yet calculated	CVE-2023-46287 MISC MISC MISC
national_instruments — system_configuration	A stack-based buffer overflow vulnerability exists in NI System Configuration that could result in information disclosure and/or arbitrary code execution. Successful exploitation requires that an attacker can provide a specially crafted response. This affects NI System Configuration 2023 Q3 and all previous versions.	2023-10-18	not yet calculated	CVE-2023-4601 MISC
netentsec_wangkang_technology — ns-asg_application_security_gateway	A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/list_addr_fwresource_ip.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243057 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-10-20	not yet calculated	CVE-2023-5681 MISC MISC MISC
nocodb — nocodb	Nocodb is an open source Airtable alternative. Affected versions of nocodb contain a SQL injection vulnerability, that allows an authenticated attacker with creator access to query the underlying database. By supplying a specially crafted payload to the given an attacker can inject arbitrary SQL queries to be executed. Since this is a blind SQL injection, an attacker may need to use time-based payloads which would include a function to delay execution for a given number of seconds. The response time indicates whether the result of the query execution was true or false. Depending on the result, the HTTP response will be returned after a given number of seconds, indicating TRUE, or immediately, indicating FALSE. In that way, an attacker can reveal the data present in the database. This vulnerability has been addressed in version 0.111.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-141`.	2023-10-17	not yet calculated	CVE-2023-43794 MISC
node.js — node.js	A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.	2023-10-18	not yet calculated	CVE-2023-39331 MISC
node.js — node.js	Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects. This is distinct from CVE-2023-32004 ([report 2038134](https://hackerone.com/reports/2038134)), which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`. Impacts: This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.	2023-10-18	not yet calculated	CVE-2023-39332 MISC
node.js — node.js	When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node’s policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.	2023-10-18	not yet calculated	CVE-2023-38552 MISC
nxp — multiple_products	A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family processors. Under certain conditions, a crafted Flattened Image Tree (FIT) format structure can be used to overwrite SPL memory, allowing unauthenticated software to execute on the target, leading to privilege escalation. This affects i.MX 8M, i.MX 8M Mini, i.MX 8M Nano, and i.MX 8M Plus.	2023-10-17	not yet calculated	CVE-2023-39902 MISC MISC
ojs — ojs	Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.	2023-10-18	not yet calculated	CVE-2023-5626 MISC MISC
onsinview2 — onsinview2	Improper restriction of operations within the bounds of a memory buffer issue exists in OnSinView2 versions 2.0.1 and earlier. If this vulnerability is exploited, information may be disclosed, or arbitrary code may be executed by having a user open a specially crafted OnSinView2 project file.	2023-10-17	not yet calculated	CVE-2023-42506 MISC MISC
onsinview2 — onsinview2	Stack-based buffer overflow vulnerability exists in OnSinView2 versions 2.0.1 and earlier. If this vulnerability is exploited, information may be disclosed, or arbitrary code may be executed by having a user open a specially crafted OnSinView2 project file.	2023-10-17	not yet calculated	CVE-2023-42507 MISC MISC
openfga — openfga	OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial-of-service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.	2023-10-17	not yet calculated	CVE-2023-45810 MISC
openvpn_inc — openvpn_connect	OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the user’s credentials	2023-10-17	not yet calculated	CVE-2022-3761 MISC MISC
papercut — mobility_print_server	A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an authenticated attacker to achieve read-only access to the server’s filesystem, because requests beginning with “GET /ui/static/..//..” reach getStaticContent in UIContentResource.class in the static-content-files servlet.	2023-10-19	not yet calculated	CVE-2023-31046 MISC MISC MISC MISC
pdm — pdm	pdm is a Python package and dependency manager supporting the latest PEP standards. It’s possible to craft a malicious `pdm.lock` file that could allow e.g., an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project `foo` can be targeted by creating the project `foo-2` and uploading the file `foo-2-2.tar.gz` to pypi.org. PyPI will see this as project `foo-2` version `2`, while PDM will see this as project `foo` version `2-2`. The version must only be `parseable as a version` and the filename must be a prefix of the project name, but it’s not verified to match the version being installed. Version `2-2` is also not a valid normalized version per PEP 440. Matching the project name exactly (not just prefix) would fix the issue. When installing dependencies with PDM, what’s actually installed could differ from what’s listed in `pyproject.toml` (including arbitrary code execution on install). It could also be used for downgrade attacks by only changing the version. This issue has been addressed in commit `6853e2642df` which is included in release version `2.9.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-20	not yet calculated	CVE-2023-45805 MISC MISC MISC MISC MISC
pegasystems_inc. — pega_platform	Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation	2023-10-18	not yet calculated	CVE-2023-32087 MISC
pegasystems_inc. — pega_platform	Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation	2023-10-18	not yet calculated	CVE-2023-32088 MISC
pegasystems_inc. — pega_platform	Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description	2023-10-18	not yet calculated	CVE-2023-32089 MISC
pleaser — pleaser	please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)	2023-10-20	not yet calculated	CVE-2023-46277 MISC MISC MISC MISC
prestashop — dm_concept_configurator	DM Concept configurator before v4.9.4 was discovered to contain a SQL injection vulnerability via the component ConfiguratorAttachment::getAttachmentByToken.	2023-10-19	not yet calculated	CVE-2023-43986 MISC MISC
prestashop — prestashop	In the module “PireosPay” (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via `PireosPayValidationModuleFrontController::postProcess().`	2023-10-17	not yet calculated	CVE-2023-45375 MISC
prestashop — prestashop	In the module “Carousels Pack – Instagram, Products, Brands, Supplier” (hicarouselspack) for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a guest can perform SQL injection via HiCpProductGetter::getViewedProduct().`	2023-10-19	not yet calculated	CVE-2023-45376 MISC MISC
prestashop — prestashop	In the module “Rotator Img” (posrotatorimg) in versions at least up to 1.1 from PosThemes for PrestaShop, a guest can perform SQL injection.	2023-10-19	not yet calculated	CVE-2023-45379 MISC MISC
prestashop — prestashop	In the module “Creative Popup” (creativepopup) up to version 1.6.9 from WebshopWorks for PrestaShop, a guest can perform SQL injection via `cp_download_popup().`	2023-10-19	not yet calculated	CVE-2023-45381 MISC MISC
prestashop — prestashop	In the module “SoNice etiquetage” (sonice_etiquetage) up to version 2.5.9 from Common-Services for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system.	2023-10-18	not yet calculated	CVE-2023-45383 MISC MISC
prestashop — prestashop	In the module extratabspro before version 2.2.8 from MyPresta.eu for PrestaShop, a guest can perform SQL injection via `extratabspro::searchcategory()`, `extratabspro::searchproduct()` and `extratabspro::searchmanufacturer().’	2023-10-17	not yet calculated	CVE-2023-45386 MISC
proself — multiple_products	Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.	2023-10-18	not yet calculated	CVE-2023-45727 MISC MISC
qad — search_server	The QAD Search Server is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to, and including, 1.0.0.315 due to insufficient checks on indexes. This makes it possible for unauthenticated attackers to create a new index and inject a malicious web script into its name, that will execute whenever a user accesses the search page.	2023-10-20	not yet calculated	CVE-2023-45471 MISC
qnap_systems_inc. — qusbcam2	An OS command injection vulnerability has been reported to affect QUSBCam2. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: QUSBCam2 2.0.3 ( 2023/06/15 ) and later	2023-10-20	not yet calculated	CVE-2023-23373 MISC
quick_cms — quick_cms	Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Languages Menu component.	2023-10-19	not yet calculated	CVE-2023-43342 MISC MISC
quick_cms — quick_cms	Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the SEO – Meta description parameter in the Pages Menu component.	2023-10-19	not yet calculated	CVE-2023-43344 MISC
