Category: alerts

Cyber Security Monitor Alerts News Notifications. We monitor and send notifications on the latest Cyber Security alerts, blogs, news on data breaches and emerging cyber threats.

alerts

Incident Response Guide for the WWS Sector

Post author By admin
Post date January 18, 2024

Today, CISA, the Federal Bureau of Investigation (FBI), and the Environmental Protection Agency released a joint Incident Response Guide for the Water and Wastewater Systems (WWS) Sector. The guide includes contributions from over 25 WWS Sector organizations spanning private industry, nonprofit, and government entities. This coordination enabled CISA, FBI, and EPA to develop a guide with meaningful value to WWS Sector organizations.

Specifically, the guide provides information about the federal support available at each stage of the cyber incident response (IR) lifecycle and aims to enhance WWS Sector cybersecurity by:

Establishing clear guidance for reporting cyber incidents;
Connecting utilities with available cybersecurity resources, services, and no-cost trainings;
Empowering utilities to build a strong cybersecurity baseline to improve cyber resilience and cyber hygiene; and
Encouraging utilities to integrate into their local cyber communities.

CISA, FBI, and EPA urge all WWS Sector and critical infrastructure organizations to review this guidance and incorporate it into their organizational cyber incident response planning. Organizations can visit CISA.gov/water for additional sector tools, information, and resources.

alerts

Drupal Releases Security Advisory for Drupal Core

Post author By admin
Post date January 18, 2024

Drupal released a security advisory to address a vulnerability affecting multiple Drupal core versions. A cyber threat actor could exploit this vulnerability to cause a denial-of-service condition.

CISA encourages users and administrators to review Drupal security advisory SA-CORE-2024-001 for more information and apply the necessary update.