quick_cms — quick_cms	Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Content – Name parameter in the Pages Menu component.	2023-10-19	not yet calculated	CVE-2023-43345 MISC
quick_cms — quick_cms	Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Backend – Dashboard parameter in the Languages Menu component.	2023-10-20	not yet calculated	CVE-2023-43346 MISC MISC
qumu_inc. — multicast_extension	A privilege escalation vulnerability exists within the Qumu Multicast Extension v2 before 2.0.63 for Windows. When a standard user triggers a repair of the software, a pop-up window opens with SYSTEM privileges. Standard users may use this to gain arbitrary code execution as SYSTEM.	2023-10-19	not yet calculated	CVE-2023-45883 MISC MISC
radare — radare2	Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.	2023-10-20	not yet calculated	CVE-2023-5686 MISC MISC
reconftw — reconftw	reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities. A vulnerability has been identified in reconftw where inadequate validation of retrieved subdomains may lead to a Remote Code Execution (RCE) attack. An attacker can exploit this vulnerability by crafting a malicious CSP entry on it’s own domain. Successful exploitation can lead to the execution of arbitrary code within the context of the application, potentially compromising the system. This issue has been addressed in version 2.7.1.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-20	not yet calculated	CVE-2023-46117 MISC MISC
redis — redis	Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.	2023-10-18	not yet calculated	CVE-2023-45145 MISC MISC
roundcube — roundcube	Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.	2023-10-18	not yet calculated	CVE-2023-5631 MISC MISC MISC MISC MISC MISC MISC MISC MISC
ruckus_wireless — ruckus_cloudpath	Cross Site Scripting vulnerability in Ruckus Wireless (CommScope) Ruckus CloudPath v.5.12.54414 allows a remote attacker to escalate privileges via a crafted script to the macaddress parameter in the onboarding portal.	2023-10-19	not yet calculated	CVE-2023-45992 MISC MISC MISC MISC MISC
santesoft — dicom_viewer_pro	Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.	2023-10-19	not yet calculated	CVE-2023-39431 MISC
santesoft — dicom_viewer_pro	Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to a stack-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.	2023-10-19	not yet calculated	CVE-2023-35986 MISC
santesoft — sante_fft_imaging	Santesoft Sante FFT Imaging lacks proper validation of user-supplied data when parsing DICOM files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.	2023-10-19	not yet calculated	CVE-2023-5059 MISC
secudos — qiata	SECUDOS Qiata (DOMOS OS) 4.13 has Insecure Permissions for the previewRm.sh daily cronjob. To exploit this, an attacker needs access as a low-privileged user to the underlying DOMOS system. Every user on the system has write permission for previewRm.sh, which is executed by the root user.	2023-10-20	not yet calculated	CVE-2023-40361 MISC
silicon_labs — gecko_bootloader	An integer overflow in Silicon Labs Gecko Bootloader version 4.3.1 and earlier allows unbounded memory access when reading from or writing to storage slots.	2023-10-20	not yet calculated	CVE-2023-3487 MISC MISC
silverstripe-graphql — silverstripe-graphql	silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack (DDOS attack) against a website. This mostly affects websites with publicly exposed graphql schemas. If your Silverstripe CMS project does not expose a public facing graphql schema, a user account is required to trigger the DDOS attack. If your site is hosted behind a content delivery network (CDN), such as Imperva or CloudFlare, this may further mitigate the risk. This issue has been addressed in versions 3.8.2, 4.1.3, 4.2.5, 4.3.4, and 5.0.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-16	not yet calculated	CVE-2023-40180 MISC MISC MISC MISC MISC
sitolog — sitologapplicationconnect	Sitolog sitologapplicationconnect v7.8.a and before was discovered to contain a SQL injection vulnerability via the component /activate_hook.php.	2023-10-20	not yet calculated	CVE-2023-37824 MISC
small_crm — small_crm	Stored Cross-Site Scripting (XSS) vulnerability in the Company field in the “Request a Quote” Section of Small CRM v3.0 allows an attacker to store and execute malicious javascript code in the Admin panel which leads to Admin account takeover.	2023-10-20	not yet calculated	CVE-2023-45394 MISC
sophos — sophos_firewall	A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the password type is set to “Specified by sender”.	2023-10-18	not yet calculated	CVE-2023-5552 MISC
sourcecodester — best_courier_management_system	Sourcecodester Best Courier Management System 1.0 is vulnerable to Arbitrary file upload in the update_user function.	2023-10-18	not yet calculated	CVE-2023-46004 MISC
sourcecodester — best_courier_management_system	Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_branch.php.	2023-10-18	not yet calculated	CVE-2023-46005 MISC
sourcecodester — best_courier_management_system	Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_user.php.	2023-10-18	not yet calculated	CVE-2023-46006 MISC
sourcecodester — best_courier_management_system	Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_staff.php.	2023-10-18	not yet calculated	CVE-2023-46007 MISC
sourcecodester — free_hospital_management_system	A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /vm/admin/doctors.php of the component Parameter Handler. The manipulation of the argument search leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-242186 is the identifier assigned to this vulnerability.	2023-10-15	not yet calculated	CVE-2023-5587 MISC MISC MISC
sourcecodester — judging_management_system	A vulnerability was found in SourceCodester Judging Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-242188.	2023-10-15	not yet calculated	CVE-2023-5589 MISC MISC MISC
south_river_technologies — titan_mft/sftp	Insufficient path validation when extracting a zip archive in South River Technologies’ Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal	2023-10-16	not yet calculated	CVE-2023-45685 MISC MISC
south_river_technologies — titan_mft/sftp	Insufficient path validation when writing a file via WebDAV in South River Technologies’ Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal	2023-10-16	not yet calculated	CVE-2023-45686 MISC MISC
south_river_technologies — titan_mft/sftp	A session fixation vulnerability in South River Technologies’ Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the server’s authentication if they can trick an administrator into authorizing a session id of their choosing.	2023-10-16	not yet calculated	CVE-2023-45687 MISC MISC
south_river_technologies — titan_mft/sftp	Lack of sufficient path validation in South River Technologies’ Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of an arbitrary file on the filesystem using path traversal in the ftp “SIZE” command	2023-10-16	not yet calculated	CVE-2023-45688 MISC MISC
south_river_technologies — titan_mft/sftp	Lack of sufficient path validation in South River Technologies’ Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker with administrative privileges to read any file on the filesystem via path traversal	2023-10-16	not yet calculated	CVE-2023-45689 MISC MISC
south_river_technologies — titan_mft/sftp	Default file permissions on South River Technologies’ Titan MFT and Titan SFTP servers on Linux allows a user that’s authentication to the OS to read sensitive files on the filesystem	2023-10-16	not yet calculated	CVE-2023-45690 MISC MISC
spring — amqp	In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however, by default, when no allowed list was provided, all classes could be deserialized. Specifically, an application is vulnerable if * the SimpleMessageConverter or SerializerMessageConverter is used * the user does not configure allowed list patterns * untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content.	2023-10-19	not yet calculated	CVE-2023-34050 MISC
stb_image — stb_image	stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in `stbi__gif_load_next`. This happens because two_back points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory allocation information.	2023-10-21	not yet calculated	CVE-2023-45661 MISC MISC MISC
stb_image — stb_image	stb_image is a single file MIT licensed library for processing images. When `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_comp` is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. A crafted image file can trigger `memcpy` out-of-bounds read because `bytes_per_pixel` used to calculate `bytes_per_row` doesn’t match the real image array dimensions.	2023-10-21	not yet calculated	CVE-2023-45662 MISC MISC
stb_image — stb_image	stb_image is a single file MIT licensed library for processing images. The stbi__getn function reads a specified number of bytes from context (typically a file) into the specified buffer. In case the file stream points to the end, it returns zero. There are two places where its return value is not checked: In the `stbi__hdr_load` function and in the `stbi__tga_load` function. The latter of the two is likely more exploitable as an attacker may also control the size of an uninitialized buffer.	2023-10-21	not yet calculated	CVE-2023-45663 MISC MISC MISC MISC
stb_image — stb_image	stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free the out variable. This happens in `stbi__load_gif_main` because when the `layers * stride` value is zero the behavior is implementation defined, but common that realloc frees the old memory and returns null pointer. Since it attempts to double-free the memory a few lines below the first “free”, the issue can be potentially exploited only in a multi-threaded environment. In the worst case this may lead to code execution.	2023-10-21	not yet calculated	CVE-2023-45664 MISC MISC
stb_image — stb_image	stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn’t give guarantees about the content of output value `delays` upon failure. Although it sets `delays` to zero at the beginning, it doesn’t do it in case the image is not recognized as GIF and a call to `stbi__load_gif_main_outofmem` only frees possibly allocated memory in `delays` without resetting it to zero. Thus it would be fair to say the caller of `stbi__load_gif_main` is responsible to free the allocated memory in `delays` only if `stbi__load_gif_main` returns a non null value. However, at the same time the function may return null value but fail to free the memory in `*delays` if internally `stbi__convert_format` is called and fails. The issue may lead to a memory leak if the caller chooses to free `delays` only when `stbi__load_gif_main` didn’t fail or to a double-free if the `delays` is always freed.	2023-10-21	not yet calculated	CVE-2023-45666 MISC MISC MISC
stb_image — stb_image	stb_image is a single file MIT licensed library for processing images. If `stbi__load_gif_main` in `stbi_load_gif_from_memory` fails it returns a null pointer and may keep the `z` variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls `stbi__vertical_flip_slices` with the null pointer result value and the uninitialized `z` value. This may result in a program crash.	2023-10-21	not yet calculated	CVE-2023-45667 MISC MISC MISC
stb_vorbis — stb_vorbis	stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)’’;`. The root cause is that if the len read in `start_decoder` is `-1` and `len + 1` becomes 0 when passed to `setup_malloc`. The `setup_malloc` behaves differently when `f->alloc.alloc_buffer` is pre-allocated. Instead of returning `NULL` as in `malloc` case it shifts the pre-allocated buffer by zero and returns the currently available memory block. This issue may lead to code execution.	2023-10-21	not yet calculated	CVE-2023-45675 MISC MISC MISC MISC
stb_vorbis — stb_vorbis	stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[i] = get8_packet(f);`. The root cause is an integer overflow in `setup_malloc`. A sufficiently large value in the variable `sz` overflows with `sz+7` in and the negative value passes the maximum available memory buffer check. This issue may lead to code execution.	2023-10-21	not yet calculated	CVE-2023-45676 MISC MISC MISC
stb_vorbis — stb_vorbis	stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in `f->vendor[len] = (char)’’;`. The root cause is that if `len` read in `start_decoder` is a negative number and `setup_malloc` successfully allocates memory in that case, but memory write is done with a negative index `len`. Similarly, if len is INT_MAX the integer overflow len+1 happens in `f->vendor = (char)setup_malloc(f, sizeof(char) (len+1));` and `f->comment_list[i] = (char)setup_malloc(f, sizeof(char) (len+1));`. This issue may lead to code execution.	2023-10-21	not yet calculated	CVE-2023-45677 MISC MISC MISC MISC MISC MISC
stb_vorbis — stb_vorbis	stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of buffer write in `start_decoder` because at maximum `m->submaps` can be 16 but `submap_floor` and `submap_residue` are declared as arrays of 15 elements. This issue may lead to code execution.	2023-10-21	not yet calculated	CVE-2023-45678 MISC MISC MISC
stb_vorbis — stb_vorbis	stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In that case the function returns early, but some of the pointers in `f->comment_list` are left initialized and later `setup_free` is called on these pointers in `vorbis_deinit`. This issue may lead to code execution.	2023-10-21	not yet calculated	CVE-2023-45679 MISC MISC MISC
stb_vorbis — stb_vorbis	stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In that case the function returns early, the `f->comment_list` is set to `NULL`, but `f->comment_list_length` is not reset. Later in `vorbis_deinit` it tries to dereference the `NULL` pointer. This issue may lead to denial of service.	2023-10-21	not yet calculated	CVE-2023-45680 MISC MISC MISC
stb_vorbis — stb_vorbis	stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential integer overflow in `sizeof(char) (f->comment_list_length)` which may make `setup_malloc` allocate less memory than required. Since there is another integer overflow an attacker may overflow it too to force `setup_malloc` to return 0 and make the exploit more reliable. This issue may lead to code execution.	2023-10-21	not yet calculated	CVE-2023-45681 MISC MISC
stb_vorbis — stb_vorbis	stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds read in `DECODE` macro when `var` is negative. As it can be seen in the definition of `DECODE_RAW` a negative `var` is a valid value. This issue may be used to leak internal memory allocation information.	2023-10-21	not yet calculated	CVE-2023-45682 MISC MISC MISC MISC
subrion_cms — subrion_cms	Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser, adminusername and adminemail.	2023-10-19	not yet calculated	CVE-2023-43875 MISC MISC
superwebmailer — superwebmailer	An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Export SQL Injection via the size parameter.	2023-10-21	not yet calculated	CVE-2023-38190 MISC MISC
superwebmailer — superwebmailer	An issue was discovered in SuperWebMailer 9.00.0.01710. It allows spamtest_external.php XSS via a crafted filename.	2023-10-20	not yet calculated	CVE-2023-38191 MISC MISC
superwebmailer — superwebmailer	An issue was discovered in SuperWebMailer 9.00.0.01710. It allows superadmincreate.php XSS via crafted incorrect passwords.	2023-10-21	not yet calculated	CVE-2023-38192 MISC MISC
superwebmailer — superwebmailer	An issue was discovered in SuperWebMailer 9.00.0.01710. It allows Remote Code Execution via a crafted sendmail command line.	2023-10-21	not yet calculated	CVE-2023-38193 MISC MISC
superwebmailer — superwebmailer	An issue was discovered in SuperWebMailer 9.00.0.01710. It allows keepalive.php XSS via a GET parameter.	2023-10-21	not yet calculated	CVE-2023-38194 MISC MISC
synchrony — deobfuscator	Synchrony deobfuscator is a javascript cleaner & deobfuscator. A `__proto__` pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A `__proto__` pollution vulnerability exists in the `LiteralMap` transformer allowing crafted input to modify properties in the Object prototype. A fix has been released in `deobfuscator@2.4.4`. Users are advised to upgrade. Users unable to upgrade should launch node with the [–disable-proto=delete][disable-proto] or [–disable-proto=throw][disable-proto] flags	2023-10-17	not yet calculated	CVE-2023-45811 MISC MISC MISC
tauri — tauri	Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri documentation used an insecure example configuration in the `Vite guide` to showcase how to use Tauri together with Vite. Copying the following snippet `envPrefix: [‘VITE_’, ‘TAURI_’],` from this guide into the `vite.config.ts` of a Tauri project leads to bundling the `TAURI_PRIVATE_KEY` and `TAURI_KEY_PASSWORD` into the Vite frontend code and therefore leaking this value to the released Tauri application. Using the `envPrefix: [‘VITE_’],` or any other framework than Vite means you are not impacted by this advisory. Users are advised to rotate their updater private key if they are affected by this (requires Tauri CLI >=1.5.5). After updating the envPrefix configuration, generate a new private key with `tauri signer generate`, saving the new private key and updating the updater’s `pubkey` value on `tauri.conf.json` with the new public key. To update your existing application, the next application build must be signed with the older private key in order to be accepted by the existing application.	2023-10-20	not yet calculated	CVE-2023-46115 MISC MISC
terminalfour — terminalfour	In Terminalfour before 8.3.16, misconfigured LDAP users are able to login with an invalid password.	2023-10-16	not yet calculated	CVE-2023-29484 MISC MISC