alerts

Vulnerability Summary for the Week of January 8, 2024

Post author By admin
Post date January 17, 2024

High Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
abocms — abo.cms	SQL Injection vulnerability in ABO.CMS v.5.9.3, allows remote attackers to execute arbitrary code via the d parameter in the Documents module.	2024-01-06	9.8	CVE-2023-46953 cve@mitre.org
acme — ultra_mini_httpd	A vulnerability was found in ACME Ultra Mini HTTPd 1.21. It has been classified as problematic. This affects an unknown part of the component HTTP GET Request Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-249819.	2024-01-07	7.5	CVE-2024-0263 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
advancedcustomfields — advanced_custom_fields	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.	2024-01-08	7.5	CVE-2022-40696 audit@patchstack.com
alekseykurepin — pico_http_server_in_c	route in main.c in Pico HTTP Server in C through f3b69a6 has an sprintf stack-based buffer overflow via a long URI, leading to remote code execution.	2024-01-05	9.8	CVE-2024-22087 cve@mitre.org
altassian — bitbucket	An issue was discovered in savignano S/Notify before 2.0.1 for Bitbucket. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Bitbucket, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.	2024-01-09	8.3	CVE-2023-50931 cve@mitre.org
altassian — jira	An issue was discovered in savignano S/Notify before 4.0.2 for Jira. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Jira, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.	2024-01-09	8.3	CVE-2023-50930 cve@mitre.org
ami — megarac_sp-x	AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	2024-01-09	8.8	CVE-2023-3043 biossecurity@ami.com
ami — megarac_sp-x	AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	2024-01-09	8.8	CVE-2023-37293 biossecurity@ami.com
ami — megarac_sp-x	AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	2024-01-09	8.8	CVE-2023-37294 biossecurity@ami.com
ami — megarac_sp-x	AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	2024-01-09	8.8	CVE-2023-37295 biossecurity@ami.com
ami — megarac_sp-x	AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	2024-01-09	8.8	CVE-2023-37296 biossecurity@ami.com
ami — megarac_sp-x	AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	2024-01-09	8.8	CVE-2023-37297 biossecurity@ami.com
ami — megarac_sp-x	AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference by a local network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	2024-01-09	7.8	CVE-2023-34332 biossecurity@ami.com
ami — megarac_sp-x	AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference via a local network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.	2024-01-09	7.8	CVE-2023-34333 biossecurity@ami.com
apache — axis	UNSUPPORTED WHEN ASSIGNED Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF This issue affects Apache Axis: through 1.3. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06 applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.	2024-01-06	7.2	CVE-2023-51441 security@apache.org security@apache.org
apollo13themes — apollo13_framework_extensions	Cross-Site Request Forgery (CSRF) vulnerability in Apollo13Themes Apollo13 Framework Extensions.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.1.	2024-01-05	8.8	CVE-2023-51539 audit@patchstack.com
apple — macos	The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing a file may lead to arbitrary code execution.	2024-01-10	7.8	CVE-2023-42826 product-security@apple.com
apple — macos	The issue was addressed with improved bounds checks. This issue is fixed in macOS Sonoma 14. Processing a file may lead to a denial-of-service or potentially disclose memory contents.	2024-01-10	7.1	CVE-2023-42876 product-security@apple.com
apple — macos	This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to gain elevated privileges.	2024-01-10	7.8	CVE-2023-42933 product-security@apple.com
atlassian — confluence	An issue was discovered in savignano S/Notify before 4.0.2 for Confluence. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Confluence, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be.	2024-01-09	8.3	CVE-2023-50932 cve@mitre.org
azure — ipam	Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers’ Azure environments as the Service Principal used is only assigned the Reader role at the root Management Group level. Until recently, the solution lacked the validation of the passed in authentication token which may result in attacker impersonating any privileged user to access data stored within the IPAM instance and subsequently from Azure, causing an elevation of privilege. This vulnerability has been patched in version 3.0.0.	2024-01-10	9.1	CVE-2024-21638 security-advisories@github.com security-advisories@github.com security-advisories@github.com
azuread — activedirectory_identitymodel_extensions_for_dotnet	IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller’s identity. Anyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Microsoft.IdentityModel trusts the `jku`claim by default for the `SignedHttpRequest`protocol. This raises the possibility to make any remote or local `HTTP GET` request. The vulnerability has been fixed in Microsoft.IdentityModel.Protocols.SignedHttpRequest. Users should update all their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher.	2024-01-10	7.1	CVE-2024-21643 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
backupbliss — clone	The Clone WordPress plugin before 2.4.3 uses buffer files to store in-progress backup informations, which is stored at a publicly accessible, statically defined file path.	2024-01-08	7.5	CVE-2023-6750 contact@wpscan.com
basixonline — nex-forms	Cross-Site Request Forgery (CSRF) vulnerability in Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more.This issue affects NEX-Forms – Ultimate Form Builder – Contact forms and much more: from n/a through 8.5.2.	2024-01-05	8.8	CVE-2023-52120 audit@patchstack.com
blueastral — page_builder	Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder.This issue affects Page Builder: Live Composer: from n/a through 1.5.25.	2024-01-08	7.2	CVE-2023-52206 audit@patchstack.com
bosch — bcc101	Network port 8899 open in WiFi firmware of BCC101/BCC102/BCC50 products, that allows an attacker to connect to the device via same WiFi network.	2024-01-09	8.3	CVE-2023-49722 psirt@bosch.com
briandgoad — ptypeconverter	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Brian D. Goad pTypeConverter.This issue affects pTypeConverter: from n/a through 0.2.8.1.	2024-01-08	8.8	CVE-2023-52201 audit@patchstack.com
buy-addons — bazoom_magnifier	SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privileges and gain sensitive information via BaproductzoommagnifierZoomModuleFrontController::run() method.	2024-01-05	9.8	CVE-2023-50027 cve@mitre.org
byzoro — smart_s150_firmware	A vulnerability was found in Beijing Baichuo Smart S150 Management Platform up to 20240101. It has been rated as critical. Affected by this issue is some unknown functionality of the file /useratte/userattestation.php of the component HTTP POST Request Handler. The manipulation of the argument web_img leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249866 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-08	9.8	CVE-2024-0300 cna@vuldb.com cna@vuldb.com cna@vuldb.com
canonical — snapd	Race condition in snap-confine’s must_mkdir_and_open_with_perms()	2024-01-08	7	CVE-2022-3328 security@ubuntu.com security@ubuntu.com
checkmk — checkmk	Insufficient authentication flow in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows attacker to use locked credentials	2024-01-12	8.8	CVE-2023-31211 security@checkmk.com
checkmk — checkmk	Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges	2024-01-12	8.8	CVE-2023-6735 security@checkmk.com
checkmk — checkmk	Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges	2024-01-12	8.8	CVE-2023-6740 security@checkmk.com
chendotjs — lotos_webserver	Lotos WebServer through 0.1.1 (commit 3eb36cc) has a use-after-free in buffer_avail() at buffer.h via a long URI, because realloc is mishandled.	2024-01-05	9.8	CVE-2024-22088 cve@mitre.org
cleantalk — spam_protection,_antispam,_firewall	Cross-Site Request Forgery (CSRF) vulnerability in ?leanTalk – Anti-Spam Protection Spam protection, Anti-Spam, FireWall by CleanTalk.This issue affects Spam protection, Anti-Spam, FireWall by CleanTalk: from n/a through 6.20.	2024-01-05	8.8	CVE-2023-51535 audit@patchstack.com
clerk — javascript	Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router. This vulnerability was patched in version 4.29.3.	2024-01-12	9	CVE-2024-22206 security-advisories@github.com security-advisories@github.com security-advisories@github.com
cloud_foundry — routing_release	Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack. An unauthenticated attacker can use this vulnerability to force route pruning and therefore degrade the service availability of the Cloud Foundry deployment.	2024-01-12	7.5	CVE-2023-34061 security@vmware.com
code-projects — dormitory_management_system	A vulnerability classified as critical was found in code-projects Dormitory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250579.	2024-01-12	7.3	CVE-2024-0474 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — simple_online_hotel_reservation_system	A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250126 is the identifier assigned to this vulnerability.	2024-01-10	9.8	CVE-2024-0359 cna@vuldb.com cna@vuldb.com cna@vuldb.com
constantcontact — constant_contact_forms	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Constant Contact Constant Contact Forms.This issue affects Constant Contact Forms: from n/a through 2.4.2.	2024-01-08	7.5	CVE-2023-52208 audit@patchstack.com
cozmoslabs — profile_builder_pro	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Cozmoslabs Profile Builder Pro allows Reflected XSS.This issue affects Profile Builder Pro: from n/a through 3.10.0.	2024-01-13	7.1	CVE-2024-22142 audit@patchstack.com
dataiku — data_science_studio	Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass.	2024-01-09	9.8	CVE-2023-51717 cve@mitre.org cve@mitre.org
dedecms — dedecms	A vulnerability classified as critical has been found in DeDeCMS up to 5.7.112. Affected is an unknown function of the file file_class.php of the component Backend. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249768. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-07	9.8	CVE-2023-7212 cna@vuldb.com cna@vuldb.com cna@vuldb.com
demon1a — discord-recon	Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerable to remote code execution. An attacker is able to execute shell commands in the server without having an admin role. This vulnerability has been fixed in version 0.0.8.	2024-01-09	8.8	CVE-2024-21663 security-advisories@github.com security-advisories@github.com security-advisories@github.com
discourse — discourse	Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5.	2024-01-12	8.6	CVE-2023-48297 security-advisories@github.com
dtale –dtale	D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery (SSRF), allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the `Load From the Web` input is turned off by default. The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.	2024-01-05	7.5	CVE-2024-21642 security-advisories@github.com security-advisories@github.com security-advisories@github.com
engineers_online_portal_project — engineers_online_portal	A vulnerability, which was classified as problematic, was found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file change_password_teacher.php of the component Password Change. The manipulation leads to session expiration. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249816.	2024-01-07	7.5	CVE-2024-0260 cna@vuldb.com cna@vuldb.com cna@vuldb.com
evernote — evernote	An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments components.	2024-01-09	9.8	CVE-2023-50643 cve@mitre.org cve@mitre.org
fastify — reply-from	fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an header `ContentType: application/json ; charset=utf-8`. This can lead to bypass of security checks. This vulnerability has been patched in ‘@fastify/reply-from` version 9.6.0.	2024-01-08	7.5	CVE-2023-51701 security-advisories@github.com security-advisories@github.com
fhs-opensource — iparking	A vulnerability classified as critical was found in fhs-opensource iparking 1.5.22.RELEASE. This vulnerability affects the function getData of the file src/main/java/com/xhb/pay/action/PayTempOrderAction.java. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249868.	2024-01-08	9.8	CVE-2024-0301 cna@vuldb.com cna@vuldb.com cna@vuldb.com
fhs-opensource — iparking	A vulnerability, which was classified as critical, has been found in fhs-opensource iparking 1.5.22.RELEASE. This issue affects some unknown processing of the file /vueLogin. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249869 was assigned to this vulnerability.	2024-01-08	9.8	CVE-2024-0302 cna@vuldb.com cna@vuldb.com cna@vuldb.com
fit2cloud — cloudexplorer_lite	Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter.	2024-01-06	7.8	CVE-2023-50612 cve@mitre.org
flycms_project — flycms	FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/userconfig_updagte.	2024-01-08	8.8	CVE-2023-52072 cve@mitre.org
flycms_project — flycms	FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/config_footer_updagte.	2024-01-08	8.8	CVE-2023-52073 cve@mitre.org
flycms_project — flycms	FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component system/site/webconfig_updagte.	2024-01-08	8.8	CVE-2023-52074 cve@mitre.org
fonttools — fonttools	fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.	2024-01-10	7.5	CVE-2023-45139 security-advisories@github.com security-advisories@github.com security-advisories@github.com
fortinet — fortios	An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS requests.	2024-01-10	8.8	CVE-2023-44250 psirt@fortinet.com
fortinet — fortiportal	A improper access control in Fortinet FortiPortal version 7.0.0 through 7.0.6, Fortinet FortiPortal version 7.2.0 through 7.2.1 allows attacker to escalate its privilege via specifically crafted HTTP requests.	2024-01-10	7.2	CVE-2023-46712 psirt@fortinet.com
framework — framework	Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation. The vulnerability has been fixed and published as flarum/core v1.8.5. As a workaround, some extensions modifying the logout route can remedy this issue if their implementation is safe.	2024-01-05	7.5	CVE-2024-21641 security-advisories@github.com security-advisories@github.com security-advisories@github.com
ftpdmin_project — ftpdmin	A vulnerability has been found in Sentex FTPDMIN 0.96 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component RNFR Command Handler. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249817 was assigned to this vulnerability.	2024-01-07	7.5	CVE-2024-0261 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
gecka — terms_thumbnails	Deserialization of Untrusted Data vulnerability in Gecka Gecka Terms Thumbnails.This issue affects Gecka Terms Thumbnails: from n/a through 1.1.	2024-01-08	8.8	CVE-2023-52219 audit@patchstack.com
getawesomesupport — awesome_support	Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin.This issue affects Awesome Support – WordPress HelpDesk & Support Plugin: from n/a through 6.1.5.	2024-01-05	8.8	CVE-2023-51538 audit@patchstack.com
gitlab — gitlab	An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding changes to a previously approved merge request.	2024-01-12	7.6	CVE-2023-4812 cve@gitlab.com cve@gitlab.com
gitlab — gitlab	Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user.	2024-01-12	7.3	CVE-2023-5356 cve@gitlab.com cve@gitlab.com
gitlab — gitlab	An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.	2024-01-12	10	CVE-2023-7028 cve@gitlab.com cve@gitlab.com
gitpython-developers — gitpython	GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.	2024-01-11	7.8	CVE-2024-22190 security-advisories@github.com security-advisories@github.com security-advisories@github.com
go-git — go-git	A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using “Plain” versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli.	2024-01-12	9.8	CVE-2023-49569 cve-requests@bitdefender.com
go-git — go-git	A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli.	2024-01-12	7.5	CVE-2023-49568 cve-requests@bitdefender.com
goauthentik — authentik	Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with `response_mode=form_post`. This relatively user could use the described attacks to perform a privilege escalation. This vulnerability has been patched in versions 2023.10.6 and 2023.8.6.	2024-01-11	7.6	CVE-2024-21637 security-advisories@github.com security-advisories@github.com security-advisories@github.com
gofiber — template	This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious scripts in users’ browsers when visiting affected web pages. The vulnerability has been addressed, the template engine now defaults to having autoescape set to `true`, effectively mitigating the risk of XSS attacks.	2024-01-11	9.3	CVE-2024-22199 security-advisories@github.com security-advisories@github.com
gpac — gpac	Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.	2024-01-08	9.8	CVE-2024-0321 security@huntr.dev security@huntr.dev
gpac — gpac	Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.	2024-01-08	9.1	CVE-2024-0322 security@huntr.dev security@huntr.dev
gtkwave — gtkwave	An integer overflow vulnerability exists in the FST_BL_GEOM parsing maxhandle functionality of GTKWave 3.3.115, when compiled as a 32-bit binary. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.	2024-01-08	7.8	CVE-2023-32650 talos-cna@cisco.com
gtkwave — gtkwave	An improper array index validation vulnerability exists in the EVCD var len parsing functionality of GTKWave 3.3.115. A specially crafted .evcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.	2024-01-08	7.8	CVE-2023-34087 talos-cna@cisco.com
gtkwave — gtkwave	An out-of-bounds write vulnerability exists in the LXT2 num_time_table_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.	2024-01-08	7.8	CVE-2023-34436 talos-cna@cisco.com
gtkwave — gtkwave	An integer overflow vulnerability exists in the VZT longest_len value allocation functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.	2024-01-08	7.8	CVE-2023-35004 talos-cna@cisco.com
gtkwave — gtkwave	An integer overflow vulnerability exists in the LXT2 lxt2_rd_trace value elements allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.	2024-01-08	7.8	CVE-2023-35057 talos-cna@cisco.com
gtkwave — gtkwave	An integer overflow vulnerability exists in the fstReaderIterBlocks2 time_table tsec_nitems functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.	2024-01-08	7.8	CVE-2023-35128 talos-cna@cisco.com
gtkwave — gtkwave	Multiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the fstReaderVarint32 function.	2024-01-08	7.8	CVE-2023-35702 talos-cna@cisco.com
gtkwave — gtkwave	Multiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the fstReaderVarint64 function.	2024-01-08	7.8	CVE-2023-35703 talos-cna@cisco.com
gtkwave — gtkwave	Multiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the fstReaderVarint32WithSkip function.	2024-01-08	7.8	CVE-2023-35704 talos-cna@cisco.com
gtkwave — gtkwave	Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the decompression function `LZ4_decompress_safe_partial`.	2024-01-08	7.8	CVE-2023-35955 talos-cna@cisco.com
gtkwave — gtkwave	Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the decompression function `fastlz_decompress`.	2024-01-08	7.8	CVE-2023-35956 talos-cna@cisco.com
gtkwave — gtkwave	Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the decompression function `uncompress`.	2024-01-08	7.8	CVE-2023-35957 talos-cna@cisco.com
gtkwave — gtkwave	Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the copy function `fstFread`.	2024-01-08	7.8	CVE-2023-35958 talos-cna@cisco.com
gtkwave — gtkwave	Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns `.ghw` decompression.	2024-01-08	7.8	CVE-2023-35959 talos-cna@cisco.com
gtkwave — gtkwave	Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns legacy decompression in `vcd_main`.	2024-01-08	7.8	CVE-2023-35960 talos-cna@cisco.com
gtkwave — gtkwave	Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in `vcd_recorder_main`.	2024-01-08	7.8	CVE-2023-35961 talos-cna@cisco.com
gtkwave — gtkwave	Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in the `vcd2vzt` utility.	2024-01-08	7.8	CVE-2023-35962 talos-cna@cisco.com
gtkwave — gtkwave	Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in the `vcd2lxt2` utility.	2024-01-08	7.8	CVE-2023-35963 talos-cna@cisco.com
gtkwave — gtkwave	Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in the `vcd2lxt` utility.	2024-01-08	7.8	CVE-2023-35964 talos-cna@cisco.com
gtkwave — gtkwave	Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chain_table parsing functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the chain_table of `FST_BL_VCDATA` and `FST_BL_VCDATA_DYN_ALIAS` section types.	2024-01-08	7.8	CVE-2023-35969 talos-cna@cisco.com
gtkwave — gtkwave	Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chain_table parsing functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the chain_table of the `FST_BL_VCDATA_DYN_ALIAS2` section type.	2024-01-08	7.8	CVE-2023-35970 talos-cna@cisco.com
gtkwave — gtkwave	An integer overflow vulnerability exists in the LXT2 zlib block allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.	2024-01-08	7.8	CVE-2023-35989 talos-cna@cisco.com
gtkwave — gtkwave	An integer overflow vulnerability exists in the FST fstReaderIterBlocks2 vesc allocation functionality of GTKWave 3.3.115, when compiled as a 32-bit binary. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.	2024-01-08	7.8	CVE-2023-35992 talos-cna@cisco.com
gtkwave — gtkwave	Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta initialization part.	2024-01-08	7.8	CVE-2023-35994 talos-cna@cisco.com
gtkwave — gtkwave	Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta indexing when signal_lens is 1.	2024-01-08	7.8	CVE-2023-35995 talos-cna@cisco.com
gtkwave — gtkwave	Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta indexing when signal_lens is 0.	2024-01-08	7.8	CVE-2023-35996 talos-cna@cisco.com
gtkwave — gtkwave	Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta indexing when signal_lens is 2 or more.	2024-01-08	7.8	CVE-2023-35997 talos-cna@cisco.com
gtkwave — gtkwave	Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 fstWritex len functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the handling of `len` in `fstWritex` when parsing the time table.	2024-01-08	7	CVE-2023-36746 talos-cna@cisco.com
gtkwave — gtkwave	Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 fstWritex len functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the handling of `len` in `fstWritex` when `beg_time` does not match the start of the time table.	2024-01-08	7	CVE-2023-36747 talos-cna@cisco.com
gtkwave — gtkwave	An out-of-bounds write vulnerability exists in the VZT LZMA_read_varint functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.	2024-01-08	7.8	CVE-2023-36861 talos-cna@cisco.com
gtkwave — gtkwave	An integer overflow vulnerability exists in the fstReaderIterBlocks2 temp_signal_value_buf allocation functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.	2024-01-08	7.8	CVE-2023-36864 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the FST fstReaderIterBlocks2 chain_table allocation functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the allocation of the `chain_table` array.	2024-01-08	7.8	CVE-2023-36915 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the FST fstReaderIterBlocks2 chain_table allocation functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the allocation of the `chain_table_lengths` array.	2024-01-08	7.8	CVE-2023-36916 talos-cna@cisco.com
gtkwave — gtkwave	An out-of-bounds write vulnerability exists in the VZT LZMA_Read dmem extraction functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.	2024-01-08	7.8	CVE-2023-37282 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the GUI’s legacy VCD parsing code.	2024-01-08	7.8	CVE-2023-37416 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the GUI’s interactive VCD parsing code.	2024-01-08	7.8	CVE-2023-37417 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2vzt conversion utility.	2024-01-08	7.8	CVE-2023-37418 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt2 conversion utility.	2024-01-08	7.8	CVE-2023-37419 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt conversion utility.	2024-01-08	7.8	CVE-2023-37420 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds read when triggered via the GUI’s default VCD parsing code.	2024-01-08	7.8	CVE-2023-37442 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds read when triggered via the GUI’s legacy VCD parsing code.	2024-01-08	7.8	CVE-2023-37443 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds read when triggered via the GUI’s interactive VCD parsing code.	2024-01-08	7.8	CVE-2023-37444 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2vzt conversion utility.	2024-01-08	7.8	CVE-2023-37445 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt2 conversion utility.	2024-01-08	7.8	CVE-2023-37446 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt conversion utility.	2024-01-08	7.8	CVE-2023-37447 talos-cna@cisco.com
gtkwave — gtkwave	Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the GUI’s recoder (default) VCD parsing code.	2024-01-08	7.8	CVE-2023-37573 talos-cna@cisco.com
gtkwave — gtkwave	Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the GUI’s legacy VCD parsing code.	2024-01-08	7.8	CVE-2023-37574 talos-cna@cisco.com
gtkwave — gtkwave	Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the GUI’s interactive VCD parsing code.	2024-01-08	7.8	CVE-2023-37575 talos-cna@cisco.com
gtkwave — gtkwave	Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2vzt conversion utility.	2024-01-08	7.8	CVE-2023-37576 talos-cna@cisco.com
gtkwave — gtkwave	Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2lxt2 conversion utility.	2024-01-08	7.8	CVE-2023-37577 talos-cna@cisco.com
gtkwave — gtkwave	Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2lxt conversion utility.	2024-01-08	7.8	CVE-2023-37578 talos-cna@cisco.com
gtkwave — gtkwave	Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2vzt conversion utility.	2024-01-08	7.8	CVE-2023-37921 talos-cna@cisco.com
gtkwave — gtkwave	Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2lxt2 conversion utility.	2024-01-08	7.8	CVE-2023-37922 talos-cna@cisco.com
gtkwave — gtkwave	Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2lxt conversion utility.	2024-01-08	7.8	CVE-2023-37923 talos-cna@cisco.com
gtkwave — gtkwave	A stack-based buffer overflow vulnerability exists in the LXT2 lxt2_rd_expand_integer_to_bits function of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.	2024-01-08	7.8	CVE-2023-38583 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `rows` array.	2024-01-08	7.8	CVE-2023-38618 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `msb` array.	2024-01-08	7.8	CVE-2023-38619 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `lsb` array.	2024-01-08	7.8	CVE-2023-38620 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `flags` array.	2024-01-08	7.8	CVE-2023-38621 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `len` array.	2024-01-08	7.8	CVE-2023-38622 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `vindex_offset` array.	2024-01-08	7.8	CVE-2023-38623 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_get_facname decompression functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the prefix copy loop.	2024-01-08	7.8	CVE-2023-38648 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_get_facname decompression functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the string copy loop.	2024-01-08	7.8	CVE-2023-38649 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode times parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is not zero.	2024-01-08	7.8	CVE-2023-38650 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode times parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is zero.	2024-01-08	7.8	CVE-2023-38651 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode dict parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is not zero.	2024-01-08	7.8	CVE-2023-38652 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode dict parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is zero.	2024-01-08	7.8	CVE-2023-38653 talos-cna@cisco.com
gtkwave — gtkwave	An out-of-bounds write vulnerability exists in the LXT2 zlib block decompression functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.	2024-01-08	7.8	CVE-2023-38657 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when looping over `lt->numrealfacs`.	2024-01-08	7.8	CVE-2023-39234 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when looping over `lt->num_time_ticks`.	2024-01-08	7.8	CVE-2023-39235 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `rows` array.	2024-01-08	7.8	CVE-2023-39270 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `msb` array.	2024-01-08	7.8	CVE-2023-39271 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `lsb` array.	2024-01-08	7.8	CVE-2023-39272 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `flags` array.	2024-01-08	7.8	CVE-2023-39273 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `len` array.	2024-01-08	7.8	CVE-2023-39274 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `value` array.	2024-01-08	7.8	CVE-2023-39275 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the LXT2 num_dict_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `string_pointers` array.	2024-01-08	7.8	CVE-2023-39316 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer overflow vulnerabilities exist in the LXT2 num_dict_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `string_lens` array.	2024-01-08	7.8	CVE-2023-39317 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer underflow vulnerabilities exist in the LXT2 lxt2_rd_iter_radix shift operation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer underflow when performing the left shift operation.	2024-01-08	7.8	CVE-2023-39413 talos-cna@cisco.com
gtkwave — gtkwave	Multiple integer underflow vulnerabilities exist in the LXT2 lxt2_rd_iter_radix shift operation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer underflow when performing the right shift operation.	2024-01-08	7.3	CVE-2023-39414 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. A specially-crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the prefix copy loop.	2024-01-08	7.8	CVE-2023-39443 talos-cna@cisco.com
gtkwave — gtkwave	Multiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. A specially-crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the string copy loop.	2024-01-08	7.8	CVE-2023-39444 talos-cna@cisco.com
hancom — hcell	Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability in Hancom HCell on Windows allows Overflow Buffers.This issue affects HCell: 12.0.0.893.	2024-01-12	8.8	CVE-2023-40250 vuln@krcert.or.kr
haokekeji — yiqiniu	A vulnerability, which was classified as critical, has been found in HaoKeKeJi YiQiNiu up to 3.1. Affected by this issue is the function http_post of the file /application/pay/controller/Api.php. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250652.	2024-01-13	7.3	CVE-2024-0510 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
hayyp — cherry	handle_request in http.c in cherry through 4b877df has an sscanf stack-based buffer overflow via a long URI, leading to remote code execution.	2024-01-05	9.8	CVE-2024-22086 cve@mitre.org
hex_workshop — hex_workshop	A denial service vulnerability has been found on Hex Workshop affecting version 6.7, an attacker could send a command line file arguments and control the Structured Exception Handler (SEH) records resulting in a service shutdown.	2024-01-11	7.3	CVE-2024-0429 cve-coordination@incibe.es
hyperledger — aries-cloudagent-python	Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation `document.proof` was not factored into the final `verified` value (`true`/`false`) on the presentation record. The flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own. This vulnerability has been present since version 0.7.0 and fixed in version 0.10.5.	2024-01-11	9.9	CVE-2024-21669 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
ibm — cics_transaction_gateway	IBM CICS Transaction Gateway 9.3 could allow a user to transfer or view files due to improper access controls. IBM X-Force ID: 270259.	2024-01-08	8.1	CVE-2023-47140 psirt@us.ibm.com psirt@us.ibm.com nvd@nist.gov
ibm — db2	IBM Db2 for Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow a local user to escalate their privileges to the SYSTEM user using the MSI repair functionality. IBM X-Force ID: 270402.	2024-01-07	7.8	CVE-2023-47145 psirt@us.ibm.com psirt@us.ibm.com
ibm — security_verify_access_appliance	IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254658.	2024-01-11	8.4	CVE-2023-31003 psirt@us.ibm.com psirt@us.ibm.com
ibm — storage_fusion_hci	IBM Storage Fusion HCI 2.1.0 through 2.6.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 275671.	2024-01-08	9.8	CVE-2023-50948 psirt@us.ibm.com psirt@us.ibm.com
icegram — icegram_engage	Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building.This issue affects Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: from n/a through 3.1.18.	2024-01-05	8.8	CVE-2023-52119 audit@patchstack.com
inc2734 — mw_wp_form	The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the ‘_single_file_upload’ function in versions up to, and including, 5.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible.	2024-01-11	9.8	CVE-2023-6316 security@wordfence.com security@wordfence.com security@wordfence.com
inis_project — inis	A vulnerability was found in Inis up to 2.0.1. It has been rated as critical. This issue affects some unknown processing of the file app/api/controller/default/Proxy.php. The manipulation of the argument p_url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249875.	2024-01-08	8.8	CVE-2024-0308 cna@vuldb.com cna@vuldb.com cna@vuldb.com
irfanview — b3d	IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+27ef heap-based out-of-bounds write.	2024-01-05	9.8	CVE-2020-13878 cve@mitre.org
irfanview — b3d	IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+214f heap-based out-of-bounds write.	2024-01-05	9.8	CVE-2020-13879 cve@mitre.org
irfanview — b3d	IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+1cbf heap-based out-of-bounds write.	2024-01-05	9.8	CVE-2020-13880 cve@mitre.org
ivanti — connect_secure	A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.	2024-01-12	9.1	CVE-2024-21887 support@hackerone.com
ivanti — connect_secure	An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.	2024-01-12	8.2	CVE-2023-46805 support@hackerone.com
ivanti — endpoint_manager	An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the internal network to execute arbitrary SQL queries and retrieve output without the need for authentication. Under specific circumstances, this may also lead to RCE on the core server.	2024-01-09	8.8	CVE-2023-39336 support@hackerone.com
javik — randomize	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Javik Randomize.This issue affects Randomize: from n/a through 1.4.3.	2024-01-08	8.8	CVE-2023-52204 audit@patchstack.com
juniper_networks — junos_os	An Improper Validation of Syntactic Correctness of Input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). If an attacker sends high rate of specific ICMP traffic to a device with VXLAN configured, this causes a deadlock of the PFE and results in the device becoming unresponsive. A manual restart will be required to recover the device. This issue only affects EX4100, EX4400, EX4600, QFX5000 Series devices. This issue affects: Juniper Networks Junos OS * 21.4R3 versions earlier than 21.4R3-S4; * 22.1R3 versions earlier than 22.1R3-S3; * 22.2R2 versions earlier than 22.2R3-S1; * 22.3 versions earlier than 22.3R2-S2, 22.3R3; * 22.4 versions earlier than 22.4R2; * 23.1 versions earlier than 23.1R2.	2024-01-12	7.5	CVE-2024-21595 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os	A Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). In a remote access VPN scenario, if a “tcp-encap-profile” is configured and a sequence of specific packets is received, a flowd crash and restart will be observed. This issue affects Juniper Networks Junos OS on SRX Series: * All versions earlier than 20.4R3-S8; * 21.2 versions earlier than 21.2R3-S6; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S3; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S1; * 22.4 versions earlier than 22.4R2-S2, 22.4R3.	2024-01-12	7.5	CVE-2024-21606 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os	A Missing Release of Memory after Effective Lifetime vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). In a Juniper Flow Monitoring (jflow) scenario route churn that causes BGP next hops to be updated will cause a slow memory leak and eventually a crash and restart of rpd. Thread level memory utilization for the areas where the leak occurs can be checked using the below command: user@host> show task memory detail \| match so_in so_in6 28 32 344450 11022400 344760 11032320 so_in 8 16 1841629 29466064 1841734 29467744 This issue affects: Junos OS * 21.4 versions earlier than 21.4R3; * 22.1 versions earlier than 22.1R3; * 22.2 versions earlier than 22.2R3. Junos OS Evolved * 21.4-EVO versions earlier than 21.4R3-EVO; * 22.1-EVO versions earlier than 22.1R3-EVO; * 22.2-EVO versions earlier than 22.2R3-EVO. This issue does not affect: Juniper Networks Junos OS versions earlier than 21.4R1. Juniper Networks Junos OS Evolved versions earlier than 21.4R1.	2024-01-12	7.5	CVE-2024-21611 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os	An Improper Check for Unusual or Exceptional Conditions vulnerability in Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to cause rpd to crash, leading to Denial of Service (DoS). On all Junos OS and Junos OS Evolved platforms, when NETCONF and gRPC are enabled, and a specific query is executed via Dynamic Rendering (DREND), rpd will crash and restart. Continuous execution of this specific query will cause a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS * 22.2 versions earlier than 22.2R2-S2, 22.2R3; * 22.3 versions earlier than 22.3R2, 22.3R3. Juniper Networks Junos OS Evolved * 22.2 versions earlier than 22.2R2-S2-EVO, 22.2R3-EVO; * 22.3 versions earlier than 22.3R2-EVO, 22.3R3-EVO. This issue does not affect Juniper Networks: Junos OS versions earlier than 22.2R1; Junos OS Evolved versions earlier than 22.2R1-EVO.	2024-01-12	7.5	CVE-2024-21614 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os	An Improper Validation of Syntactic Correctness of Input vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service (DoS). On all Junos OS MX Series and SRX Series platforms, when SIP ALG is enabled, and a specific SIP packet is received and processed, NAT IP allocation fails for genuine traffic, which causes Denial of Service (DoS). Continuous receipt of this specific SIP ALG packet will cause a sustained DoS condition. NAT IP usage can be monitored by running the following command. user@srx> show security nat resource-usage source-poolPool name: source_pool_name .. Address Factor-index Port-range Used Avail Total Usage X.X.X.X 0 Single Ports 50258 52342 62464 96% <<<<< – Alg Ports 0 2048 2048 0% This issue affects: Juniper Networks Junos OS on MX Series and SRX Series * All versions earlier than 21.2R3-S6; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S1; * 22.4 versions earlier than 22.4R2-S2, 22.4R3; * 23.2 versions earlier than 23.2R1-S1, 23.2R2.	2024-01-12	7.5	CVE-2024-21616 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os	An Out-of-bounds Write vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS), or Remote Code Execution (RCE) and obtain root privileges on the device. This issue is caused by use of an insecure function allowing an attacker to overwrite arbitrary memory. This issue affects Juniper Networks Junos OS SRX Series and EX Series: * Junos OS versions earlier than 20.4R3-S9; * Junos OS 21.2 versions earlier than 21.2R3-S7; * Junos OS 21.3 versions earlier than 21.3R3-S5; * Junos OS 21.4 versions earlier than 21.4R3-S5; * Junos OS 22.1 versions earlier than 22.1R3-S4; * Junos OS 22.2 versions earlier than 22.2R3-S3; * Junos OS 22.3 versions earlier than 22.3R3-S2; * Junos OS 22.4 versions earlier than 22.4R2-S2, 22.4R3.	2024-01-12	9.8	CVE-2024-21591 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os_evolved	A NULL Pointer Dereference vulnerability in Juniper Networks Junos OS Evolved on ACX7024, ACX7100-32C and ACX7100-48L allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). If a specific IPv4 UDP packet is received and sent to the Routing Engine (RE) packetio crashes and restarts which causes a momentary traffic interruption. Continued receipt of such packets will lead to a sustained DoS. This issue does not happen with IPv6 packets. This issue affects Juniper Networks Junos OS Evolved on ACX7024, ACX7100-32C and ACX7100-48L: * 21.4-EVO versions earlier than 21.4R3-S6-EVO; * 22.1-EVO versions earlier than 22.1R3-S5-EVO; * 22.2-EVO versions earlier than 22.2R2-S1-EVO, 22.2R3-EVO; * 22.3-EVO versions earlier than 22.3R2-EVO. This issue does not affect Juniper Networks Junos OS Evolved versions earlier than 21.4R1-EVO.	2024-01-12	7.5	CVE-2024-21602 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os_evolved	An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). If a high rate of specific valid packets are processed by the routing engine (RE) this will lead to a loss of connectivity of the RE with other components of the chassis and thereby a complete and persistent system outage. Please note that a carefully designed lo0 firewall filter will block or limit these packets which should prevent this issue from occurring. The following log messages can be seen when this issue occurs: kernel: nf_conntrack: nf_conntrack: table full, dropping packet This issue affects Juniper Networks Junos OS Evolved: * All versions earlier than 20.4R3-S7-EVO; * 21.2R1-EVO and later versions; * 21.4-EVO versions earlier than 21.4R3-S5-EVO; * 22.1-EVO versions earlier than 22.1R3-S2-EVO; * 22.2-EVO versions earlier than 22.2R3-EVO; * 22.3-EVO versions earlier than 22.3R2-EVO; * 22.4-EVO versions earlier than 22.4R2-EVO.	2024-01-12	7.5	CVE-2024-21604 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os_evolved	An Improper Handling of Syntactically Invalid Structure vulnerability in Object Flooding Protocol (OFP) service of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). On all Junos OS Evolved platforms, when specific TCP packets are received on an open OFP port, the OFP crashes leading to a restart of Routine Engine (RE). Continuous receipt of these specific TCP packets will lead to a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS Evolved * All versions earlier than 21.2R3-S7-EVO; * 21.3 versions earlier than 21.3R3-S5-EVO ; * 21.4 versions earlier than 21.4R3-S5-EVO; * 22.1 versions earlier than 22.1R3-S4-EVO; * 22.2 versions earlier than 22.2R3-S3-EVO ; * 22.3 versions earlier than 22.3R3-EVO; * 22.4 versions earlier than 22.4R2-EVO, 22.4R3-EVO.	2024-01-12	7.5	CVE-2024-21612 sirt@juniper.net sirt@juniper.net