texas_instruments — omap	The AES implementation in the Texas Instruments OMAP L138 (secure variants), present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext inputs. Using this side channel, the SK_LOAD secure kernel routine can be used to recover the Customer Encryption Key (CEK).	2023-10-19	not yet calculated	CVE-2022-25332 MISC
texas_instruments — omap	The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module through the SK_LOAD routine. However, only the module header authenticity is validated. An adversary can re-use any correctly signed header and append a forged payload, to be encrypted using the CEK (obtainable through CVE-2022-25332) in order to obtain arbitrary code execution in secure context. This constitutes a full break of the TEE security architecture.	2023-10-19	not yet calculated	CVE-2022-25333 MISC
texas_instruments — omap	The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) lacks a bounds check on the signature size field in the SK_LOAD module loading routine, present in mask ROM. A module with a sufficiently large signature field causes a stack overflow, affecting secure kernel data pages. This can be leveraged to obtain arbitrary code execution in secure supervisor context by overwriting a SHA256 function pointer in the secure kernel data area when loading a forged, unsigned SK_LOAD module encrypted with the CEK (obtainable through CVE-2022-25332). This constitutes a full break of the TEE security architecture.	2023-10-19	not yet calculated	CVE-2022-25334 MISC
thingnario_photon — thingnario_photon	An issue in ThingNario Photon v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the ping function to the “thingnario Logger Maintenance Webpage” endpoint.	2023-10-21	not yet calculated	CVE-2023-46055 MISC
thirty_bees_core — thirty_bees_core	Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload.	2023-10-18	not yet calculated	CVE-2023-45958 MISC MISC
tinylab — tinylab	TinyLab linux-lab v1.1-rc1 and cloud-labv0.8-rc2, v1.1-rc1 are vulnerable to insecure permissions. The default configuration could cause Container Escape.	2023-10-19	not yet calculated	CVE-2022-42150 MISC MISC MISC MISC MISC
tinymce — tinymce	TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE’s unfiltered notification system, which is used in error handling. The conditions for this exploit requires carefully crafted malicious content to have been inserted into the editor and a notification to have been triggered. When a notification was opened, the HTML within the text argument was displayed unfiltered in the notification. The vulnerability allowed arbitrary JavaScript execution when a notification presented in the TinyMCE UI for the current user. This issue could also be exploited by any integration which uses a TinyMCE notification to display unfiltered HTML content. This vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring that the HTML displayed in the notification is sanitized, preventing the exploit. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-19	not yet calculated	CVE-2023-45819 MISC
tinymce — tinymce	TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully crafted HTML snippet passes the XSS sanitization layer, it is manipulated as a string by internal trimming functions before being stored in the undo stack. If the HTML snippet is restored from the undo stack, the combination of the string manipulation and reparative parsing by either the browser’s native [DOMParser API](https://developer.mozilla.org/en-US/docs/Web/API/DOMParser) (TinyMCE 6) or the SaxParser API (TinyMCE 5) mutates the HTML maliciously, allowing an XSS payload to be executed. This vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring HTML is trimmed using node-level manipulation instead of string manipulation. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-19	not yet calculated	CVE-2023-45818 MISC MISC MISC MISC MISC
tongda — oa	A vulnerability has been found in Tongda OA 2017 and classified as critical. This vulnerability affects unknown code of the file general/hr/training/record/delete.php. The manipulation of the argument RECORD_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-243058 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-10-20	not yet calculated	CVE-2023-5682 MISC MISC MISC
torbot — torbot	Torbot is an open source tor network intelligence tool. In affected versions the `torbot.modules.validators.validate_link function` uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows an attacker to cause an application crash using a well-crafted argument. An attacker can use a well-crafted URL argument to exploit the vulnerability in the regular expression and cause a Denial of Service on the system. The validators file has been removed in version 4.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-18	not yet calculated	CVE-2023-45813 MISC MISC
tsplus — remote_work	TSplus Remote Work 16.0.0.0 places a cleartext password on the “var pass” line of the HTML source code for the secure single sign-on web portal. NOTE: CVE-2023-31069 is only about the TSplus Remote Access product, not the TSplus Remote Work product.	2023-10-17	not yet calculated	CVE-2023-27132 MISC
tsplus — remote_work	TSplus Remote Work 16.0.0.0 has weak permissions for .exe, .js, and .html files under the %PROGRAMFILES(X86)%TSplus-RemoteWorkClientswww folder. This may enable privilege escalation if a different local user modifies a file. NOTE: CVE-2023-31067 and CVE-2023-31068 are only about the TSplus Remote Access product, not the TSplus Remote Work product.	2023-10-17	not yet calculated	CVE-2023-27133 MISC
unicopia — unicopia	Sollace Unicopia version 1.1.1 and before was discovered to deserialize untrusted data, allowing attackers to execute arbitrary code.	2023-10-20	not yet calculated	CVE-2023-39680 MISC
urllib3 — urllib3	urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn’t remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality, we believe the exploitability of this vulnerability is low. Additionally, many users aren’t putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn’t exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren’t expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body.	2023-10-17	not yet calculated	CVE-2023-45803 MISC MISC MISC MISC
vmware — aria_operations	VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.	2023-10-20	not yet calculated	CVE-2023-34051 MISC
vmware — aria_operations	VMware Aria Operations for Logs contains a deserialization vulnerability. A malicious actor with non-administrative access to the local system can trigger the deserialization of data which could result in authentication bypass.	2023-10-20	not yet calculated	CVE-2023-34052 MISC
vmware — fusion	VMware Fusion (13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the ‘.dmg’ volume) or when installing an upgrade. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time.	2023-10-20	not yet calculated	CVE-2023-34045 MISC
vmware — fusion	VMware Fusion (13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the ‘.dmg’ volume) or when installing an upgrade. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time.	2023-10-20	not yet calculated	CVE-2023-34046 MISC
vmware — workstation/fusion	VMware Workstation (17.x prior to 17.5) and Fusion (13.x prior to 13.5) contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.	2023-10-20	not yet calculated	CVE-2023-34044 MISC
wagtail — wagtail	Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user accounts, and by modifying URL parameters, the user can retrieve the display name for any user. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 4.1.8 (LTS), 5.0.5 and 5.1.3. The fix is also included in Release Candidate 1 of the forthcoming Wagtail 5.2 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.	2023-10-19	not yet calculated	CVE-2023-45809 MISC MISC
wbce_cms — wbce_cms	Cross Site Scripting (XSS) vulnerability in WBCE CMS v.1.6.1 and before allows a remote attacker to escalate privileges via a crafted script to the website_footer parameter in the admin/settings/save.php component.	2023-10-21	not yet calculated	CVE-2023-46054 MISC
webjet_cms — webjet_cms	Interway a.s WebJET CMS 8.6.896 is vulnerable to Cross Site Scripting (XSS).	2023-10-19	not yet calculated	CVE-2022-37830 MISC MISC
weintek — multiple_products	In Weintek’s cMT3000 HMI Web CGI device, the cgi-bin command_wb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.	2023-10-19	not yet calculated	CVE-2023-38584 MISC MISC
weintek — multiple_products	In Weintek’s cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device.	2023-10-19	not yet calculated	CVE-2023-40145 MISC MISC
weintek — multiple_products	In Weintek’s cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.	2023-10-19	not yet calculated	CVE-2023-43492 MISC MISC
wipotec_gmbh — comscale	WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 fails to validate user sessions, allowing unauthenticated attackers to read files from the underlying operating system and obtain directory listings.	2023-10-18	not yet calculated	CVE-2023-45912 MISC
wipotec_gmbh — comscale	An issue in WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 allows unauthenticated attackers to login as any user without a password.	2023-10-18	not yet calculated	CVE-2023-45911 MISC
wordpress — wordpress	Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in David Lingren Media Library Assistant plugin <= 3.11 versions.	2023-10-17	not yet calculated	CVE-2023-24385 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ezoic AmpedSense – AdSense Split Tester plugin <= 4.68 versions.	2023-10-18	not yet calculated	CVE-2023-25476 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Theme Blvd Tweeple plugin <= 0.9.5 versions.	2023-10-18	not yet calculated	CVE-2023-30781 MISC
wordpress — wordpress	Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in MyTechTalky User Location and IP plugin <= 1.6 versions.	2023-10-18	not yet calculated	CVE-2023-31217 MISC
wordpress — wordpress	The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attackers to increase or decrease the rating of a post.	2023-10-20	not yet calculated	CVE-2023-3998 MISC MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7.1 versions.	2023-10-17	not yet calculated	CVE-2023-44990 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wp3sixty Woo Custom Emails plugin <= 2.2 versions.	2023-10-17	not yet calculated	CVE-2023-45004 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ByConsole WooODT Lite – WooCommerce Order Delivery or Pickup with Date Time Location plugin <= 2.4.6 versions.	2023-10-17	not yet calculated	CVE-2023-45006 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fotomoto plugin <= 1.2.8 versions.	2023-10-17	not yet calculated	CVE-2023-45007 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPJohnny Comment Reply Email plugin <= 1.0.3 versions.	2023-10-18	not yet calculated	CVE-2023-45008 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex MacArthur Complete Open Graph plugin <= 3.4.5 versions.	2023-10-17	not yet calculated	CVE-2023-45010 MISC
wordpress — wordpress	Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <= 4.6.7 versions.	2023-10-18	not yet calculated	CVE-2023-45049 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Image vertical reel scroll slideshow plugin <= 9.0 versions.	2023-10-18	not yet calculated	CVE-2023-45051 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AWESOME TOGI Product Category Tree plugin <= 2.5 versions.	2023-10-18	not yet calculated	CVE-2023-45054 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <= 1.3.26 versions.	2023-10-18	not yet calculated	CVE-2023-45056 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hitsteps Web Analytics plugin <= 5.86 versions.	2023-10-18	not yet calculated	CVE-2023-45057 MISC
wordpress — wordpress	Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gumroad plugin <= 3.1.0 versions.	2023-10-18	not yet calculated	CVE-2023-45059 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Thomas Scholl canvasio3D Light plugin <= 2.4.6 versions.	2023-10-18	not yet calculated	CVE-2023-45062 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Daisuke Takahashi (Extend Wings) OPcache Dashboard plugin <= 0.3.1 versions.	2023-10-18	not yet calculated	CVE-2023-45064 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mad Fish Digital Bulk NoIndex & NoFollow Toolkit plugin <= 1.42 versions.	2023-10-18	not yet calculated	CVE-2023-45065 MISC
wordpress — wordpress	Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions.	2023-10-18	not yet calculated	CVE-2023-45067 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.18 versions.	2023-10-18	not yet calculated	CVE-2023-45070 MISC
wordpress — wordpress	Unauth. Stored Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.18 versions.	2023-10-18	not yet calculated	CVE-2023-45071 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kardi Order auto complete for WooCommerce plugin <= 1.2.0 versions.	2023-10-18	not yet calculated	CVE-2023-45072 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Koch Mendeley Plugin plugin <= 1.3.2 versions.	2023-10-18	not yet calculated	CVE-2023-45073 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Shopfiles Ltd Ebook Store plugin <= 5.785 versions.	2023-10-18	not yet calculated	CVE-2023-45602 MISC
wordpress — wordpress	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Scott Reilly Get Custom Field Values plugin <= 4.0.1 versions.	2023-10-18	not yet calculated	CVE-2023-45604 MISC
wordpress — wordpress	Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Hector Cabrera WordPress Popular Posts plugin <= 6.3.2 versions.	2023-10-18	not yet calculated	CVE-2023-45607 MISC
wordpress — wordpress	Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Nicola Modugno Smart Cookie Kit plugin <= 2.3.1 versions.	2023-10-18	not yet calculated	CVE-2023-45608 MISC
wordpress — wordpress	Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in QROkes QR Twitter Widget plugin <= 0.2.3 versions.	2023-10-18	not yet calculated	CVE-2023-45628 MISC
wordpress — wordpress	Unauth. Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions.	2023-10-18	not yet calculated	CVE-2023-45630 MISC
wordpress — wordpress	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado SpiderVPlayer plugin <= 1.5.22 versions.	2023-10-18	not yet calculated	CVE-2023-45632 MISC
wordpress — wordpress	The Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-20	not yet calculated	CVE-2023-4598 MISC MISC MISC
wordpress — wordpress	The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and including, 2.50. This is due to missing capability checks on several AJAX actions and nonce disclosure in the source page of the administrative dashboard. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to call functions and delete and/or upload files.	2023-10-20	not yet calculated	CVE-2020-36698 MISC MISC MISC
wordpress — wordpress	The Simple:Press – WordPress Forum Plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ~/admin/resources/jscript/ajaxupload/sf-uploader.php file in versions up to, and including, 6.6.0. This makes it possible for attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.	2023-10-20	not yet calculated	CVE-2020-36706 MISC MISC MISC MISC
wordpress — wordpress	The Brizy plugin for WordPress is vulnerable to authorization bypass due to an incorrect capability check on the is_administrator() function in versions up to, and including, 1.0.125. This makes it possible for authenticated attackers to access and interact with available AJAX functions.	2023-10-20	not yet calculated	CVE-2020-36714 MISC MISC
wordpress — wordpress	The Coupon Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to missing or incorrect nonce validation on the save_meta() function. This makes it possible for unauthenticated attackers to save meta fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2020-36751 MISC MISC MISC MISC MISC MISC MISC MISC MISC
wordpress — wordpress	The Hueman theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation on the save_meta_box() function. This makes it possible for unauthenticated attackers to save metabox data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2020-36753 MISC MISC MISC MISC MISC MISC MISC MISC MISC
wordpress — wordpress	The Paid Memberships Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.2. This is due to missing or incorrect nonce validation on the pmpro_page_save() function. This makes it possible for unauthenticated attackers to save pages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2020-36754 MISC MISC MISC MISC MISC MISC MISC MISC MISC
wordpress — wordpress	The Customizr theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.0. This is due to missing or incorrect nonce validation on the czr_fn_post_fields_save() function. This makes it possible for unauthenticated attackers to post fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2020-36755 MISC MISC MISC MISC MISC MISC MISC MISC MISC
wordpress — wordpress	The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This is due to missing or incorrect nonce validation on the save_feedzy_post_type_meta() function. This makes it possible for unauthenticated attackers to update post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2020-36758 MISC MISC MISC MISC MISC MISC MISC MISC MISC
wordpress — wordpress	The Woody code snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.9. This is due to missing or incorrect nonce validation on the runActions() function. This makes it possible for unauthenticated attackers to activate and deactivate snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2020-36759 MISC MISC MISC MISC MISC MISC MISC MISC MISC
wordpress — wordpress	The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check on the fpd_update_options function in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify site options, including setting the default role to administrator which can allow privilege escalation.	2023-10-20	not yet calculated	CVE-2021-4334 MISC MISC