juniper_networks — paragon_active_assurance	An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated network-based attacker to access reports without authenticating, potentially containing sensitive configuration information. A feature was introduced in version 3.1.0 of the Paragon Active Assurance Control Center which allows users to selectively share account data. By exploiting this vulnerability, it is possible to access reports without being logged in, resulting in the opportunity for malicious exfiltration of user data. Note that the Paragon Active Assurance Control Center SaaS offering is not affected by this issue. This issue affects Juniper Networks Paragon Active Assurance versions 3.1.0, 3.2.0, 3.2.2, 3.3.0, 3.3.1, 3.4.0. This issue does not affect Juniper Networks Paragon Active Assurance versions earlier than 3.1.0.	2024-01-12	7.4	CVE-2024-21589 sirt@juniper.net sirt@juniper.net
kashipara — food_management_system	A vulnerability was found in Kashipara Food Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file itemBillPdf.php. The manipulation of the argument printid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249848.	2024-01-07	9.8	CVE-2024-0287 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability classified as critical has been found in Kashipara Food Management System 1.0. This affects an unknown part of the file rawstock_used_damaged_submit.php. The manipulation of the argument product_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249849 was assigned to this vulnerability.	2024-01-08	9.8	CVE-2024-0288 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability classified as critical was found in Kashipara Food Management System 1.0. This vulnerability affects unknown code of the file stock_entry_submit.php. The manipulation of the argument itemype leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249850 is the identifier assigned to this vulnerability.	2024-01-08	9.8	CVE-2024-0289 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability, which was classified as critical, has been found in Kashipara Food Management System 1.0. This issue affects some unknown processing of the file stock_edit.php. The manipulation of the argument item_type leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249851.	2024-01-08	9.8	CVE-2024-0290 cna@vuldb.com cna@vuldb.com cna@vuldb.com
korenix — jetnet_series	An Improper Authentication vulnerability in Korenix JetNet TFTP allows abuse of this service. This issue affects JetNet devices older than firmware version 2024/01.	2024-01-09	8.6	CVE-2023-5376 office@cyberdanube.com office@cyberdanube.com office@cyberdanube.com office@cyberdanube.com
korenix — jetnet_series	An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmware version 2024/01.	2024-01-09	9.8	CVE-2023-5347 office@cyberdanube.com office@cyberdanube.com office@cyberdanube.com office@cyberdanube.com
kutethemes — ovic_responsive_wpbakery	The Ovic Responsive WPBakery WordPress plugin before 1.2.9 does not limit which options can be updated via some of its AJAX actions, which may allow attackers with a subscriber+ account to update blog options, such as ‘users_can_register’ and ‘default_role’. It also unserializes user input in the process, which may lead to Object Injection attacks.	2024-01-08	8.8	CVE-2023-5235 contact@wpscan.com
likeshop — likeshop	A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250120.	2024-01-09	7.3	CVE-2024-0352 cna@vuldb.com cna@vuldb.com cna@vuldb.com
linux — kernel	An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an attacker to achieve out-of-bounds access.	2024-01-12	7.8	CVE-2023-6040 security@ubuntu.com security@ubuntu.com security@ubuntu.com
linux — linux_kernel	It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.	2024-01-08	7.8	CVE-2022-2586 security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com
linux — linux_kernel	io_uring UAF, Unix SCM garbage collection	2024-01-08	7	CVE-2022-2602 security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com
linux — kernel	It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.	2024-01-08	7.8	CVE-2021-3600 security@ubuntu.com security@ubuntu.com security@ubuntu.com
linux — kernel	It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0.	2024-01-08	7.8	CVE-2022-2588 security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com
lopalopa — dynamic_lab_management_system	A vulnerability was found in Kashipara Dynamic Lab Management System up to 1.0. It has been classified as critical. This affects an unknown part of the file /admin/admin_login_process.php. The manipulation of the argument admin_password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249873 was assigned to this vulnerability.	2024-01-08	7.5	CVE-2024-0306 cna@vuldb.com cna@vuldb.com cna@vuldb.com
lopalopa — dynamic_lab_management_system	A vulnerability was found in Kashipara Dynamic Lab Management System up to 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login_process.php. The manipulation of the argument password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249874 is the identifier assigned to this vulnerability.	2024-01-08	7.5	CVE-2024-0307 cna@vuldb.com cna@vuldb.com cna@vuldb.com
machothemes — strong_testimonials	Cross-Site Request Forgery (CSRF) vulnerability in WPChill Strong Testimonials.This issue affects Strong Testimonials: from n/a through 3.1.10.	2024-01-05	8.8	CVE-2023-52123 audit@patchstack.com
manageengine — adselfservice_plus	ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability.	2024-01-11	8.8	CVE-2024-0252 0fc0942c-577d-436f-ae8e-945763c79b02
mariosalexandrou — republish_old_posts	Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Republish Old Posts.This issue affects Republish Old Posts: from n/a through 1.21.	2024-01-05	8.8	CVE-2023-52145 audit@patchstack.com
mate-desktop — atril	Atril is a simple multi-page document viewer. Atril is vulnerable to a critical Command Injection Vulnerability. This vulnerability gives the attacker immediate access to the target system when the target user opens a crafted document or clicks on a crafted link/URL using a maliciously crafted CBT document which is a TAR archive. A patch is available at commit ce41df6.	2024-01-12	9.6	CVE-2023-51698 security-advisories@github.com security-advisories@github.com
meowapps — database_cleaner	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Database Cleaner: Clean, Optimize & Repair.This issue affects Database Cleaner: Clean, Optimize & Repair: from n/a through 0.9.8.	2024-01-08	7.5	CVE-2023-51508 audit@patchstack.com
metagauss — profilegrid	Missing Authorization vulnerability in Profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profiles, Memberships, Groups and Communities: from n/a through 5.0.3.	2024-01-08	8.8	CVE-2022-36352 audit@patchstack.com
microchip — maxview_storage_manager	In default installations of Microchip maxView Storage Manager (for Adaptec Smart Storage Controllers) where Redfish server is configured for remote system management, unauthorized access can occur, with data modification and information disclosure. This affects 3.00.23484 through 4.14.00.26064 (except for the patched versions 3.07.23980 and 4.07.00.25339).	2024-01-08	9.1	CVE-2024-22216 cve@mitre.org
microsoft — .net	.NET Denial of Service Vulnerability	2024-01-09	7.5	CVE-2024-20672 secure@microsoft.com
microsoft — .net_8.0	NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability	2024-01-09	9.1	CVE-2024-0057 secure@microsoft.com
microsoft — .net_framework	.NET Framework Denial of Service Vulnerability	2024-01-09	7.5	CVE-2024-21312 secure@microsoft.com
microsoft — azure_storage_mover	Azure Storage Mover Remote Code Execution Vulnerability	2024-01-09	8	CVE-2024-20676 secure@microsoft.com
microsoft — azure_uamqp	Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.	2024-01-09	9.8	CVE-2024-21646 security-advisories@github.com security-advisories@github.com
microsoft — microsoft_office_2019	A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint and Outlook for Windows and Mac. Versions of Office that had this feature enabled will no longer have access to it. This includes Office 2019, Office 2021, Office LTSC for Mac 2021, and Microsoft 365. 3D models in Office documents that were previously inserted from a FBX file will continue to work as expected unless the Link to File option was chosen at insert time. This change is effective as of the January 9, 2024 security update.	2024-01-09	7.8	CVE-2024-20677 secure@microsoft.com
microsoft — microsoft_sql_server_2022_(gdr)	Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability	2024-01-09	8.7	CVE-2024-0056 secure@microsoft.com
microsoft — microsoft_visual_studio_2017_version_15.9_(includes_15.0_-_15.8)	Visual Studio Elevation of Privilege Vulnerability	2024-01-09	7.8	CVE-2024-20656 secure@microsoft.com
microsoft — printer_metadata_troubleshooter_tool	Microsoft Printer Metadata Troubleshooter Tool Remote Code Execution Vulnerability	2024-01-09	7.8	CVE-2024-21325 secure@microsoft.com
microsoft — sharepoint_server	Microsoft SharePoint Server Remote Code Execution Vulnerability	2024-01-09	8.8	CVE-2024-21318 secure@microsoft.com
microsoft — windows_10_1507	Windows Kerberos Security Feature Bypass Vulnerability	2024-01-09	8.8	CVE-2024-20674 secure@microsoft.com
microsoft — windows_10_1507	Microsoft Message Queuing Denial of Service Vulnerability	2024-01-09	7.5	CVE-2024-20661 secure@microsoft.com
microsoft — windows_10_1507	Windows Cryptographic Services Remote Code Execution Vulnerability	2024-01-09	7.8	CVE-2024-20682 secure@microsoft.com
microsoft — windows_10_1507	Win32k Elevation of Privilege Vulnerability	2024-01-09	7.8	CVE-2024-20683 secure@microsoft.com
microsoft — windows_10_1507	Microsoft AllJoyn API Denial of Service Vulnerability	2024-01-09	7.5	CVE-2024-20687 secure@microsoft.com
microsoft — windows_10_1507	Remote Desktop Client Remote Code Execution Vulnerability	2024-01-09	7.5	CVE-2024-21307 secure@microsoft.com
microsoft — windows_10_1809	Windows Libarchive Remote Code Execution Vulnerability	2024-01-09	7.3	CVE-2024-20696 secure@microsoft.com
microsoft — windows_10_1809	Windows Kernel Elevation of Privilege Vulnerability	2024-01-09	7.8	CVE-2024-20698 secure@microsoft.com
microsoft — windows_10_1809	Windows Hyper-V Remote Code Execution Vulnerability	2024-01-09	7.5	CVE-2024-20700 secure@microsoft.com
microsoft — windows_10_1809	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	2024-01-09	7.8	CVE-2024-21310 secure@microsoft.com
microsoft — windows_10_21h2	Windows Subsystem for Linux Elevation of Privilege Vulnerability	2024-01-09	7.8	CVE-2024-20681 secure@microsoft.com
microsoft — windows_10_version_1809	Microsoft ODBC Driver Remote Code Execution Vulnerability	2024-01-09	8	CVE-2024-20654 secure@microsoft.com
microsoft — windows_10_version_1809	Windows HTML Platforms Security Feature Bypass Vulnerability	2024-01-09	7.5	CVE-2024-20652 secure@microsoft.com
microsoft — windows_10_version_1809	Windows Group Policy Elevation of Privilege Vulnerability	2024-01-09	7	CVE-2024-20657 secure@microsoft.com
microsoft — windows_10_version_1809	Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability	2024-01-09	7.8	CVE-2024-20658 secure@microsoft.com
microsoft — windows_11_21h2	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	2024-01-09	7.8	CVE-2024-21309 secure@microsoft.com
microsoft — windows_11_22h2	Windows Libarchive Remote Code Execution Vulnerability	2024-01-09	7.3	CVE-2024-20697 secure@microsoft.com
microsoft — windows_server_2022,23h2_edition_(server_core_installation)	Microsoft Common Log File System Elevation of Privilege Vulnerability	2024-01-09	7.8	CVE-2024-20653 secure@microsoft.com
microsoft — windows_server_2022_23h2	Win32k Elevation of Privilege Vulnerability	2024-01-09	7.8	CVE-2024-20686 secure@microsoft.com
motopress — getwid_-_gutenberg_blocks	Any unauthenticated user may send e-mail from the site with any title or content to the admin	2024-01-08	7.5	CVE-2023-6042 contact@wpscan.com
mtrv — teachpress	Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4.	2024-01-05	8.8	CVE-2023-52129 audit@patchstack.com
ncast_project — ncast	A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249872.	2024-01-08	7.5	CVE-2024-0305 cna@vuldb.com cna@vuldb.com cna@vuldb.com
netscout — ngeniusone	An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted file.	2024-01-09	9.8	CVE-2023-26999 cve@mitre.org cve@mitre.org cve@mitre.org
nginx-ui — nginx-ui	Nginx-UI is an online statistic for Server Indicators?? Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `”desc”` and `”id”` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.	2024-01-11	7	CVE-2024-22196 security-advisories@github.com security-advisories@github.com
nginx-ui — nginx-ui	Nginx-ui is online statistics for Server Indicators?? Monitor CPU usage, memory usage, load average, and disk usage in real-time. The `Home > Preference` page exposes a small list of nginx settings such as `Nginx Access Log Path` and `Nginx Error Log Path`. However, the API also exposes `test_config_cmd`, `reload_cmd` and `restart_cmd`. While the UI doesn’t allow users to modify any of these settings, it is possible to do so by sending a request to the API. This issue may lead to authenticated Remote Code Execution, Privilege Escalation, and Information Disclosure. This issue has been patched in version 2.0.0.beta.9.	2024-01-11	7.7	CVE-2024-22197 security-advisories@github.com security-advisories@github.com
nginx-ui — nginx-ui	Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings. The `Home > Preference` page exposes a list of system settings such as `Run Mode`, `Jwt Secret`, `Node Secret` and `Terminal Start Command`. While the UI doesn’t allow users to modify the `Terminal Start Command` setting, it is possible to do so by sending a request to the API. This issue may lead to authenticated remote code execution, privilege escalation, and information disclosure. This vulnerability has been patched in version 2.0.0.beta.9.	2024-01-11	7.1	CVE-2024-22198 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
ninjateam — fastdup	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FastDup – Fastest WordPress Migration & Duplicator.This issue affects FastDup – Fastest WordPress Migration & Duplicator: from n/a through 2.1.7.	2024-01-08	7.5	CVE-2023-51406 audit@patchstack.com
nitropack — nitropack	Cross-Site Request Forgery (CSRF) vulnerability in NitroPack Inc. NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images.This issue affects NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images: from n/a through 1.10.2.	2024-01-05	8.8	CVE-2023-52121 audit@patchstack.com
nvidia — dgx_a100	NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A successful exploit of this vulnerability may lead to denial of service.	2024-01-12	7.5	CVE-2023-31032 psirt@nvidia.com
nvidia — dgx_a100	NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may cause an SMI callout vulnerability that could be used to execute arbitrary code at the SMM level. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, and information disclosure.	2024-01-12	7.5	CVE-2023-31035 psirt@nvidia.com
nvidia — dgx_a100	NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause stack memory corruption by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.	2024-01-12	9	CVE-2023-31024 psirt@nvidia.com
nvidia — dgx_a100	NVIDIA DGX A100 baseboard management controller (BMC) contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.	2024-01-12	9.3	CVE-2023-31029 psirt@nvidia.com
nvidia — dgx_a100	NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.	2024-01-12	9.3	CVE-2023-31030 psirt@nvidia.com
nvidia — triton_inference_server	NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option –model-control explicit, an attacker may use the model load API to cause a relative path traversal. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.	2024-01-12	7.5	CVE-2023-31036 psirt@nvidia.com
omron — cj-series/cs-series_cpu_modules	An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and write files form the PLC internal memory and memory card.	2024-01-10	8.6	CVE-2022-45794 ot-cert@dragos.com ot-cert@dragos.com
onenav — onenav	A vulnerability was found in OneNav up to 0.9.33. It has been classified as critical. This affects an unknown part of the file /index.php?c=api of the component API. The manipulation of the argument X-Token leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249765 was assigned to this vulnerability.	2024-01-07	9.8	CVE-2023-7210 nvd@nist.gov cna@vuldb.com cna@vuldb.com cna@vuldb.com
online_food_ordering_system_project — online_food_ordering_system	A vulnerability classified as critical was found in CodeAstro Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /admin/ of the component Admin Panel. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249778 is the identifier assigned to this vulnerability.	2024-01-05	9.8	CVE-2024-0247 cna@vuldb.com cna@vuldb.com cna@vuldb.com
open-xchange — ox_app_suite	The optional “LDAP contacts provider” could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized users could break confidentiality of information in the directory and potentially cause high load on the directory server, leading to denial of service. Encoding has been added for user-provided fragments that are used when constructing the LDAP query. No publicly available exploits are known.	2024-01-08	9.6	CVE-2023-29050 security@open-xchange.com security@open-xchange.com security@open-xchange.com security@open-xchange.com
open-xchange — ox_app_suite	A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known.	2024-01-08	8.8	CVE-2023-29048 security@open-xchange.com security@open-xchange.com security@open-xchange.com security@open-xchange.com
open-xchange — ox_app_suite	User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default was not effective in this case. Unauthorized users could discover and modify application state, including objects related to other users and contexts. We now make sure that the switch to disable user-generated templates by default works as intended and will remove the feature in future generations of the product. No publicly available exploits are known.	2024-01-08	8.1	CVE-2023-29051 security@open-xchange.com security@open-xchange.com security@open-xchange.com security@open-xchange.com
openvpn — connect	OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environment variable	2024-01-08	7.8	CVE-2023-7224 security@openvpn.net
oretnom23 — clinic_queuing_system	A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /LoginRegistration.php. The manipulation of the argument formToken leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249820.	2024-01-07	9.8	CVE-2024-0264 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
oretnom23 — clinic_queuing_system	A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php of the component GET Parameter Handler. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249821 was assigned to this vulnerability.	2024-01-07	8.8	CVE-2024-0265 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
ovation — dynamic_content_for_elementor	Cross-Site Request Forgery (CSRF) vulnerability in Ovation S.R.L. Dynamic Content for Elementor.This issue affects Dynamic Content for Elementor: from n/a before 2.12.5.	2024-01-05	8.8	CVE-2023-52150 audit@patchstack.com
phome — empirecms	SQL injection vulnerability in EmpireCMS v7.5, allows remote attackers to execute arbitrary code and obtain sensitive information via the DoExecSql function.	2024-01-09	7.2	CVE-2023-50162 cve@mitre.org
phpgurukul — dairy_farm_shop_management_system	A vulnerability, which was classified as critical, was found in PHPGurukul Dairy Farm Shop Management System up to 1.1. Affected is an unknown function of the file add-category.php. The manipulation of the argument category leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250122 is the identifier assigned to this vulnerability.	2024-01-10	9.8	CVE-2024-0355 cna@vuldb.com cna@vuldb.com cna@vuldb.com
phpgurukul — hospital_management_system	A vulnerability was found in PHPGurukul Hospital Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/edit-doctor-specialization.php. The manipulation of the argument doctorspecilization leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250127.	2024-01-10	9.8	CVE-2024-0360 cna@vuldb.com cna@vuldb.com cna@vuldb.com
phpgurukul — hospital_management_system	A vulnerability classified as critical has been found in PHPGurukul Hospital Management System 1.0. Affected is an unknown function of the file admin/contact.php. The manipulation of the argument mobnum leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250128.	2024-01-10	9.8	CVE-2024-0361 cna@vuldb.com cna@vuldb.com cna@vuldb.com
phpgurukul — hospital_management_system	A vulnerability classified as critical was found in PHPGurukul Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/change-password.php. The manipulation of the argument cpass leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-250129 was assigned to this vulnerability.	2024-01-10	9.8	CVE-2024-0362 cna@vuldb.com cna@vuldb.com cna@vuldb.com