wordpress — wordpress	The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a missing capability check on multiple AJAX functions in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify plugin settings, including retrieving arbitrary order information or creating/updating/deleting products, orders, or other sensitive information not associated with their own account.	2023-10-20	not yet calculated	CVE-2021-4335 MISC MISC
wordpress — wordpress	The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. This is due to missing authorization on the export() function which makes makes it possible for unauthenticated attackers to export the plugin’s settings.	2023-10-20	not yet calculated	CVE-2021-4353 MISC MISC
wordpress — wordpress	The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to save code snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2021-4418 MISC MISC MISC MISC MISC MISC MISC MISC MISC
wordpress — wordpress	The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the ‘cli_path’ parameter in versions up to and including 1.7.5. This makes it possible for unauthenticated users to run arbitrary commands leading to remote command execution, granted they can trick a site administrator into performing an action such as clicking on a link. This makes it possible for an attacker to create and or modify files hosted on the server which can easily grant attackers backdoor access to the affected server.	2023-10-20	not yet calculated	CVE-2022-2441 MISC MISC MISC MISC MISC MISC
wordpress — wordpress	The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the ‘zeroBSCRM_CSVImporterLitehtml_app’ function in versions up to, and including, 5.3.1. While the function performs a nonce check, steps 2 and 3 of the check do not take any action upon a failed check. These steps then perform a ‘file_exists’ check on the value of ‘zbscrmcsvimpf’. If a phar:// archive is supplied, its contents will be deserialized and an object injected in the execution stream. This allows an unauthenticated attacker to obtain object injection if they are able to upload a phar archive (for instance if the site supports image uploads) and then trick an administrator into performing an action, such as clicking a link.	2023-10-20	not yet calculated	CVE-2022-3342 MISC MISC MISC
wordpress — wordpress	The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and including, 6.9.11. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change some plugin settings intended to be modifiable by admins only.	2023-10-20	not yet calculated	CVE-2022-3622 MISC MISC MISC MISC
wordpress — wordpress	The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the ‘ctl_sanitize_title’ function in versions up to, and including, 3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This potentially allows authenticated users with the ability to add or modify terms or tags to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A partial patch became available in version 3.6 and the issue was fully patched in version 3.7.	2023-10-20	not yet calculated	CVE-2022-4290 MISC MISC
wordpress — wordpress	The WP Cerber Security plugin for WordPress is vulnerable to stored cross-site scripting via the log parameter when logging in to the site in versions up to, and including, 9.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2022-4712 MISC MISC
wordpress — wordpress	The miniOrange’s Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin settings in versions up to, and including, 5.6.5. This makes it possible for unauthenticated attackers to change the plugin’s settings.	2023-10-20	not yet calculated	CVE-2022-4943 MISC MISC
wordpress — wordpress	The Waiting: One-click countdowns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown name in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2022-4954 MISC MISC
wordpress — wordpress	The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthenticated attackers to reset plugin settings and remove reviews via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-18	not yet calculated	CVE-2023-3254 MISC MISC
wordpress — wordpress	The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the voteOnComment function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attackers to increase or decrease the rating of a comment.	2023-10-20	not yet calculated	CVE-2023-3869 MISC MISC
wordpress — wordpress	The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2023-3933 MISC MISC
wordpress — wordpress	The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2023-3962 MISC MISC
wordpress — wordpress	The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2023-3965 MISC MISC
wordpress — wordpress	The ARMember Lite – Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	2023-10-20	not yet calculated	CVE-2023-3996 MISC MISC MISC MISC MISC
wordpress — wordpress	The Modern Events Calendar lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Google API key and Calendar ID in versions up to, but not including, 7.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	2023-10-20	not yet calculated	CVE-2023-4021 MISC MISC
wordpress — wordpress	The Photospace Responsive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘psres_button_size’ parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	2023-10-20	not yet calculated	CVE-2023-4271 MISC MISC MISC
wordpress — wordpress	The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 0.9.89. This allows authenticated attackers with administrative privileges to delete the contents of arbitrary directories on the server, which can be a critical issue in a shared environment.	2023-10-20	not yet calculated	CVE-2023-4274 MISC MISC MISC
wordpress — wordpress	The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the get_posts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.	2023-10-20	not yet calculated	CVE-2023-4386 MISC MISC
wordpress — wordpress	The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the get_products function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.	2023-10-20	not yet calculated	CVE-2023-4402 MISC MISC
wordpress — wordpress	The Auto Amazon Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-4482 MISC MISC
wordpress — wordpress	The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php file. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.	2023-10-20	not yet calculated	CVE-2023-4488 MISC MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Qwerty23 Rocket Font plugin <= 1.2.3 versions.	2023-10-21	not yet calculated	CVE-2023-46067 MISC
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in PluginEver WC Serial Numbers plugin <= 1.6.3 versions.	2023-10-21	not yet calculated	CVE-2023-46078 MISC
wordpress — wordpress	The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	2023-10-21	not yet calculated	CVE-2023-4635 MISC MISC
wordpress — wordpress	The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai_ajax function. This can allow unauthenticated attackers to extract sensitive data such as post titles and slugs (including those of protected posts along with their passwords), usernames, available roles, the plugin license key provided the remote debugging option is enabled. In the default state it is disabled.	2023-10-19	not yet calculated	CVE-2023-4645 MISC MISC MISC
wordpress — wordpress	The WP Customer Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	2023-10-20	not yet calculated	CVE-2023-4648 MISC MISC
wordpress — wordpress	The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. This can allow unauthenticated attackers to extract sensitive data including installed plugins (present and active), active theme, various plugin settings, WordPress version, as well as some server settings such as memory limit, installation paths.	2023-10-20	not yet calculated	CVE-2023-4668 MISC MISC
wordpress — wordpress	The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the ‘wcj_wp_option’ shortcode in versions up to, and including, 7.1.0 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with subscriber-level capabilities or above, to retrieve arbitrary sensitive site options.	2023-10-20	not yet calculated	CVE-2023-4796 MISC MISC MISC
wordpress — wordpress	The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks.	2023-10-16	not yet calculated	CVE-2023-4798 MISC
wordpress — wordpress	A vulnerability exists which allows an authenticated attacker to access sensitive information on the AirWave Management Platform web-based management interface. Successful exploitation allows the attacker to gain access to some data that could be further exploited to laterally access devices managed and monitored by the AirWave server.	2023-10-17	not yet calculated	CVE-2023-4896 MISC
wordpress — wordpress	The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `iframe` shortcode in versions up to, and including, 4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permission and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 4.6 and fully patched in version 4.7.	2023-10-20	not yet calculated	CVE-2023-4919 MISC MISC MISC MISC