phpgurukul — hospital_management_system	A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file admin/patient-search.php. The manipulation of the argument searchdata leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250130 is the identifier assigned to this vulnerability.	2024-01-10	9.8	CVE-2024-0363 cna@vuldb.com cna@vuldb.com cna@vuldb.com
phpgurukul — hospital_management_system	A vulnerability, which was classified as critical, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file admin/query-details.php. The manipulation of the argument adminremark leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250131.	2024-01-10	9.8	CVE-2024-0364 cna@vuldb.com cna@vuldb.com cna@vuldb.com
presstigers — simple_job_board	Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board.This issue affects Simple Job Board: from n/a through 2.10.6.	2024-01-05	8.8	CVE-2023-52122 audit@patchstack.com
prestashow — google_integrator	Blind SQL Injection vulnerability in PrestaShow Google Integrator (PrestaShop addon) allows for data extraction and modification. This attack is possible via command insertion in one of the cookies.	2024-01-08	9.1	CVE-2023-6921 cvd@cert.pl cvd@cert.pl cvd@cert.pl
ptc — kepware_kepserverex	An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM.	2024-01-10	7.8	CVE-2023-29445 ot-cert@dragos.com ot-cert@dragos.com ot-cert@dragos.com
puma — puma	Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.	2024-01-08	7.5	CVE-2024-21647 security-advisories@github.com security-advisories@github.com
pyload — pyload	pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.	2024-01-08	8.8	CVE-2023-47890 cve@mitre.org cve@mitre.org
pyload — pyload	pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.	2024-01-08	7.5	CVE-2024-21644 security-advisories@github.com security-advisories@github.com
qnap — qcalagent	An OS command injection vulnerability has been reported to affect QcalAgent. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: QcalAgent 1.1.8 and later	2024-01-05	8.8	CVE-2023-41289 security@qnapsecurity.com.tw
qnap — qts	An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later	2024-01-05	7.2	CVE-2023-39294 security@qnapsecurity.com.tw
qnap — qts	A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that have incompatible type, which may lead to a crash via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later	2024-01-05	7.5	CVE-2023-39296 security@qnapsecurity.com.tw
qnap — qts	A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later	2024-01-05	7.2	CVE-2023-45039 security@qnapsecurity.com.tw
qnap — qts	A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later	2024-01-05	7.2	CVE-2023-45040 security@qnapsecurity.com.tw
qnap — qts	A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later	2024-01-05	7.2	CVE-2023-45041 security@qnapsecurity.com.tw
qnap — qts	A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later	2024-01-05	7.2	CVE-2023-45042 security@qnapsecurity.com.tw
qnap — qts	A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later	2024-01-05	7.2	CVE-2023-45043 security@qnapsecurity.com.tw
qnap — qts	A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later	2024-01-05	7.2	CVE-2023-45044 security@qnapsecurity.com.tw
qnap — qumagie	A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: QuMagie 2.2.1 and later	2024-01-05	8.8	CVE-2023-47219 security@qnapsecurity.com.tw
qnap — qumagie	An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: QuMagie 2.2.1 and later	2024-01-05	8.8	CVE-2023-47560 security@qnapsecurity.com.tw
qnap — video_station	A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 ( 2023/11/23 ) and later	2024-01-05	8.8	CVE-2023-41287 security@qnapsecurity.com.tw
qnap — video_station	An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 ( 2023/11/23 ) and later	2024-01-05	8.8	CVE-2023-41288 security@qnapsecurity.com.tw
redis — redis	Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue has been patched in version 7.0.15 and 7.2.4.	2024-01-10	8.1	CVE-2023-41056 security-advisories@github.com security-advisories@github.com security-advisories@github.com
reputeinfosystems — armember	Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup.This issue affects ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: n/a.	2024-01-08	9.8	CVE-2023-52200 audit@patchstack.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution (RCE) with root privileges on the device.	2024-01-10	8.1	CVE-2023-48243 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts.	2024-01-10	8.1	CVE-2023-48250 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account.	2024-01-10	8.1	CVE-2023-48251 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests.	2024-01-10	8.8	CVE-2023-48252 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request. By abusing this vulnerability it is possible to exfiltrate other users’ password hashes or update them with arbitrary values and access their accounts.	2024-01-10	8.8	CVE-2023-48253 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.	2024-01-10	8.1	CVE-2023-48262 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.	2024-01-10	8.1	CVE-2023-48263 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.	2024-01-10	8.1	CVE-2023-48264 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.	2024-01-10	8.1	CVE-2023-48265 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.	2024-01-10	8.1	CVE-2023-48266 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges on the device. The vulnerability can be exploited directly by authenticated users, via crafted HTTP requests, or indirectly by unauthenticated users, by accessing already-exported backup packages, or crafting an import package and inducing an authenticated victim into sending the HTTP upload request.	2024-01-10	7.8	CVE-2023-48257 psirt@bosch.com
sap — gui_connector	Under certain conditions the Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) – version 1.0, allows an attacker to access highly sensitive information which would otherwise be restricted causing high impact on confidentiality.	2024-01-09	7.5	CVE-2024-22125 cna@sap.com cna@sap.com
sap — lt_replication_server	SAP LT Replication Server – version S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108, does not perform necessary authorization checks. This could allow an attacker with high privileges to perform unintended actions, resulting in escalation of privileges, which has High impact on confidentiality, integrity and availability of the system.	2024-01-09	7.2	CVE-2024-21735 cna@sap.com cna@sap.com
sap_se — sap_application_interface_framework_(file_adapter)	In SAP Application Interface Framework File Adapter – version 702, a high privilege user can use a function module to traverse through various layers and execute OS commands directly. By this, such user can control the behavior of the application. This leads to considerable impact on confidentiality, integrity and availability.	2024-01-09	8.4	CVE-2024-21737 cna@sap.com cna@sap.com
schneider_electric — easergy_studio	A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain higher privileges by providing a harmful serialized object.	2024-01-09	7.8	CVE-2023-7032 cybersecurity@se.com
siemens — jt2go	A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V14.1 (All versions < V14.1.0.12), Teamcenter Visualization V14.2 (All versions < V14.2.0.9), Teamcenter Visualization V14.3 (All versions < V14.3.0.6). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted CGM files. This could allow an attacker to execute code in the context of the current process.	2024-01-09	7.8	CVE-2023-51439 productcert@siemens.com
siemens — jt2go	A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V14.1 (All versions < V14.1.0.12), Teamcenter Visualization V14.2 (All versions < V14.2.0.9), Teamcenter Visualization V14.3 (All versions < V14.3.0.6). The affected applications contain a stack overflow vulnerability while parsing specially crafted CGM files. This could allow an attacker to execute code in the context of the current process.	2024-01-09	7.8	CVE-2023-51745 productcert@siemens.com
siemens — jt2go	A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V14.1 (All versions < V14.1.0.12), Teamcenter Visualization V14.2 (All versions < V14.2.0.9), Teamcenter Visualization V14.3 (All versions < V14.3.0.6). The affected applications contain a stack overflow vulnerability while parsing specially crafted CGM files. This could allow an attacker to execute code in the context of the current process.	2024-01-09	7.8	CVE-2023-51746 productcert@siemens.com
siemens — simatic_cn_4100	A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The “intermediate installation” system state of the affected application allows an attacker to add their own login credentials to the device. This allows an attacker to remotely login as root and take control of the device even after the affected device is fully set up.	2024-01-09	9.8	CVE-2023-49251 productcert@siemens.com
siemens — simatic_cn_4100	A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The “intermediate installation” system state of the affected application uses default credential with admin privileges. An attacker could use the credentials to gain complete control of the affected device.	2024-01-09	9.8	CVE-2023-49621 productcert@siemens.com
siemens — simatic_cn_4100	A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The affected application allows IP configuration change without authentication to the device. This could allow an attacker to cause denial of service condition.	2024-01-09	7.5	CVE-2023-49252 productcert@siemens.com
siemens — simatic_ipc1047e	A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC647E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC847E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows). In default installations of maxView Storage Manager where Redfish® server is configured for remote system management, a vulnerability has been identified that can provide unauthorized access.	2F024-01-09	10	CVE-2023-51438 productcert@siemens.com
siemens — solid_edge_se2023	A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	2024-01-09	7.8	CVE-2023-49121 productcert@siemens.com
siemens — solid_edge_se2023	A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	2024-01-09	7.8	CVE-2023-49122 productcert@siemens.com
siemens — solid_edge_se2023	A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	2024-01-09	7.8	CVE-2023-49123 productcert@siemens.com
siemens — solid_edge_se2023	A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	2024-01-09	7.8	CVE-2023-49124 productcert@siemens.com
siemens — solid_edge_se2023	A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	2024-01-09	7.8	CVE-2023-49126 productcert@siemens.com
siemens — solid_edge_se2023	A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	2024-01-09	7.8	CVE-2023-49127 productcert@siemens.com
siemens — solid_edge_se2023	A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted PAR file. This could allow an attacker to execute code in the context of the current process.	2024-01-09	7.8	CVE-2023-49128 productcert@siemens.com
siemens — solid_edge_se2023	A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain a stack overflow vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	2024-01-09	7.8	CVE-2023-49129 productcert@siemens.com
siemens — solid_edge_se2023	A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.	2024-01-09	7.8	CVE-2023-49130 productcert@siemens.com
siemens — solid_edge_se2023	A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.	2024-01-09	7.8	CVE-2023-49131 productcert@siemens.com
siemens — solid_edge_se2023	A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.	2024-01-09	7.8	CVE-2023-49132 productcert@siemens.com
siemens — spectrum_power_7	A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q4). The affected product’s sudo configuration permits the local administrative account to execute several entries as root user. This could allow an authenticated local attacker to inject arbitrary code and gain root access.	2024-01-09	7.8	CVE-2023-44120 productcert@siemens.com
smartersite — wp_compress_â€“_image_optimizer_[all-in-one]	The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the css parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.	2024-01-11	9.1	CVE-2023-6699 security@wordfence.com security@wordfence.com
smashballoon — custom_twitter_feeds	Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2.	2024-01-05	8.8	CVE-2023-52136 audit@patchstack.com
snapcreek — duplicator	The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server.	2024-01-08	9.8	CVE-2018-25095 contact@wpscan.com
studip — stud.ip	Stud.IP 5.x through 5.3.3 allows XSS with resultant upload of executable files, because upload_action and edit_action in Admin_SmileysController do not check the file extension. This leads to remote code execution with the privileges of the www-data user. The fixed versions are 5.3.4, 5.2.6, 5.1.7, and 5.0.9.	2024-01-08	9	CVE-2023-50982 cve@mitre.org cve@mitre.org cve@mitre.org
stylishpricelist — stylish_price_list	Cross-Site Request Forgery (CSRF) vulnerability in Designful Stylish Price List – Price Table Builder & QR Code Restaurant Menu.This issue affects Stylish Price List – Price Table Builder & QR Code Restaurant Menu: from n/a through 7.0.17.	2024-01-05	9.8	CVE-2023-51673 audit@patchstack.com
subnet — powersystem_center	PowerSYSTEM Center versions 2020 Update 16 and prior contain a vulnerability that may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges.	2024-01-08	7.8	CVE-2023-6631 ics-cert@hq.dhs.gov ics-cert@hq.dhs.gov
surajghosh — hospital_management_system	A vulnerability classified as critical was found in Kashipara Hospital Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file login.php of the component Parameter Handler. The manipulation of the argument email/password leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249823.	2024-01-07	9.8	CVE-2024-0267 cna@vuldb.com cna@vuldb.com cna@vuldb.com
surajghosh — hospital_management_system	A vulnerability, which was classified as critical, has been found in Kashipara Hospital Management System up to 1.0. Affected by this issue is some unknown functionality of the file registration.php. The manipulation of the argument name/email/pass/gender/age/city leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249824.	2024-01-07	9.8	CVE-2024-0268 cna@vuldb.com cna@vuldb.com cna@vuldb.com
svnlabs — html5_mp3_player_with_folder_feedburner_playlist_free	Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Folder Feedburner Playlist Free.This issue affects HTML5 MP3 Player with Folder Feedburner Playlist Free: from n/a through 2.8.0.	2024-01-08	7.2	CVE-2023-52202 audit@patchstack.com
svnlabs — html5_mp3_player_with_playlist_free	Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Playlist Free.This issue affects HTML5 MP3 Player with Playlist Free: from n/a through 3.0.0.	2024-01-08	8.8	CVE-2023-52207 audit@patchstack.com
svnlabs — html5_soundcloud_player_with_playlist_free	Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 SoundCloud Player with Playlist Free.This issue affects HTML5 SoundCloud Player with Playlist Free: from n/a through 2.8.0.	2024-01-08	7.2	CVE-2023-52205 audit@patchstack.com
taggbox — taggbox	Deserialization of Untrusted Data vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics. This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1.	2024-01-08	9.8	CVE-2023-52225 audit@patchstack.com
taokeyun — taokeyun	A vulnerability was found in Taokeyun up to 1.0.5. It has been classified as critical. Affected is the function login of the file application/index/controller/m/User.php of the component HTTP POST Request Handler. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250584.	2024-01-13	7.3	CVE-2024-0479 cna@vuldb.com cna@vuldb.com cna@vuldb.com
taokeyun — taokeyun	A vulnerability was found in Taokeyun up to 1.0.5. It has been declared as critical. Affected by this vulnerability is the function index of the file application/index/controller/m/Drs.php of the component HTTP POST Request Handler. The manipulation of the argument cid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250585 was assigned to this vulnerability.	2024-01-13	7.3	CVE-2024-0480 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
tenda — a18_firmware	Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.	2024-01-09	9.8	CVE-2023-50585 cve@mitre.org
tenda — ax12_firmware	Buffer Overflow vulnerability in Tenda AX12 V22.03.01.46, allows remote attackers to cause a denial of service (DoS) via list parameter in SetNetControlList function.	2024-01-10	7.5	CVE-2023-49427 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formSetIptv.	2024-01-10	9.8	CVE-2023-51952 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv.	2024-01-10	9.8	CVE-2023-51953 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formSetIptv.	2024-01-10	9.8	CVE-2023-51954 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formSetIptv.	2024-01-10	9.8	CVE-2023-51955 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formSetIptv	2024-01-10	9.8	CVE-2023-51956 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formGetIptv.	2024-01-10	9.8	CVE-2023-51957 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formGetIptv.	2024-01-10	9.8	CVE-2023-51958 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formGetIptv.	2024-01-10	9.8	CVE-2023-51959 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formGetIptv.	2024-01-10	9.8	CVE-2023-51960 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formGetIptv.	2024-01-10	9.8	CVE-2023-51961 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function setIptvInfo.	2024-01-10	9.8	CVE-2023-51962 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function setIptvInfo.	2024-01-10	9.8	CVE-2023-51963 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function setIptvInfo.	2024-01-10	9.8	CVE-2023-51964 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function setIptvInfo.	2024-01-10	9.8	CVE-2023-51965 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function setIptvInfo.	2024-01-10	9.8	CVE-2023-51966 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function getIptvInfo.	2024-01-10	9.8	CVE-2023-51967 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function getIptvInfo.	2024-01-10	9.8	CVE-2023-51968 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function getIptvInfo.	2024-01-10	9.8	CVE-2023-51969 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv.	2024-01-10	9.8	CVE-2023-51970 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function getIptvInfo.	2024-01-10	9.8	CVE-2023-51971 cve@mitre.org
tenda — ax1803_firmware	Tenda AX1803 v1.0.0.1 was discovered to contain a command injection vulnerability via the function fromAdvSetLanIp.	2024-01-10	9.8	CVE-2023-51972 cve@mitre.org
tenda — i29_firmware	Buffer Overflow vulnerability in Tenda i29 versions 1.0 V1.0.0.5 and 1.0 V1.0.0.2, allows remote attackers to cause a denial of service (DoS) via the pingIp parameter in the pingSet function.	2024-01-05	7.5	CVE-2023-50991 cve@mitre.org
themepunch — slider_revolution	The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution.	2024-01-08	8.8	CVE-2023-6528 contact@wpscan.com
thimpress — learnpress_â€“_wordpress_lms_plugin	The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	2024-01-11	9.8	CVE-2023-6567 security@wordfence.com security@wordfence.com
tianocore — edk2	EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.	2024-01-09	7	CVE-2022-36763 infosec@edk2.groups.io
tianocore — edk2	EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.	2024-01-09	7	CVE-2022-36764 infosec@edk2.groups.io
tianocore — edk2	EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.	2024-01-09	7	CVE-2022-36765 infosec@edk2.groups.io
tinowagner — jupyter_notebook_viewer	nbviewer-app (aka Jupyter Notebook Viewer) before 0.1.6 has the get-task-allow entitlement for release builds.	2024-01-05	9.8	CVE-2023-51277 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