wordpress — wordpress	The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_save_options function. This makes it possible for unauthenticated attackers to modify the plugin’s settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additionally, input sanitization and escaping is insufficient resulting in the possibility of malicious script injection.	2023-10-20	not yet calculated	CVE-2023-4920 MISC MISC MISC
wordpress — wordpress	The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_delete function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2023-4923 MISC MISC MISC
wordpress — wordpress	The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to missing capability checks on the woobe_bulkoperations_delete function. This makes it possible for authenticated attackers, with subscriber access or higher, to delete products.	2023-10-20	not yet calculated	CVE-2023-4924 MISC MISC MISC
wordpress — wordpress	The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulk_delete_products function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2023-4926 MISC MISC MISC
wordpress — wordpress	The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the create_profile function. This makes it possible for unauthenticated attackers to create profiles via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2023-4935 MISC MISC MISC
wordpress — wordpress	The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_apply_default_combination function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2023-4937 MISC MISC MISC
wordpress — wordpress	The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_apply_default_combination function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.	2023-10-18	not yet calculated	CVE-2023-4938 MISC MISC MISC
wordpress — wordpress	The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a weak authentication token for the /wp-json/salesmanago/v1/callbackApiV3 API endpoint which is simply a SHA1 hash of the site URL and client ID found in the page source of the website. This makes it possible for unauthenticated attackers to inject arbitrary content into the log files, and when combined with another vulnerability this could have significant consequences.	2023-10-21	not yet calculated	CVE-2023-4939 MISC MISC MISC
wordpress — wordpress	The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_swap function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2023-4940 MISC MISC MISC
wordpress — wordpress	The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_swap function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.	2023-10-20	not yet calculated	CVE-2023-4941 MISC MISC MISC
wordpress — wordpress	The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_visibility function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2023-4942 MISC MISC MISC
wordpress — wordpress	The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_visibility function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.	2023-10-20	not yet calculated	CVE-2023-4943 MISC MISC MISC
wordpress — wordpress	The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_ean_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above, to update EAN numbers for orders.	2023-10-20	not yet calculated	CVE-2023-4947 MISC MISC
wordpress — wordpress	The Poptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘poptin-form’ shortcode in versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-4961 MISC MISC MISC
wordpress — wordpress	The WPLegalPages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘wplegalpage’ shortcode in versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with author-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-4968 MISC MISC MISC
wordpress — wordpress	The Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1. This is due to missing or incorrect nonce validation on functionality in the builder.php file. This makes it possible for unauthenticated attackers to change the stripe connect token via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2023-4975 MISC MISC MISC
wordpress — wordpress	The Horizontal scrolling announcement plugin for WordPress is vulnerable to SQL Injection via the plugin’s [horizontal-scrolling] shortcode in versions up to, and including, 9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-20	not yet calculated	CVE-2023-4999 MISC MISC
wordpress — wordpress	The Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-5050 MISC MISC MISC
wordpress — wordpress	The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that include social media authentication tokens and secrets as well as app passwords.	2023-10-20	not yet calculated	CVE-2023-5070 MISC MISC
wordpress — wordpress	The Sitekit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘sitekit_iframe’ shortcode in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-5071 MISC MISC MISC
wordpress — wordpress	The Copy Anything to Clipboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘copy’ shortcode in versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-5086 MISC MISC MISC
wordpress — wordpress	The WP Mailto Links – Protect Email Addresses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘wpml_mailto’ shortcode in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 3.1.3 and fully patched in version 3.1.4.	2023-10-20	not yet calculated	CVE-2023-5109 MISC MISC
wordpress — wordpress	The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image file path parameter in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-5120 MISC MISC
wordpress — wordpress	The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings (the backup path parameter) in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	2023-10-20	not yet calculated	CVE-2023-5121 MISC MISC
wordpress — wordpress	The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parseRemoteRequest function in versions up to, and including, 6.0.1. This makes it possible for unauthenticated attackers with knowledge of an existing WooCommerce Order ID to expose sensitive WooCommerce order information (e.g., Name, Address, Email Address, and other order metadata).	2023-10-21	not yet calculated	CVE-2023-5132 MISC MISC
wordpress — wordpress	The flowpaper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘flipbook’ shortcode in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-5200 MISC MISC MISC
wordpress — wordpress	The ChatBot plugin for WordPress is vulnerable to SQL Injection via the $strid parameter in versions up to, and including, 4.8.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-19	not yet calculated	CVE-2023-5204 MISC MISC MISC
wordpress — wordpress	The Add Custom Body Class plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘add_custom_body_class’ value in versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-21	not yet calculated	CVE-2023-5205 MISC MISC
wordpress — wordpress	The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 4.8.9. This makes it possible for authenticated attackers with subscriber privileges to delete arbitrary files on the server, which makes it possible to take over affected sites as well as others sharing the same hosting account.	2023-10-19	not yet calculated	CVE-2023-5212 MISC MISC MISC
wordpress — wordpress	The Magic Action Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.17.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-5231 MISC MISC
wordpress — wordpress	The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 via the qcld_openai_upload_pagetraining_file function. This allows subscriber-level attackers to append “	2023-10-19	not yet calculated	CVE-2023-5241 MISC MISC MISC
wordpress — wordpress	The ChatBot plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.8.9 via the qcld_wb_chatbot_check_user function. This can allow unauthenticated attackers to extract sensitive data including confirmation as to whether a username exists on the site as well as order information for existing users.	2023-10-19	not yet calculated	CVE-2023-5254 MISC MISC MISC
wordpress — wordpress	The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘acfe_form’ shortcode in versions up to, and including, 0.8.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-5292 MISC MISC MISC MISC
wordpress — wordpress	The Podcast Subscribe Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘podcast_subscribe’ shortcode in versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-5308 MISC MISC MISC
wordpress — wordpress	The iPanorama 360 – WordPress Virtual Tour Builder plugin for WordPress is vulnerable to SQL Injection via the plugin’s shortcode in versions up to, and including, 1.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2023-10-19	not yet calculated	CVE-2023-5336 MISC MISC MISC
wordpress — wordpress	The Contact form Form For All plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘formforall’ shortcode in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-5337 MISC MISC