totolink — lr1200gb_firmware	A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected is the function setOpModeCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249858 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-08	9.8	CVE-2024-0292 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — lr1200gb_firmware	A vulnerability classified as critical was found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected by this vulnerability is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249859. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-08	9.8	CVE-2024-0293 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — lr1200gb_firmware	A vulnerability, which was classified as critical, has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected by this issue is the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249860. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-08	9.8	CVE-2024-0294 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — lr1200gb_firmware	A vulnerability, which was classified as critical, was found in Totolink LR1200GB 9.1.0u.6619_B20230130. This affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249861 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-08	9.8	CVE-2024-0295 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — lr1200gb_firmware	A vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been rated as critical. This issue affects the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249857 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-08	8.8	CVE-2024-0291 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — n200re_firmware	A vulnerability has been found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This vulnerability affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument host_time leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249862 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-08	9.8	CVE-2024-0296 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — n200re_firmware	A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This issue affects the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249863. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-08	9.8	CVE-2024-0297 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — n200re_firmware	A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. Affected is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249864. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-08	9.8	CVE-2024-0298 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — n200re_firmware	A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been declared as critical. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249865 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-08	9.8	CVE-2024-0299 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — n350rt_firmware	A vulnerability has been found in Totolink N350RT 9.3.5u.6139_B202012 and classified as critical. Affected by this vulnerability is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249853 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-09	9.8	CVE-2023-7219 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — n350rt_firmware	A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6139_B20201216. Affected by this vulnerability is the function main of the file /cgi-bin/cstecgi.cgi?action=login&flag=1 of the component HTTP POST Request Handler. The manipulation of the argument v33 leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249769 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-07	8.8	CVE-2023-7213 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — n350rt_firmware	A vulnerability, which was classified as critical, has been found in Totolink N350RT 9.3.5u.6139_B20201216. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument v8 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249770 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-07	8.8	CVE-2023-7214 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — n350rt_firmware	A vulnerability, which was classified as critical, was found in Totolink N350RT 9.3.5u.6139_B202012. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-249852. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-08	7.2	CVE-2023-7218 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — nr1800x_firmware	A vulnerability was found in Totolink NR1800X 9.1.0u.6279_B20210910 and classified as critical. Affected by this issue is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249854 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-09	9.8	CVE-2023-7220 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — t6_firmware	A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. It has been classified as critical. This affects the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument v41 leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249855. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-09	9.8	CVE-2023-7221 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — x2000r_firmware	A vulnerability classified as critical was found in Totolink X2000R_V2 2.0.0-B20230727.10434. This vulnerability affects the function formTmultiAP of the file /bin/boa. The manipulation leads to buffer overflow. VDB-249742 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-07	9.8	CVE-2023-7208 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — x2000r_firmware	A vulnerability was found in Totolink X2000R 1.0.0-B20221212.1452. It has been declared as critical. This vulnerability affects the function formTmultiAP of the file /bin/boa of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249856. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-09	9.8	CVE-2023-7222 cna@vuldb.com cna@vuldb.com cna@vuldb.com
tp-link — tapo	TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel.	2024-01-09	7.5	CVE-2023-27098 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
trellix — agent	A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause a Denial of Service (DoS), through exploiting a memory corruption issue in the TA service, which runs as root. This may also result in the disabling of event reporting to ePO, caused by failure to validate input from the file correctly.	2024-01-09	7.8	CVE-2024-0213 trellixpsirt@trellix.com
trellix — anti-malware_engine	A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local user to potentially gain an escalation of privileges. This was achieved by adding an entry to the registry under the Trellix ENS registry folder with a symbolic link to files that the user wouldn’t normally have permission to. After a scan, the Engine would follow the links and remove the files	2024-01-09	7.1	CVE-2024-0206 trellixpsirt@trellix.com
trendnet — tv-ip1314pi_firmware	An issue was discovered in libremote_dbg.so on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Filtering of debug information is mishandled during use of popen. Consequently, an attacker can bypass validation and execute a shell command.	2024-01-09	9.8	CVE-2023-49235 cve@mitre.org cve@mitre.org
trendnet — tv-ip1314pi_firmware	A stack-based buffer overflow was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices, leading to arbitrary command execution. This occurs because of lack of length validation during a sscanf of a user-entered scale field in the RTSP playback function of davinci.	2024-01-09	9.8	CVE-2023-49236 cve@mitre.org cve@mitre.org
uniwayinfo — uw-302vp_firmware	A vulnerability was found in Uniway Router 2.0. It has been declared as critical. This vulnerability affects unknown code of the component Administrative Web Interface. The manipulation leads to reliance on ip address for authentication. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-249766 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-07	8.1	CVE-2023-7211 cna@vuldb.com cna@vuldb.com cna@vuldb.com
uniwayinfo — uw-302vp_firmware	A vulnerability was found in Uniway Router up to 2.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boaform/device_reset.cgi of the component Device Reset Handler. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249758 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-07	7.5	CVE-2023-7209 cna@vuldb.com cna@vuldb.com cna@vuldb.com
wallix — bastion	WALLIX Bastion 7.x, 8.x, 9.x and 10.x and WALLIX Access Manager 3.x and 4.x have Incorrect Access Control which can lead to sensitive data exposure.	2024-01-08	7.5	CVE-2023-49961 cve@mitre.org
wazuh — wazuh	Wazuh is a free and open source platform used for threat prevention, detection, and response. This bug introduced a stack overflow hazard that could allow a local privilege escalation. This vulnerability was patched in version 4.5.3.	2024-01-12	7.4	CVE-2023-42463 security-advisories@github.com
wiselyhub — js_help_desk	Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.	2024-01-05	9.8	CVE-2022-46839 audit@patchstack.com
wordpress — wordpress	Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway. This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.1.	2024-01-05	9.8	CVE-2023-51502 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in UkrSolution Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce.This issue affects Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce: from n/a through 1.5.1.	2024-01-08	9.8	CVE-2023-52215 audit@patchstack.com
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in Anton Bond Woocommerce Tranzila Payment Gateway. This issue affects Woocommerce Tranzila Payment Gateway: from n/a through 1.0.8.	2024-01-08	9.8	CVE-2023-52218 audit@patchstack.com
wordpress — wordpress	Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More.This issue affects Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More: from n/a through 2.1.5.	2024-01-08	8.8	CVE-2022-34344 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Product Bundles for WooCommerce.This issue affects WPC Product Bundles for WooCommerce: from n/a through 7.3.1.	2024-01-05	8.8	CVE-2023-52127 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard.This issue affects White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard: from n/a through 2.9.0.	2024-01-05	8.8	CVE-2023-52128 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Cool Plugins Events Shortcodes For The Events Calendar.This issue affects Events Shortcodes For The Events Calendar: from n/a through 2.3.1.	2024-01-08	8.8	CVE-2023-52142 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.2.2.	2024-01-08	8.8	CVE-2023-52222 audit@patchstack.com
wordpress — wordpress	The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.9. This is due to missing or incorrect nonce validation on the update_password_validate function. This makes it possible for unauthenticated attackers to reset a user’s password via a forged request granted they can trick the user into performing an action such as clicking on a link.	2024-01-11	8.8	CVE-2023-5448 security@wordfence.com security@wordfence.com
wordpress — wordpress	The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally, default settings will place an index.php and a .htaccess file into the chosen directory (unless already present) when the first backup job is run that are intended to prevent directory listing and file access. This means that an attacker could set the backup directory to the root of another site in a shared environment and thus disable that site.	2024-01-11	8.7	CVE-2023-5504 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution.	2024-01-08	8.8	CVE-2023-6140 contact@wpscan.com
wordpress — wordpress	The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the ‘piotnetforms_ajax_form_builder’ function in versions up to, and including, 1.0.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible.	2024-01-11	8.1	CVE-2023-6220 security@wordfence.com security@wordfence.com
wordpress — wordpress	The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due to the plugin making use of the call_user_func function with user input. This makes it possible for unauthenticated attackers to execute any public function with one parameter, which could result in remote code execution.	2024-01-11	8.1	CVE-2023-6634 security@wordfence.com security@wordfence.com
wordpress — wordpress	The CommentTweets WordPress plugin through 0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks	2024-01-08	8.8	CVE-2023-6845 contact@wpscan.com contact@wpscan.com
wordpress — wordpress	The Slick Social Share Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘dcssb_ajax_update’ function in versions up to, and including, 2.4.11. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily.	2024-01-11	8.8	CVE-2023-6878 security@wordfence.com security@wordfence.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StudioWombat WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce.This issue affects WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce: from n/a through 1.4.3.	2024-01-08	7.5	CVE-2023-51408 audit@patchstack.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Naa986 WP Stripe Checkout.This issue affects WP Stripe Checkout: from n/a through 1.2.2.37.	2024-01-05	7.5	CVE-2023-52143 audit@patchstack.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Swings Coupon Referral Program.This issue affects Coupon Referral Program: from n/a through 1.7.2.	2024-01-08	7.5	CVE-2023-52190 audit@patchstack.com
wordpress — wordpress	The Ni Purchase Order(PO) For WooCommerce WordPress plugin through 1.2.1 does not validate logo and signature image files uploaded in the settings, allowing high privileged user to upload arbitrary files to the web server, triggering an RCE vulnerability by uploading a web shell.	2024-01-08	7.2	CVE-2023-5957 contact@wpscan.com
wordpress — wordpress	The Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download the debug log without authorization and gain access to sensitive data	2024-01-08	7.5	CVE-2023-6383 contact@wpscan.com
wordpress — wordpress	The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files.	2024-01-08	7.5	CVE-2023-6505 contact@wpscan.com
wordpress — wordpress	The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the ‘upload_import_file’ function in versions up to, and including, 2.4.8. This makes it possible for authenticated attackers with shop manager-level capabilities or above, to upload arbitrary files on the affected site’s server which may make remote code execution possible.	2024-01-11	7.2	CVE-2023-6558 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the ‘gspb_save_files’ function in versions up to, and including, 7.6.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site’s server which may make remote code execution possible.	2024-01-11	7.2	CVE-2023-6636 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function publish_website in all versions up to, and including, 1.9.7. This makes it possible for unauthenticated attackers to enable and disable maintenance mode.	2024-01-11	7.3	CVE-2023-6751 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ arf_http_referrer_url’ parameter in all versions up to, and including, 1.5.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	7.2	CVE-2023-6828 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ivole_import_upload_csv AJAX action in all versions up to, and including, 5.38.9. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site’s server which may make remote code execution possible.	2024-01-11	9.8	CVE-2023-6979 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of the handle_downloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to download back-up files which can contain sensitive information such as user passwords, PII, database credentials, and much more.	2024-01-11	7.5	CVE-2023-6266 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wow-company — floating_button	Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Floating Button.This issue affects Floating Button: from n/a through 6.0.	2024-01-05	8.8	CVE-2023-52149 audit@patchstack.com
wp-blogs-planetarium_project — wp-blogs-planetarium	The WP Blogs’ Planetarium WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack	2024-01-08	8.8	CVE-2023-6532 contact@wpscan.com contact@wpscan.com
wpaffiliatemanager — affiliates_manager	Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.31.	2024-01-05	8.8	CVE-2023-52130 audit@patchstack.com
wpchill — download_monitor	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7.60.	2024-01-08	7.5	CVE-2022-45354 audit@patchstack.com
wpexpertsio — post_smtp_â€“_the_#1_wordpress_smtp_plugin_with_advanced_email_logging_and_delivery_failure_notifications	The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover.	2024-01-11	9.8	CVE-2023-6875 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wpjobportal — wp_job_portal	Cross-Site Request Forgery (CSRF) vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a through 2.0.6.	2024-01-05	8.8	CVE-2023-52184 audit@patchstack.com
wpmudev — defender_security	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender Security – Malware Scanner, Login Security & Firewall: from n/a through 4.1.0.	2024-01-08	7.5	CVE-2023-51490 audit@patchstack.com
wpzone — inline_image_upload_for_bbpress	Cross-Site Request Forgery (CSRF) vulnerability in WP Zone Inline Image Upload for BBPress.This issue affects Inline Image Upload for BBPress: from n/a through 1.1.18.	2024-01-05	8.8	CVE-2023-51668 audit@patchstack.com
wwbn — avideo	A cross-site scripting (xss) vulnerability exists in the navbarMenuAndLogo.php user name functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.	2024-01-10	8.5	CVE-2023-48730 talos-cna@cisco.com
wwbn — avideo	An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to an arbitrary user password recovery. An attacker can send an HTTP request to trigger this vulnerability.	2024-01-10	8.8	CVE-2023-49589 talos-cna@cisco.com
wwbn — avideo	A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.	2024-01-10	9	CVE-2023-47861 talos-cna@cisco.com
wwbn — avideo	A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send a series of HTTP requests to trigger this vulnerability.	2024-01-10	9.8	CVE-2023-47862 talos-cna@cisco.com
wwbn — avideo	A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.	2024-01-10	9.6	CVE-2023-48728 talos-cna@cisco.com
wwbn — avideo	An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and brute force the salt offline, leading to forging a legitimate password recovery code for the admin user.	2024-01-10	9.8	CVE-2023-49599 talos-cna@cisco.com
wwbn — avideo	An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.	2024-01-10	7.5	CVE-2023-49738 talos-cna@cisco.com
wwbn — avideo	A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user credentials. An attacker can send a series of HTTP requests to trigger this vulnerability.	2024-01-10	7.3	CVE-2023-49810 talos-cna@cisco.com
xen — xen	For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped when PV guests run, Xen and shadowed PV guests run directly the respective shadow page tables. For 64-bit PV guests this means running on the shadow of the guest root page table. In the course of dealing with shortage of memory in the shadow pool associated with a domain, shadows of page tables may be torn down. This tearing down may include the shadow root page table that the CPU in question is presently running on. While a precaution exists to supposedly prevent the tearing down of the underlying live page table, the time window covered by that precaution isn’t large enough.	2024-01-05	7.8	CVE-2023-34322 security@xen.org
xen — xen	[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] libfsimage contains parsing code for several filesystems, most of them based on grub-legacy code. libfsimage is used by pygrub to inspect guest disks. Pygrub runs as the same user as the toolstack (root in a priviledged domain). At least one issue has been reported to the Xen Security Team that allows an attacker to trigger a stack buffer overflow in libfsimage. After further analisys the Xen Security Team is no longer confident in the suitability of libfsimage when run against guest controlled input with super user priviledges. In order to not affect current deployments that rely on pygrub patches are provided in the resolution section of the advisory that allow running pygrub in deprivileged mode. CVE-2023-4949 refers to the original issue in the upstream grub project (“An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory corruption in grub’s XFS file system implementation.”) CVE-2023-34325 refers specifically to the vulnerabilities in Xen’s copy of libfsimage, which is decended from a very old version of grub.	2024-01-05	7.8	CVE-2023-34325 security@xen.org
xen — xen	The caching invalidation guidelines from the AMD-Vi specification (48882-Rev 3.07-PUB-Oct 2022) is incorrect on some hardware, as devices will malfunction (see stale DMA mappings) if some fields of the DTE are updated but the IOMMU TLB is not flushed. Such stale DMA mappings can point to memory ranges not owned by the guest, thus allowing access to unindented memory regions.	2024-01-05	7.8	CVE-2023-34326 security@xen.org
xwiki — xwiki	XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the “first name” or “last name” fields during user registration. This impacts all installations that have user registration enabled for guests. This vulnerability has been patched in XWiki 14.10.17, 15.5.3 and 15.8 RC1.	2024-01-08	9.8	CVE-2024-21650 security-advisories@github.com security-advisories@github.com security-advisories@github.com
xwiki — xwiki	XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback action is missing a right protection, a user can rollback to a previous version of the page to gain rights they don’t have anymore. The problem has been patched in XWiki 14.10.17, 15.5.3 and 15.8-rc-1 by ensuring that the rights are checked before performing the rollback.	2024-01-09	8.8	CVE-2024-21648 security-advisories@github.com security-advisories@github.com security-advisories@github.com
yevhenkotelnytskyi — js_&_css_script_optimizer	Cross-Site Request Forgery (CSRF) vulnerability in Yevhen Kotelnytskyi JS & CSS Script Optimizer.This issue affects JS & CSS Script Optimizer: from n/a through 0.3.3.	2024-01-08	8.8	CVE-2023-52216 audit@patchstack.com
youke365 — youke_365	A vulnerability, which was classified as critical, was found in Youke365 up to 1.5.3. Affected is an unknown function of the file /app/api/controller/caiji.php of the component Parameter Handler. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249870 is the identifier assigned to this vulnerability.	2024-01-08	9.8	CVE-2024-0303 cna@vuldb.com cna@vuldb.com cna@vuldb.com
youke365 — youke_365	A vulnerability has been found in Youke365 up to 1.5.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/collect.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249871.	2024-01-08	9.8	CVE-2024-0304 cna@vuldb.com cna@vuldb.com cna@vuldb.com
zohocorp — manageengine_firewall_analyzer	A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.	2024-01-08	8.6	CVE-2023-47211 talos-cna@cisco.com talos-cna@cisco.com
zoom_video_communications_inc. — zoom_desktop_client_for_windows/zoom_vdi_client_for_windows/zoom_sdks_for_windows	Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenticated user to conduct an escalation of privilege via local access.	2024-01-12	8.8	CVE-2023-49647 security@zoom.us

Medium Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
react-native-mmkv– react-native-mmkv	react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app’s thread model. This issue has been patched in version 2.11.0.	2024-01-09	4.4	CVE-2024-21668 security-advisories@github.com security-advisories@github.com security-advisories@github.com
acritum — femitter_server	A vulnerability, which was classified as problematic, was found in Acritum Femitter Server 1.04. Affected is an unknown function. The manipulation leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250446 is the identifier assigned to this vulnerability.	2024-01-12	4.3	CVE-2010-10011 cna@vuldb.com cna@vuldb.com cna@vuldb.com
adobe — substance3d_stager	Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-01-10	5.5	CVE-2024-20714 psirt@adobe.com
adobe — substance3d_stager	Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-01-10	5.5	CVE-2024-20715 psirt@adobe.com
adobe — substance_3d_stager	Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-01-10	5.5	CVE-2024-20710 psirt@adobe.com
adobe — substance_3d_stager	Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-01-10	5.5	CVE-2024-20711 psirt@adobe.com
adobe — substance_3d_stager	Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-01-10	5.5	CVE-2024-20712 psirt@adobe.com
adobe — substance_3d_stager	Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	2024-01-10	5.5	CVE-2024-20713 psirt@adobe.com
ajexperience — 404_solution	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a through 2.33.0.	2024-01-05	5.3	CVE-2023-52146 audit@patchstack.com
apollo — apollo	A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. VDB-250430 is the identifier assigned to this vulnerability. NOTE: The maintainer explains that user data information like user id, name, and email are not sensitive.	2024-01-12	4.3	CVE-2022-4962 cna@vuldb.com cna@vuldb.com cna@vuldb.com
apple — macos	This issue was addressed with improved data protection. This issue is fixed in macOS Sonoma 14. An app may be able to access user-sensitive data.	2024-01-10	5.5	CVE-2023-40411 product-security@apple.com
apple — macos	A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access removable volumes without user consent.	2024-01-10	5.5	CVE-2023-40430 product-security@apple.com
apple — macos	This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access sensitive user data.	2024-01-10	5.5	CVE-2023-41987 product-security@apple.com
apple — macos	A logic issue was addressed with improved checks This issue is fixed in macOS Sonoma 14. A camera extension may be able to access the camera view from apps other than the app for which it was granted permission.	2024-01-10	5.5	CVE-2023-41994 product-security@apple.com
apple — macos	The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access protected user data.	2024-01-10	5.5	CVE-2023-42929 product-security@apple.com
appwrite — command_line_interface	In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials.	2024-01-09	5.5	CVE-2023-50974 cve@mitre.org cve@mitre.org
arm — valhall_gpu_kernel_driver	Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU processing operations to gain access to already freed memory. This issue affects Valhall GPU Kernel Driver: from r37p0 through r40p0.	2024-01-08	5.5	CVE-2023-5091 arm-security@arm.com
austin — austin	A vulnerability was found in ZhongFuCheng3y Austin 1.0 and classified as critical. This issue affects the function getFile of the file com/java3y/austin/web/controller/MaterialController.java of the component Upload Material Menu. The manipulation leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250619.	2024-01-13	5.5	CVE-2024-0505 cna@vuldb.com cna@vuldb.com cna@vuldb.com
autelrobotics — evo_nano_drone_firmware	Autel EVO NANO drone flight control firmware version 1.6.5 is vulnerable to denial of service (DoS).	2024-01-06	5.7	CVE-2023-50121 cve@mitre.org
ava — teaching_video_application_service_platform	Cross Site Scripting (XSS) vulnerability in AVA teaching video application service platform version 3.1, allows remote attackers to execute arbitrary code via a crafted script to ajax.aspx.	2024-01-06	6.1	CVE-2023-50609 cve@mitre.org
blood_bank_&_donor_management — blood_bank_&_donor_management	A vulnerability has been found in Blood Bank & Donor Management 5.6 and classified as critical. This vulnerability affects unknown code of the file /admin/request-received-bydonar.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250564.	2024-01-12	4.7	CVE-2024-0459 cna@vuldb.com cna@vuldb.com cna@vuldb.com
campcodes — student_information_system	A vulnerability was found in Campcodes Student Information System 1.0. It has been classified as critical. Affected is an unknown function of the file /classes/Users.php?f=save. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250602 is the identifier assigned to this vulnerability.	2024-01-13	6.3	CVE-2024-0497 cna@vuldb.com cna@vuldb.com cna@vuldb.com
cformsii_project — cformsii	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Oliver Seidel, Bastian Germann cformsII allows Stored XSS.This issue affects cformsII: from n/a through 15.0.5.	2024-01-08	4.8	CVE-2023-52203 audit@patchstack.com
chanzhaoyu — chatgpt_web	A vulnerability, which was classified as problematic, has been found in Chanzhaoyu chatgpt-web 2.11.1. This issue affects some unknown processing. The manipulation of the argument Description with the input leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249779.	2024-01-08	6.1	CVE-2023-7215 cna@vuldb.com cna@vuldb.com cna@vuldb.com
chromiumembedded — cef	CEF (Chromium Embedded Framework ) is a simple framework for embedding Chromium-based browsers in other applications. `CefLayeredWindowUpdaterOSR::OnAllocatedSharedMemory` does not check the size of the shared memory, which leads to out-of-bounds read outside the sandbox. This vulnerability was patched in commit 1f55d2e.	2024-01-12	5.3	CVE-2024-21639 security-advisories@github.com security-advisories@github.com
chromiumembedded — cef	Chromium Embedded Framework (CEF) is a simple framework for embedding Chromium-based browsers in other applications.`CefVideoConsumerOSR::OnFrameCaptured` does not check `pixel_format` properly, which leads to out-of-bounds read out of the sandbox. This vulnerability was patched in commit 1f55d2e.	2024-01-13	5.4	CVE-2024-21640 security-advisories@github.com security-advisories@github.com
code-projects — dormitory_management_system	A vulnerability classified as critical has been found in code-projects Dormitory Management System 1.0. Affected is an unknown function of the file comment.php. The manipulation of the argument com leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250578 is the identifier assigned to this vulnerability.	2024-01-12	6.3	CVE-2024-0473 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — dormitory_management_system	A vulnerability, which was classified as critical, has been found in code-projects Dormitory Management System 1.0. Affected by this issue is some unknown functionality of the file modifyuser.php. The manipulation of the argument user_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250580.	2024-01-13	6.3	CVE-2024-0475 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — employee_profile_management_system	A vulnerability, which was classified as critical, has been found in code-projects Employee Profile Management System 1.0. This issue affects some unknown processing of the file file_table.php. The manipulation of the argument per_id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250571.	2024-01-12	5.5	CVE-2024-0466 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — faculty_management_system	A vulnerability was found in code-projects Faculty Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/pages/student-print.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250565 was assigned to this vulnerability.	2024-01-12	6.3	CVE-2024-0460 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — fighting_c***_information_system	A vulnerability has been found in code-projects Fighting C*** Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/action/new-father.php. The manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250573 was assigned to this vulnerability.	2024-01-12	6.3	CVE-2024-0468 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — fighting_c***_information_system	A vulnerability has been found in code-projects Fighting C*** Information System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/action/update-deworm.php. The manipulation of the argument usage_deworm leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250582 is the identifier assigned to this vulnerability.	2024-01-13	6.3	CVE-2024-0477 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — fighting_c***_information_system	A vulnerability was found in code-projects Fighting C*** Information System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/pages/edit_chicken.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250583.	2024-01-13	6.3	CVE-2024-0478 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — fighting_c***_information_system	A vulnerability, which was classified as critical, has been found in code-projects Fighting C*** Information System 1.0. This issue affects some unknown processing of the file admin/action/update_mother.php. The manipulation of the argument age_mother leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250589 was assigned to this vulnerability.	2024-01-13	6.3	CVE-2024-0484 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — fighting_c***_information_system	A vulnerability, which was classified as critical, was found in code-projects Fighting C*** Information System 1.0. Affected is an unknown function of the file admin/pages/tables/add_con.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250590 is the identifier assigned to this vulnerability.	2024-01-13	6.3	CVE-2024-0485 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — fighting_c***_information_system	A vulnerability has been found in code-projects Fighting C*** Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/action/add_con.php. The manipulation of the argument chicken leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250591.	2024-01-13	6.3	CVE-2024-0486 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — fighting_c***_information_system	A vulnerability was found in code-projects Fighting C*** Information System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/action/delete-vaccine.php. The manipulation of the argument ref leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250592.	2024-01-13	6.3	CVE-2024-0487 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — fighting_c***_information_system	A vulnerability was found in code-projects Fighting C*** Information System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/action/new-feed.php. The manipulation of the argument type_feed leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250593 was assigned to this vulnerability.	2024-01-13	6.3	CVE-2024-0488 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — fighting_c***_information_system	A vulnerability was found in code-projects Fighting C*** Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/action/edit_chicken.php. The manipulation of the argument ref leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250594 is the identifier assigned to this vulnerability.	2024-01-13	6.3	CVE-2024-0489 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — human_resource_integrated_system	A vulnerability was found in code-projects Human Resource Integrated System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file update_personal_info.php. The manipulation of the argument sex leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250574 is the identifier assigned to this vulnerability.	2024-01-12	6.3	CVE-2024-0469 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — human_resource_integrated_system	A vulnerability was found in code-projects Human Resource Integrated System 1.0. It has been classified as critical. This affects an unknown part of the file /admin_route/inc_service_credits.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250575.	2024-01-12	6.3	CVE-2024-0470 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — human_resource_integrated_system	A vulnerability was found in code-projects Human Resource Integrated System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin_route/dec_service_credits.php. The manipulation of the argument date leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250576.	2024-01-12	6.3	CVE-2024-0471 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — online_faculty_clearance	A vulnerability was found in code-projects Online Faculty Clearance 1.0. It has been classified as critical. Affected is an unknown function of the file deactivate.php of the component HTTP POST Request Handler. The manipulation of the argument haydi leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250566 is the identifier assigned to this vulnerability.	2024-01-12	6.3	CVE-2024-0461 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — online_faculty_clearance	A vulnerability was found in code-projects Online Faculty Clearance 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /production/designee_view_status.php of the component HTTP POST Request Handler. The manipulation of the argument haydi leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250567.	2024-01-12	6.3	CVE-2024-0462 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — online_faculty_clearance	A vulnerability was found in code-projects Online Faculty Clearance 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /production/admin_view_info.php of the component HTTP POST Request Handler. The manipulation of the argument haydi leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250568.	2024-01-12	6.3	CVE-2024-0463 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — online_faculty_clearance	A vulnerability classified as critical has been found in code-projects Online Faculty Clearance 1.0. This affects an unknown part of the file delete_faculty.php of the component HTTP GET Request Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250569 was assigned to this vulnerability.	2024-01-12	6.3	CVE-2024-0464 cna@vuldb.com cna@vuldb.com cna@vuldb.com
codecabin — wp_go_maps	The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.28 does not properly protect most of its REST API routes, which attackers can abuse to store malicious HTML/Javascript on the site.	2024-01-08	6.1	CVE-2023-6627 contact@wpscan.com contact@wpscan.com
deshang — dscms	A vulnerability classified as problematic has been found in DeShang DSCMS up to 3.1.2/7.1. Affected is an unknown function of the file public/install.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250434 is the identifier assigned to this vulnerability.	2024-01-11	5.3	CVE-2024-0414 cna@vuldb.com cna@vuldb.com cna@vuldb.com
deshang — dskms	A vulnerability was found in DeShang DSKMS up to 3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file public/install.php. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250433 was assigned to this vulnerability.	2024-01-11	5.3	CVE-2024-0413 cna@vuldb.com cna@vuldb.com cna@vuldb.com
deshang — dsmall	A vulnerability classified as critical was found in DeShang DSMall up to 6.1.0. Affected by this vulnerability is an unknown functionality of the file application/home/controller/TaobaoExport.php of the component Image URL Handler. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250435.	2024-01-11	6.3	CVE-2024-0415 cna@vuldb.com cna@vuldb.com cna@vuldb.com
deshang — dsmall	A vulnerability was found in DeShang DSMall up to 6.1.0. It has been classified as problematic. This affects an unknown part of the file public/install.php of the component HTTP GET Request Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250431.	2024-01-11	5.3	CVE-2024-0411 cna@vuldb.com cna@vuldb.com cna@vuldb.com
deshang — dsmall	A vulnerability, which was classified as critical, has been found in DeShang DSMall up to 5.0.3. Affected by this issue is some unknown functionality of the file application/home/controller/MemberAuth.php. The manipulation of the argument file_name leads to path traversal: ‘../filedir’. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250436.	2024-01-11	5.4	CVE-2024-0416 cna@vuldb.com cna@vuldb.com cna@vuldb.com
deshang — dsshop	A vulnerability was found in DeShang DSShop up to 3.1.0. It has been declared as problematic. This vulnerability affects unknown code of the file public/install.php of the component HTTP GET Request Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250432.	2024-01-11	5.3	CVE-2024-0412 cna@vuldb.com cna@vuldb.com cna@vuldb.com
deshang — dsshop	A vulnerability, which was classified as critical, was found in DeShang DSShop up to 2.1.5. This affects an unknown part of the file application/home/controller/MemberAuth.php. The manipulation of the argument member_info leads to path traversal: ‘../filedir’. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250437 was assigned to this vulnerability.	2024-01-11	5.4	CVE-2024-0417 cna@vuldb.com cna@vuldb.com cna@vuldb.com
discourse — discourse	Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4.	2024-01-12	4.3	CVE-2024-21655 security-advisories@github.com
dlink — r15_firmware	D-Link R15 before v1.08.02 was discovered to contain no firewall restrictions for IPv6 traffic. This allows attackers to arbitrarily access any services running on the device that may be inadvertently listening via IPv6.	2024-01-10	5.3	CVE-2023-41603 cve@mitre.org
download-station — download-station	A vulnerability, which was classified as critical, has been found in unknown-o download-station up to 1.1.8. This issue affects some unknown processing of the file index.php. The manipulation of the argument f leads to path traversal: ‘../filedir’. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250121 was assigned to this vulnerability.	2024-01-10	5.3	CVE-2024-0354 cna@vuldb.com cna@vuldb.com cna@vuldb.com
dso2o — dso2o	A vulnerability was found in DeShang DSO2O up to 4.1.0. It has been classified as critical. This affects an unknown part of the file /install/install.php. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250125 was assigned to this vulnerability.	2024-01-10	5.3	CVE-2024-0358 cna@vuldb.com cna@vuldb.com cna@vuldb.com
dzzoffice — dzzoffice	SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent parameters in the Network Disk backend module.	2024-01-06	6.5	CVE-2023-39853 cve@mitre.org
easyxdm — easyxdm	easyXDM 2.5 allows XSS via the xdm_e parameter.	2024-01-08	6.1	CVE-2023-27739 cve@mitre.org
elan — dell_inspiron	ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.	2024-01-12	6	CVE-2024-0454 36106deb-8e95-420b-a0a0-e70af5d245df
engineers_online_portal_project — engineers_online_portal	A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to sensitive cookie without secure attribute. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-250117 was assigned to this vulnerability.	2024-01-09	5.3	CVE-2024-0349 cna@vuldb.com cna@vuldb.com cna@vuldb.com
eva — eva	A vulnerability was found in coderd-repos Eva 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the file /system/traceLog/page of the component HTTP POST Request Handler. The manipulation of the argument property leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250124.	2024-01-10	5.5	CVE-2024-0357 cna@vuldb.com cna@vuldb.com cna@vuldb.com
ewels — cpt_bootstrap_carousel	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Phil Ewels CPT Bootstrap Carousel allows Reflected XSS. This issue affects CPT Bootstrap Carousel: from n/a through 1.12.	2024-01-08	6.1	CVE-2023-52196 audit@patchstack.com
firefly-iii — firefly_iii	Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.	2024-01-05	6.1	CVE-2024-22075 cve@mitre.org
fortinet — fortipam	An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiPAM 1.0 all versions allows an authenticated attacker to perform a denial of service attack via sending crafted HTTP or HTTPS requests in a high frequency.	2024-01-10	4.3	CVE-2023-37934 psirt@fortinet.com
fortinet — fortiportal	An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, version 5.3.8 and below may allow a remote authenticated user with at least read-only permissions to access to other organization endpoints via crafted GET requests.	2024-01-10	5.4	CVE-2023-48783 psirt@fortinet.com
fortinet — fortivoice	An improper limitation of a pathname to a restricted directory (‘path traversal’) vulnerability [CWE-22] in FortiVoiceEntreprise version 7.0.0 and before 6.4.7 allows an authenticated attacker to read arbitrary files from the system via sending crafted HTTP or HTTPS requests	2024-01-10	6.5	CVE-2023-37932 psirt@fortinet.com
foru — cms	A vulnerability, which was classified as critical, has been found in ForU CMS up to 2020-06-23. This issue affects some unknown processing of the file admin/cms_template.php. The manipulation of the argument t_name/t_path leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250445 was assigned to this vulnerability.	2024-01-11	6.3	CVE-2024-0426 cna@vuldb.com cna@vuldb.com cna@vuldb.com
foru — cms	A vulnerability classified as critical was found in ForU CMS up to 2020-06-23. This vulnerability affects unknown code of the file /admin/index.php?act=reset_admin_psw. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250444.	2024-01-11	5.3	CVE-2024-0425 cna@vuldb.com cna@vuldb.com cna@vuldb.com
get-simple — getsimplecms	A Cross Site Scripting (XSS) vulnerability in GetSimple CMS 3.3.16 exists when using Source Code Mode as a backend user to add articles via the /admin/edit.php page.	2024-01-08	5.4	CVE-2023-51246 cve@mitre.org cve@mitre.org
gitlab — gitlab	An improper access control vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group.	2024-01-12	6.6	CVE-2023-6955 cve@gitlab.com
hamidrezasepehr — wp_custom_cursors_\|_wordpress_cursor_plugin	The WP Custom Cursors \| WordPress Cursor Plugin WordPress plugin through 3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)	2024-01-08	4.8	CVE-2023-5911 contact@wpscan.com
huaxia — erp	A vulnerability was found in Huaxia ERP up to 3.1. It has been rated as problematic. This issue affects some unknown processing of the file /user/getAllList. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-250595.	2024-01-13	5.3	CVE-2024-0490 cna@vuldb.com cna@vuldb.com cna@vuldb.com
huaxia — erp	A vulnerability classified as problematic has been found in Huaxia ERP up to 3.1. Affected is an unknown function of the file src/main/java/com/jsh/erp/controller/UserController.java. The manipulation leads to weak password recovery. It is possible to launch the attack remotely. Upgrading to version 3.2 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-250596.	2024-01-13	5.3	CVE-2024-0491 cna@vuldb.com cna@vuldb.com cna@vuldb.com
i13websolution — email_subscription_popup	The Email Subscription Popup WordPress plugin before 1.2.20 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin	2024-01-08	6.1	CVE-2023-6555 contact@wpscan.com
ibm — aix	IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the pmsvcs kernel extension to cause a denial of service. IBM X-Force ID: 267967.	2024-01-11	6.2	CVE-2023-45169 psirt@us.ibm.com psirt@us.ibm.com
ibm — aix	IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the kernel to cause a denial of service. IBM X-Force ID: 267969.	2024-01-11	6.2	CVE-2023-45171 psirt@us.ibm.com psirt@us.ibm.com
ibm — aix	IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the NFS kernel extension to cause a denial of service. IBM X-Force ID: 267971.	2024-01-11	6.2	CVE-2023-45173 psirt@us.ibm.com psirt@us.ibm.com
ibm — aix	IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel extension to cause a denial of service. IBM X-Force ID: 267973.	2024-01-11	6.2	CVE-2023-45175 psirt@us.ibm.com psirt@us.ibm.com
ibm — security_verify_access_appliance	IBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to obtain sensitive configuration information. IBM X-Force ID: 260584.	2024-01-11	6.2	CVE-2023-38267 psirt@us.ibm.com psirt@us.ibm.com
ibm — security_verify_access_appliance	IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) temporarily stores sensitive information in files that could be accessed by a local user. IBM X-Force ID: 254653.	2024-01-11	5.1	CVE-2023-31001 psirt@us.ibm.com psirt@us.ibm.com
icewarp — icewarp	A vulnerability classified as problematic has been found in IceWarp 12.0.2.1/12.0.3.1. This affects an unknown part of the file /install/ of the component Utility Download Handler. The manipulation of the argument lang with the input 1%27″()%26%25 leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249759. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-05	6.1	CVE-2024-0246 cna@vuldb.com cna@vuldb.com
iframe_project — iframe	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in webvitaly iframe allows Stored XSS.This issue affects iframe: from n/a through 4.8.	2024-01-05	5.4	CVE-2023-52125 audit@patchstack.com
impactpixel — ads_invalid_click_protection	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Impactpixel Ads Invalid Click Protection allows Stored XSS.This issue affects Ads Invalid Click Protection: from n/a through 1.0.	2024-01-08	4.8	CVE-2023-52197 audit@patchstack.com
infoblox — nios	A stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the VLAN View Name field.	2024-01-09	5.4	CVE-2022-28975 cve@mitre.org cve@mitre.org
inis — inis	A vulnerability classified as critical has been found in Inis up to 2.0.1. Affected is an unknown function of the file /app/api/controller/default/Sqlite.php. The manipulation of the argument sql leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250110 is the identifier assigned to this vulnerability.	2024-01-09	6.3	CVE-2024-0342 cna@vuldb.com cna@vuldb.com cna@vuldb.com
isharer_and_upredsun — file_sharing_wizard	A vulnerability has been found in iSharer and upRedSun File Sharing Wizard up to 1.5.0 and classified as problematic. This vulnerability affects unknown code of the component GET Request Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250438 is the identifier assigned to this vulnerability.	2024-01-11	5.3	CVE-2024-0418 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
jasper — httpdx	A vulnerability was found in Jasper httpdx up to 1.5.4 and classified as problematic. This issue affects some unknown processing of the component HTTP POST Request Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250439.	2024-01-11	5.3	CVE-2024-0419 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
jetbrains — youtrack	In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible	2024-01-09	5.4	CVE-2024-22370 cve@jetbrains.com