wordpress — wordpress	The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the show_es_logs function. This allows administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive information including those belonging to other sites, for example in shared hosting environments.	2023-10-20	not yet calculated	CVE-2023-5414 MISC MISC MISC
wordpress — wordpress	The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9. This makes it possible for unauthenticated attackers to perform some of those actions that were intended for higher privileged users.	2023-10-20	not yet calculated	CVE-2023-5533 MISC MISC
wordpress — wordpress	The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9. This is due to missing or incorrect nonce validation on the corresponding functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2023-5534 MISC MISC
wordpress — wordpress	The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-18	not yet calculated	CVE-2023-5538 MISC MISC MISC MISC
wordpress — wordpress	The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 0.9.91 via Google Drive API secrets stored in plaintext in the publicly visible plugin source. This could allow unauthenticated attackers to impersonate the WPVivid Google Drive account via the API if they can trick a user into reauthenticating via another vulnerability or social engineering.	2023-10-20	not yet calculated	CVE-2023-5576 MISC MISC MISC
wordpress — wordpress	The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2023-10-20	not yet calculated	CVE-2023-5602 MISC MISC
wordpress — wordpress	The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘tpsscode’ shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-5613 MISC MISC MISC
wordpress — wordpress	The Theme Switcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘theme_switcha_list’ shortcode in all versions up to, and including, 3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-5614 MISC MISC MISC
wordpress — wordpress	The Skype Legacy Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘skype-status’ shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-5615 MISC MISC
wordpress — wordpress	The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcode in versions up to, and including, 1.4.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-5618 MISC MISC
wordpress — wordpress	The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	2023-10-18	not yet calculated	CVE-2023-5621 MISC MISC MISC
wordpress — wordpress	The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘wcj_image’ shortcode in versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-19	not yet calculated	CVE-2023-5638 MISC MISC MISC MISC
wordpress — wordpress	The Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘tmfshortcode’ shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-19	not yet calculated	CVE-2023-5639 MISC MISC MISC MISC
wordpress — wordpress	The AI ChatBot for WordPress is vulnerable to Directory Traversal in version 4.9.2 via the qcld_openai_upload_pagetraining_file function. This allows subscriber-level attackers to append “	2023-10-20	not yet calculated	CVE-2023-5646 MISC MISC MISC
wordpress — wordpress	The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in version 4.9.2. This makes it possible for authenticated attackers with subscriber privileges to delete arbitrary files on the server, which makes it possible to take over affected sites as well as others sharing the same hosting account. This vulnerability is the same as CVE-2023-5212 but was accidentally reintroduced in version 4.9.2.	2023-10-20	not yet calculated	CVE-2023-5647 MISC MISC
wordpress — wordpress	The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 4.9.2. This is due to missing or incorrect nonce validation on the corresponding functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This vulnerability is the same as CVE-2023-5534 but was reintroduced in version 4.9.2.	2023-10-20	not yet calculated	CVE-2023-5655 MISC MISC MISC
wordpress — wordpress	The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.9.2. This makes it possible for unauthenticated attackers to perform some of those actions that were intended for higher privileged users. This vulnerability is the same as CVE-2023-5533 but was reintroduced in version 4.9.2.	2023-10-20	not yet calculated	CVE-2023-5656 MISC MISC MISC
wordpress — wordpress	The WhatsApp Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘whatsapp’ shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-10-20	not yet calculated	CVE-2023-5668 MISC MISC
xnsoft_nconvert — xnsoft_nconvert	XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow. There is a User Mode Write AV via a crafted image file. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.	2023-10-18	not yet calculated	CVE-2023-43250 MISC MISC MISC MISC
xnsoft_nconvert — xnsoft_nconvert	XNSoft Nconvert 7.136 has an Exception Handler Chain Corrupted via a crafted image file. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.	2023-10-19	not yet calculated	CVE-2023-43251 MISC MISC MISC MISC
xnsoft_nconvert — xnsoft_nconvert	XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow via a crafted image file.	2023-10-19	not yet calculated	CVE-2023-43252 MISC MISC MISC MISC
xxl-rpc — xxl-rpc	XXL-RPC is a high performance, distributed RPC framework. With it, a TCP server can be set up using the Netty framework and the Hessian serialization mechanism. When such a configuration is used, attackers may be able to connect to the server and provide malicious serialized objects that, once deserialized, force it to execute arbitrary code. This can be abused to take control of the machine the server is running by way of remote code execution. This issue has not been fixed.	2023-10-18	not yet calculated	CVE-2023-45146 MISC
yamcs — yamcs	Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2). The vulnerability is in the storage functionality of the API and allows one to escape the base directory of the buckets, freely navigate system directories, and read arbitrary files.	2023-10-19	not yet calculated	CVE-2023-45277 MISC MISC
yamcs — yamcs	Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafted HTTP DELETE request.	2023-10-19	not yet calculated	CVE-2023-45278 MISC MISC
yamcs — yamcs	Yamcs 5.8.6 allows XSS (issue 1 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There’s a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from the menu and navigating to the display.	2023-10-19	not yet calculated	CVE-2023-45279 MISC MISC
yamcs — yamcs	Yamcs 5.8.6 allows XSS (issue 2 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There’s a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrary JavaScript.	2023-10-19	not yet calculated	CVE-2023-45280 MISC MISC
yamcs — yamcs	An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file.	2023-10-19	not yet calculated	CVE-2023-45281 MISC
ydb-go-sdk — ydb-go-sdk	ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object (implementation of interface Credentials it may leak into logs. This happens because this object could be serialized into an error message using `fmt.Errorf(“something went wrong (credentials: %q)”, credentials)` during connection to the YDB server. If such logging occurred, a malicious user with access to logs could read sensitive information (i.e., credentials) information and use it to get access to the database. ydb-go-sdk contains this problem in versions from v3.48.6 to v3.53.2. The fix for this problem has been released in version v3.53.3. Users are advised to upgrade. Users unable to upgrade should implement the `fmt.Stringer` interface in your custom credentials type with explicit stringify of object state.	2023-10-19	not yet calculated	CVE-2023-45825 MISC MISC MISC MISC
yealink — sip-t19p-e2	An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to execute arbitrary code via a crafted request the ping function of the diagnostic component.	2023-10-17	not yet calculated	CVE-2023-43959 MISC MISC
zchunk — zchunk	zchunk before 1.3.2 has multiple integer overflows via malformed zchunk files to lib/comp/comp.c, lib/comp/zstd/zstd.c, lib/dl/multipart.c, or lib/header.c.	2023-10-19	not yet calculated	CVE-2023-46228 MISC MISC MISC
zzzcms — zzzcms	zzzcms v2.2.0 was discovered to contain an open redirect vulnerability.	2023-10-18	not yet calculated	CVE-2023-45909 MISC

Managed Security Services

Cyber Threat Intelligence

iDNA

SiON

About Us

Leadership

Advisors

Cyber Security Assessment

SOC Cost Calculator

Request a Dark Web Report

Cyber Security Threat Alerts

What is Incident Response?

SOC 2 Compliance

Cyber Security Definitions and Terminology

Cyber Security Jobs

Blog

Podcast

Instagram

LinkedIn

Twitter

High Vulnerabilities

Medium Vulnerabilities

Low Vulnerabilities

Severity Not Yet Assigned

High Vulnerabilities

Medium Vulnerabilities

Medium Vulnerabilities

Low Vulnerabilities

Severity Not Yet Assigned

Company

Our services

Resources

Partners

Cyber news

Weekly Newsletter

Subscribe to our weekly newsletter on cyber news and best practices!