juniper_networks — junos_os	An Improper Check for Unusual or Exceptional Conditions vulnerability in Juniper DHCP Daemon (jdhcpd) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause the jdhcpd to consume all the CPU cycles resulting in a Denial of Service (DoS). On Junos OS devices with forward-snooped-client configured, if an attacker sends a specific DHCP packet to a non-configured interface, this will cause an infinite loop. The DHCP process will have to be restarted to recover the service. This issue affects: Juniper Networks Junos OS * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S2; * 22.4 versions earlier than 22.4R2-S2, 22.4R3; * 23.2 versions earlier than 23.2R2.	2024-01-12	6.5	CVE-2023-36842 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os	An Improper Handling of Exceptional Conditions vulnerability in the broadband edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an attacker directly connected to the vulnerable system who repeatedly flaps DHCP subscriber sessions to cause a slow memory leak, ultimately leading to a Denial of Service (DoS). Memory can only be recovered by manually restarting bbe-smgd. This issue only occurs if BFD liveness detection for DHCP subscribers is enabled. Systems without BFD liveness detection enabled are not vulnerable to this issue. Indication of the issue can be observed by periodically executing the ‘show system processes extensive’ command, which will indicate an increase in memory allocation for bbe-smgd. A small amount of memory is leaked every time a DHCP subscriber logs in, which will become visible over time, ultimately leading to memory starvation. user@junos> show system processes extensive \| match bbe-smgd 13071 root 24 0 415M 201M select 0 0:41 7.28% bbe-smgd{bbe-smgd} 13071 root 20 0 415M 201M select 1 0:04 0.00% bbe-smgd{bbe-smgd} … user@junos> show system processes extensive \| match bbe-smgd 13071 root 20 0 420M 208M select 0 4:33 0.10% bbe-smgd{bbe-smgd} 13071 root 20 0 420M 208M select 0 0:12 0.00% bbe-smgd{bbe-smgd} … This issue affects Juniper Networks Junos OS on MX Series: * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S2; * 22.4 versions earlier than 22.4R2-S2, 22.4R3; * 23.2 versions earlier than 23.2R1-S1, 23.2R2.	2024-01-12	6.5	CVE-2024-21587 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os	A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). If an MX Series device receives PTP packets on an MPC3E that doesn’t support PTP this causes a memory leak which will result in unpredictable behavior and ultimately in an MPC crash and restart. To monitor for this issue, please use the following FPC vty level commands: show heap shows an increase in “LAN buffer” utilization and show clksync ptp nbr-upd-info shows non-zero “Pending PFEs” counter. This issue affects Juniper Networks Junos OS on MX Series with MPC3E: * All versions earlier than 20.4R3-S3; * 21.1 versions earlier than 21.1R3-S4; * 21.2 versions earlier than 21.2R3; * 21.3 versions earlier than 21.3R2-S1, 21.3R3; * 21.4 versions earlier than 21.4R2; * 22.1 versions earlier than 22.1R2.	2024-01-12	6.5	CVE-2024-21599 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os	An Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on PTX Series allows a unauthenticated, adjacent attacker to cause a Denial of Service (DoS). When MPLS packets are meant to be sent to a flexible tunnel interface (FTI) and if the FTI tunnel is down, these will hit the reject NH, due to which the packets get sent to the CPU and cause a host path wedge condition. This will cause the FPC to hang and requires a manual restart to recover. Please note that this issue specifically affects PTX1000, PTX3000, PTX5000 with FPC3, PTX10002-60C, and PTX10008/16 with LC110x. Other PTX Series devices and Line Cards (LC) are not affected. The following log message can be seen when the issue occurs: Cmerror Op Set: Host Loopback: HOST LOOPBACK WEDGE DETECTED IN PATH ID (URI: /fpc//pfe//cm//Host_Loopback//HOST_LOOPBACK_MAKE_CMERROR_ID[]) This issue affects Juniper Networks Junos OS: * All versions earlier than 20.4R3-S8; * 21.1 versions earlier than 21.1R3-S4; * 21.2 versions earlier than 21.2R3-S6; * 21.3 versions earlier than 21.3R3-S3; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R2-S2, 22.1R3; * 22.2 versions earlier than 22.2R2-S1, 22.2R3.	2024-01-12	6.5	CVE-2024-21600 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os	An Improper Check for Unusual or Exceptional Conditions vulnerability in the kernel of Juniper Network Junos OS on MX Series allows a network based attacker with low privileges to cause a denial of service. If a scaled configuration for Source class usage (SCU) / destination class usage (DCU) (more than 10 route classes) is present and the SCU/DCU statistics are gathered by executing specific SNMP requests or CLI commands, a ‘vmcore’ for the RE kernel will be seen which leads to a device restart. Continued exploitation of this issue will lead to a sustained DoS. This issue only affects MX Series devices with MPC10, MPC11 or LC9600, and MX304. No other MX Series devices are affected. This issue affects Juniper Networks Junos OS: * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S6; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3; * 22.1 versions earlier than 22.1R3; * 22.2 versions earlier than 22.2R2; * 22.3 versions earlier than 22.3R2.	2024-01-12	6.5	CVE-2024-21603 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os	An Incomplete Cleanup vulnerability in Nonstop active routing (NSR) component of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause memory leak leading to Denial of Service (DoS). On all Junos OS platforms, when NSR is enabled, a BGP flap will cause memory leak. A manual reboot of the system will restore the services. The memory usage can be monitored using the below commands. user@host> show chassis routing-engine no-forwarding user@host> show system memory \| no-more This issue affects: Juniper Networks Junos OS * 21.2 versions earlier than 21.2R3-S5; * 21.3 versions earlier than 21.3R3-S4; * 21.4 versions earlier than 21.4R3-S4; * 22.1 versions earlier than 22.1R3-S2; * 22.2 versions earlier than 22.2R3-S2; * 22.3 versions earlier than 22.3R2-S1, 22.3R3; * 22.4 versions earlier than 22.4R1-S2, 22.4R2. This issue does not affect Junos OS versions earlier than 20.4R3-S7.	2024-01-12	6.5	CVE-2024-21617 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os	A Heap-based Buffer Overflow vulnerability in the Network Services Daemon (NSD) of Juniper Networks Junos OS allows authenticated, low privileged, local attacker to cause a Denial of Service (DoS). On an SRX 5000 Series device, when executing a specific command repeatedly, memory is corrupted, which leads to a Flow Processing Daemon (flowd) crash. The NSD process has to be restarted to restore services. If this issue occurs, it can be checked with the following command: user@host> request security policies check The following log message can also be observed: Error: policies are out of sync for PFE node.fpc.pic. This issue affects: Juniper Networks Junos OS on SRX 5000 Series * All versions earlier than 20.4R3-S6; * 21.1 versions earlier than 21.1R3-S5; * 21.2 versions earlier than 21.2R3-S4; * 21.3 versions earlier than 21.3R3-S3; * 21.4 versions earlier than 21.4R3-S3; * 22.1 versions earlier than 22.1R3-S1; * 22.2 versions earlier than 22.2R3; * 22.3 versions earlier than 22.3R2.	2024-01-12	5.5	CVE-2024-21594 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os	An Exposure of Resource to Wrong Sphere vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the intended access restrictions. In an Abstracted Fabric (AF) scenario if routing-instances (RI) are configured, specific valid traffic destined to the device can bypass the configured lo0 firewall filters as it’s received in the wrong RI context. This issue affects Juniper Networks Junos OS on MX Series: * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S3; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3; * 22.2 versions earlier than 22.2R3; * 22.3 versions earlier than 22.3R2.	2024-01-12	5.3	CVE-2024-21597 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os	A Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) vulnerability in the Flow-processing Daemon (flowd) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (Dos). On SRX Series devices when two different threads try to simultaneously process a queue which is used for TCP events flowd will crash. One of these threads can not be triggered externally, so the exploitation of this race condition is outside the attackers direct control. Continued exploitation of this issue will lead to a sustained DoS. This issue affects Juniper Networks Junos OS: * 21.2 versions earlier than 21.2R3-S5; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S4; * 22.1 versions earlier than 22.1R3-S3; * 22.2 versions earlier than 22.2R3-S1; * 22.3 versions earlier than 22.3R2-S2, 22.3R3; * 22.4 versions earlier than 22.4R2-S1, 22.4R3. This issue does not affect Juniper Networks Junos OS versions earlier than 21.2R1.	2024-01-12	5.9	CVE-2024-21601 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os	An Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on MX Series and EX9200 Series allows an unauthenticated, network-based attacker to cause partial impact to the integrity of the device. If the “tcp-reset” option is added to the “reject” action in an IPv6 filter which matches on “payload-protocol”, packets are permitted instead of rejected. This happens because the payload-protocol match criteria is not supported in the kernel filter causing it to accept all packets without taking any other action. As a fix the payload-protocol match will be treated the same as a “next-header” match to avoid this filter bypass. This issue doesn’t affect IPv4 firewall filters. This issue affects Juniper Networks Junos OS on MX Series and EX9200 Series: * All versions earlier than 20.4R3-S7; * 21.1 versions earlier than 21.1R3-S5; * 21.2 versions earlier than 21.2R3-S5; * 21.3 versions earlier than 21.3R3-S4; * 21.4 versions earlier than 21.4R3-S4; * 22.1 versions earlier than 22.1R3-S2; * 22.2 versions earlier than 22.2R3-S2; * 22.3 versions earlier than 22.3R2-S2, 22.3R3; * 22.4 versions earlier than 22.4R1-S2, 22.4R2-S2, 22.4R3.	2024-01-12	5.3	CVE-2024-21607 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os/junos_os_evolved	A Missing Release of Memory after Effective Lifetime vulnerability in Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause an rpd crash, leading to Denial of Service (DoS). On all Junos OS and Junos OS Evolved platforms, when traffic engineering is enabled for OSPF or ISIS, and a link flaps, a patroot memory leak is observed. This memory leak, over time, will lead to an rpd crash and restart. The memory usage can be monitored using the below command. user@host> show task memory detail \| match patroot This issue affects: Juniper Networks Junos OS * All versions earlier than 21.2R3-S3; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S3; * 22.1 versions earlier than 22.1R3; * 22.2 versions earlier than 22.2R3. Juniper Networks Junos OS Evolved * All versions earlier than 21.3R3-S5-EVO; * 21.4 versions earlier than 21.4R3-EVO; * 22.1 versions earlier than 22.1R3-EVO; * 22.2 versions earlier than 22.2R3-EVO.	2024-01-12	6.5	CVE-2024-21613 sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os/junos_os_evolved	An Improper Handling of Exceptional Conditions vulnerability in BGP session processing of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker, using specific timing outside the attacker’s control, to flap BGP sessions and cause the routing protocol daemon (rpd) process to crash and restart, leading to a Denial of Service (DoS) condition. Continued BGP session flapping will create a sustained Denial of Service (DoS) condition. This issue only affects routers configured with non-stop routing (NSR) enabled. Graceful Restart (GR) helper mode, enabled by default, is also required for this issue to be exploitable. When the BGP session flaps on the NSR-enabled router, the device enters GR-helper/LLGR-helper mode due to the peer having negotiated GR/LLGR-restarter capability and the backup BGP requests for replication of the GR/LLGR-helper session, master BGP schedules, and initiates replication of GR/LLGR stale routes to the backup BGP. In this state, if the BGP session with the BGP peer comes up again, unsolicited replication is initiated for the peer without cleaning up the ongoing GR/LLGR-helper mode replication. This parallel two instances of replication for the same peer leads to the assert if the BGP session flaps again. This issue affects: Juniper Networks Junos OS * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S1; * 22.4 versions earlier than 22.4R2-S2, 22.4R3; * 23.2 versions earlier than 23.2R1-S1, 23.2R2. Juniper Networks Junos OS Evolved * All versions earlier than 21.3R3-S5-EVO; * 21.4 versions earlier than 21.4R3-S5-EVO; * 22.1 versions earlier than 22.1R3-S4-EVO; * 22.2 versions earlier than 22.2R3-S3-EVO; * 22.3 versions earlier than 22.3R3-S1-EVO; * 22.4 versions earlier than 22.4R2-S2-EVO, 22.4R3-EVO; * 23.2 versions earlier than 23.2R1-S1-EVO, 23.2R2-EVO.	2024-01-12	5.9	CVE-2024-21585 sirt@juniper.net sirt@juniper.net sirt@juniper.net
juniper_networks — junos_os/junos_os_evolved	A Heap-based Buffer Overflow vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS). If an attacker sends a specific BGP UPDATE message to the device, this will cause a memory overwrite and therefore an RPD crash and restart in the backup Routing Engine (RE). Continued receipt of these packets will cause a sustained Denial of Service (DoS) condition in the backup RE. The primary RE is not impacted by this issue and there is no impact on traffic. This issue only affects devices with NSR enabled. This issue requires an attacker to have an established BGP session to a system affected by the issue. This issue affects both eBGP and iBGP implementations. This issue affects: Juniper Networks Junos OS * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S2; * 22.3 versions earlier than 22.3R3-S1; * 22.4 versions earlier than 22.4R2-S2, 22.4R3; * 23.1 versions earlier than 23.1R2; * 23.2 versions earlier than 23.2R1-S2, 23.2R2. Juniper Networks Junos OS Evolved * All versions earlier than 21.3R3-S5-EVO; * 21.4-EVO versions earlier than 21.4R3-S5-EVO; * 22.1-EVO versions earlier than 22.1R3-S4-EVO; * 22.2-EVO versions earlier than 22.2R3-S2-EVO; * 22.3-EVO versions later than 22.3R1-EVO; * 22.4-EVO versions earlier than 22.4R2-S2-EVO, 22.4R3-EVO; * 23.1-EVO versions earlier than 23.1R2-EVO; * 23.2-EVO versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO.	2024-01-12	5.3	CVE-2024-21596 sirt@juniper.net sirt@juniper.net
juzaweb — cms	juzaweb <= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated.	2024-01-09	4.9	CVE-2023-46906 cve@mitre.org cve@mitre.org
jwx — jwx	jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification. This vulnerability has been patched in version 2.0.19.	2024-01-09	4.3	CVE-2024-21664 security-advisories@github.com security-advisories@github.com security-advisories@github.com
kashipara — billing_software	A vulnerability classified as critical was found in Kashipara Billing Software 1.0. Affected by this vulnerability is an unknown functionality of the file buyer_detail_submit.php of the component HTTP POST Request Handler. The manipulation of the argument gstn_no leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250597 was assigned to this vulnerability.	2024-01-13	6.3	CVE-2024-0492 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — billing_software	A vulnerability, which was classified as critical, has been found in Kashipara Billing Software 1.0. Affected by this issue is some unknown functionality of the file submit_delivery_list.php of the component HTTP POST Request Handler. The manipulation of the argument customer_details leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250598 is the identifier assigned to this vulnerability.	2024-01-13	6.3	CVE-2024-0493 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — billing_software	A vulnerability, which was classified as critical, was found in Kashipara Billing Software 1.0. This affects an unknown part of the file material_bill.php of the component HTTP POST Request Handler. The manipulation of the argument itemtypeid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250599.	2024-01-13	6.3	CVE-2024-0494 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — billing_software	A vulnerability has been found in Kashipara Billing Software 1.0 and classified as critical. This vulnerability affects unknown code of the file party_submit.php of the component HTTP POST Request Handler. The manipulation of the argument party_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250600.	2024-01-13	6.3	CVE-2024-0495 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — billing_software	A vulnerability was found in Kashipara Billing Software 1.0 and classified as critical. This issue affects some unknown processing of the file item_list_edit.php of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250601 was assigned to this vulnerability.	2024-01-13	6.3	CVE-2024-0496 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability, which was classified as critical, was found in Kashipara Food Management System up to 1.0. This affects an unknown part of the file item_list_submit.php. The manipulation of the argument item_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249825 was assigned to this vulnerability.	2024-01-07	6.5	CVE-2024-0270 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability has been found in Kashipara Food Management System up to 1.0 and classified as critical. This vulnerability affects unknown code of the file addmaterial_edit.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249826 is the identifier assigned to this vulnerability.	2024-01-07	6.5	CVE-2024-0271 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability was found in Kashipara Food Management System up to 1.0 and classified as critical. This issue affects some unknown processing of the file addmaterialsubmit.php. The manipulation of the argument material_name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249827.	2024-01-07	6.5	CVE-2024-0272 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability was found in Kashipara Food Management System up to 1.0. It has been classified as critical. Affected is an unknown function of the file addwaste_entry.php. The manipulation of the argument item_name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249828.	2024-01-07	6.5	CVE-2024-0273 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability was found in Kashipara Food Management System up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file billAjax.php. The manipulation of the argument item_name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249829 was assigned to this vulnerability.	2024-01-07	6.5	CVE-2024-0274 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability was found in Kashipara Food Management System up to 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file item_edit_submit.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249830 is the identifier assigned to this vulnerability.	2024-01-07	6.5	CVE-2024-0275 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability classified as critical has been found in Kashipara Food Management System up to 1.0. This affects an unknown part of the file rawstock_used_damaged_smt.php. The manipulation of the argument product_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249831.	2024-01-07	6.5	CVE-2024-0276 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability classified as critical was found in Kashipara Food Management System up to 1.0. This vulnerability affects unknown code of the file party_submit.php. The manipulation of the argument party_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249832.	2024-01-07	6.5	CVE-2024-0277 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability, which was classified as critical, has been found in Kashipara Food Management System up to 1.0. This issue affects some unknown processing of the file partylist_edit_submit.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249833 was assigned to this vulnerability.	2024-01-07	6.5	CVE-2024-0278 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability, which was classified as critical, was found in Kashipara Food Management System up to 1.0. Affected is an unknown function of the file item_list_edit.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249834 is the identifier assigned to this vulnerability.	2024-01-07	6.5	CVE-2024-0279 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability has been found in Kashipara Food Management System up to 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file item_type_submit.php. The manipulation of the argument type_name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249835.	2024-01-07	6.5	CVE-2024-0280 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability was found in Kashipara Food Management System up to 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file loginCheck.php. The manipulation of the argument password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249836.	2024-01-07	6.5	CVE-2024-0281 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability was found in Kashipara Food Management System up to 1.0. It has been classified as problematic. This affects an unknown part of the file addmaterialsubmit.php. The manipulation of the argument tin leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249837 was assigned to this vulnerability.	2024-01-07	6.1	CVE-2024-0282 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability was found in Kashipara Food Management System up to 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file party_details.php. The manipulation of the argument party_name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249838 is the identifier assigned to this vulnerability.	2024-01-07	6.1	CVE-2024-0283 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — food_management_system	A vulnerability was found in Kashipara Food Management System up to 1.0. It has been rated as problematic. This issue affects some unknown processing of the file party_submit.php. The manipulation of the argument party_address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249839.	2024-01-07	6.1	CVE-2024-0284 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kofax — capture	The application is vulnerable to Stored Cross-Site Scripting (XSS) in the endpoint /sofer/DocumentService.asc/SaveAnnotation, where input data transmitted via the POST method in the parameters author and text are not adequately sanitized and validated. This allows for the injection of malicious JavaScript code. The vulnerability was identified in the function for adding new annotations while editing document content. Reporters inform that the vulnerability has been removed in software versions above 11.1.x. Previous versions may also be vulnerable, but this has not been confirmed.	2024-01-11	5.4	CVE-2023-5118 cvd@cert.pl cvd@cert.pl
lif-platforms — lif-auth-server	Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `get_pfp` and `get_banner` routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is correct. This could allow an attacker access to files they shouldn’t have access to. This issue has been patched in version 1.4.0.	2024-01-12	4.2	CVE-2023-49801 security-advisories@github.com security-advisories@github.com
linux — kernel	It was discovered that when exec’ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free.	2024-01-08	5.3	CVE-2022-2585 security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com
linux — kernel	The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067.	2024-01-08	5.5	CVE-2023-1032 security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com security@ubuntu.com
linux — kernel	Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable. Note that 32-bit Arm-guests are not affected, as the 32-bit Linux kernel on Arm doesn’t use queued-RW-locks, which are required to trigger the issue (on Arm32 a waiting writer doesn’t block further readers to get the lock).	2024-01-05	4.9	CVE-2023-34324 security@xen.org security@xen.org security@xen.org
linux — kernel	A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.	2024-01-09	4.4	CVE-2024-0340 secalert@redhat.com secalert@redhat.com secalert@redhat.com
linux — kernel	A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error.	2024-01-12	5.5	CVE-2024-0443 secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com
mailmunch — constant_contact_forms_by_mailmunch	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in MailMunch Constant Contact Forms by MailMunch allows Stored XSS.This issue affects Constant Contact Forms by MailMunch: from n/a through 2.0.11.	2024-01-13	6.5	CVE-2024-22137 audit@patchstack.com
mapster — mapster_wp_maps	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Mapster Technology Inc. Mapster WP Maps allows Stored XSS.This issue affects Mapster WP Maps: from n/a through 1.2.38.	2024-01-08	5.4	CVE-2024-21744 audit@patchstack.com
meetyoucrop — big-whale	A vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file /auth/user/all.api of the component Admin Module. The manipulation of the argument id leads to improper ownership management. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250232.	2024-01-11	6.3	CVE-2023-7226 cna@vuldb.com cna@vuldb.com cna@vuldb.com
michielvaneerd — private_google_calendars	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Michiel van Eerd Private Google Calendars allows Stored XSS.This issue affects Private Google Calendars: from n/a through 20231125.	2024-01-08	5.4	CVE-2023-52198 audit@patchstack.com
microsoft — .net_6.0	Microsoft Identity Denial of service vulnerability	2024-01-09	6.8	CVE-2024-21319 secure@microsoft.com
microsoft — microsoft_edge_(chromium-based)	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	2024-01-11	6.3	CVE-2024-20675 secure@microsoft.com
microsoft — microsoft_edge_(chromium-based)	Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability	2024-01-11	5.2	CVE-2024-21337 secure@microsoft.com
microsoft — windows_10_1507	Microsoft Message Queuing Information Disclosure Vulnerability	2024-01-09	6.5	CVE-2024-20660 secure@microsoft.com
microsoft — windows_10_1507	Windows Message Queuing Client (MSMQC) Information Disclosure	2024-01-09	6.5	CVE-2024-20663 secure@microsoft.com
microsoft — windows_10_1507	Microsoft Message Queuing Information Disclosure Vulnerability	2024-01-09	6.5	CVE-2024-20664 secure@microsoft.com
microsoft — windows_10_1507	BitLocker Security Feature Bypass Vulnerability	2024-01-09	6.6	CVE-2024-20666 secure@microsoft.com
microsoft — windows_10_1507	Windows Message Queuing Client (MSMQC) Information Disclosure	2024-01-09	6.5	CVE-2024-20680 secure@microsoft.com
microsoft — windows_10_1507	Microsoft Message Queuing Information Disclosure Vulnerability	2024-01-09	6.5	CVE-2024-21314 secure@microsoft.com
microsoft — windows_10_1507	Windows Themes Spoofing Vulnerability	2024-01-09	6.5	CVE-2024-21320 secure@microsoft.com
microsoft — windows_10_1507	Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability	2024-01-09	5.7	CVE-2024-20692 secure@microsoft.com
microsoft — windows_10_1507	Windows Cryptographic Services Information Disclosure Vulnerability	2024-01-09	5.5	CVE-2024-21311 secure@microsoft.com
microsoft — windows_10_1507	Windows TCP/IP Information Disclosure Vulnerability	2024-01-09	5.3	CVE-2024-21313 secure@microsoft.com
microsoft — windows_10_1507	Windows Themes Information Disclosure Vulnerability	2024-01-09	4.7	CVE-2024-20691 secure@microsoft.com
microsoft — windows_10_1607	Windows Server Key Distribution Service Security Feature Bypass	2024-01-09	6.1	CVE-2024-21316 secure@microsoft.com
microsoft — windows_10_1607	Windows CoreMessaging Information Disclosure Vulnerability	2024-01-09	5.5	CVE-2024-20694 secure@microsoft.com
microsoft — windows_10_1809	Windows Nearby Sharing Spoofing Vulnerability	2024-01-09	6.5	CVE-2024-20690 secure@microsoft.com
microsoft — windows_10_1809	Windows Hyper-V Denial of Service Vulnerability	2024-01-09	5.5	CVE-2024-20699 secure@microsoft.com
microsoft — windows_10_1809	Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability	2024-01-09	4.4	CVE-2024-21305 secure@microsoft.com
microsoft — windows_10_21h2	Microsoft Bluetooth Driver Spoofing Vulnerability	2024-01-09	5.7	CVE-2024-21306 secure@microsoft.com
microsoft — windows_server_2008	Windows Online Certificate Status Protocol (OCSP) Information Disclosure Vulnerability	2024-01-09	4.9	CVE-2024-20662 secure@microsoft.com
microsoft — windows_server_2019	Microsoft Online Certificate Status Protocol (OCSP) Remote Code Execution Vulnerability	2024-01-09	6.6	CVE-2024-20655 secure@microsoft.com
mojofywp — wp_affiliate_disclosure	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in MojofyWP WP Affiliate Disclosure allows Stored XSS.This issue affects WP Affiliate Disclosure: from n/a through 1.2.7.	2024-01-05	5.4	CVE-2023-52178 audit@patchstack.com
mongodb_inc — mongodb_c_driver	When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.	2024-01-12	5.3	CVE-2023-0437 cna@mongodb.com
netapp — ontap_9	ONTAP versions 9.4 and higher are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information to unprivileged attackers when the object-store profiler command is being run by an administrative user.	2024-01-12	4.8	CVE-2024-21982 security-alert@netapp.com
netscout — ngeniusone	Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the name parameter of the Profile and Exclusion List page(s).	2024-01-09	6.1	CVE-2023-27000 cve@mitre.org cve@mitre.org cve@mitre.org
netscout — ngeniusone	Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the creator parameter of the Alert Configuration page.	2024-01-09	5.4	CVE-2023-26998 cve@mitre.org cve@mitre.org cve@mitre.org
nvidia — dgx_a100	NVIDIA DGX A100 BMC contains a vulnerability where an attacker may cause an LDAP user injection. A successful exploit of this vulnerability may lead to information disclosure.	2024-01-12	6.5	CVE-2023-31025 psirt@nvidia.com
nvidia — dgx_a100	NVIDIA DGX A100 BMC contains a vulnerability where a user may cause a missing authentication issue for a critical function by an adjacent network . A successful exploit of this vulnerability may lead to escalation of privileges, code execution, denial of service, information disclosure, and data tampering.	2024-01-12	6.8	CVE-2023-31033 psirt@nvidia.com
nvidia — dgx_a100	NVIDIA DGX A100 SBIOS contains a vulnerability where a local attacker can cause input validation checks to be bypassed by causing an integer overflow. A successful exploit of this vulnerability may lead to denial of service, information disclosure, and data tampering.	2024-01-12	6.6	CVE-2023-31034 psirt@nvidia.com
nvidia — dgx_a100	NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a heap-based buffer overflow by local access. A successful exploit of this vulnerability may lead to code execution, denial of service, information disclosure, and data tampering.	2024-01-12	4.2	CVE-2023-31031 psirt@nvidia.com
omron — sysmac_studio	[PROBLEMTYPE] in [VENDOR] [PRODUCT] [VERSION] on [PLATFORMS] allows [ATTACKER] to [IMPACT].	2024-01-10	5.5	CVE-2022-45793 ot-cert@dragos.com ot-cert@dragos.com ot-cert@dragos.com
online_job_portal — online_job_portal	A vulnerability was found in Online Job Portal 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Admin/News.php of the component Create News Page. The manipulation of the argument News with the input leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249818 is the identifier assigned to this vulnerability.	2024-01-07	4.8	CVE-2024-0262 cna@vuldb.com cna@vuldb.com cna@vuldb.com
open-xchange — ox_app_suite	The “upsell” widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised account, or gain temporary access to a legitimate account, could inject script code to gain persistent code execution capabilities under a trusted domain. User input for this widget is now sanitized to avoid malicious content the be processed. No publicly available exploits are known.	2024-01-08	6.1	CVE-2023-29049 security@open-xchange.com security@open-xchange.com security@open-xchange.com security@open-xchange.com
open-xchange — ox_app_suite	Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.	2024-01-08	5.4	CVE-2023-29052 security@open-xchange.com security@open-xchange.com security@open-xchange.com security@open-xchange.com
open-xchange — ox_app_suite	User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.	2024-01-08	5.4	CVE-2023-41710 security@open-xchange.com security@open-xchange.com security@open-xchange.com security@open-xchange.com
openedx — edx-platform	Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f.	2024-01-13	6.4	CVE-2024-22209 security-advisories@github.com security-advisories@github.com security-advisories@github.com
pallets — jinja	Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.	2024-01-11	5.4	CVE-2024-22195 security-advisories@github.com security-advisories@github.com
phpgurukul — hospital_management_system	A vulnerability, which was classified as problematic, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file index.php#contact_us of the component Contact Form. The manipulation of the argument Name/Email/Message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249843.	2024-01-07	6.1	CVE-2024-0286 cna@vuldb.com cna@vuldb.com cna@vuldb.com
pimcore — customer-data-framework	The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management, segmentation, personalization and marketing automation. An authenticated and unauthorized user can access the list of potential duplicate users and see their data. Permissions are enforced when reaching the `/admin/customermanagementframework/duplicates/list` endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. Unauthorized user(s) can access PII data from customers. This vulnerability has been patched in version 4.0.6.	2024-01-11	6.5	CVE-2024-21666 security-advisories@github.com security-advisories@github.com security-advisories@github.com
pimcore — customer-data-framework	pimcore/customer-data-framework is the Customer Management Framework for management of customer data within Pimcore. An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure. Permissions are not enforced when reaching the `/admin/customermanagementframework/gdpr-data/search-data-objects` endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. An unauthorized user can access PII data from customers. This vulnerability has been patched in version 4.0.6.	2024-01-11	6.5	CVE-2024-21667 security-advisories@github.com security-advisories@github.com security-advisories@github.com
pimcore — ecommerce-framework-bundle	ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has been patched in version 1.0.10.	2024-01-11	4.3	CVE-2024-21665 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
preh_gmbh — mib3_infotainment_unit	The Real-Time Streaming Protocol implementation in the MIB3 infotainment incorrectly handles requests to /logs URI, when the id parameter equals to zero. This issue allows an attacker connected to the in-vehicle Wi-Fi network to cause denial-of-service of the infotainment system, when the certain preconditions are met. Vulnerability discovered on Škoda Superb III (3V3) – 2.0 TDI manufactured in 2022.	2024-01-12	5.3	CVE-2023-28898 cve@asrg.io
preh_gmbh — mib3_infotainment_unit	The secret value used for access to critical UDS services of the MIB3 infotainment is hardcoded in the firmware. Vulnerability discovered on Škoda Superb III (3V3) – 2.0 TDI manufactured in 2022.	2024-01-12	4	CVE-2023-28897 cve@asrg.io
project_worlds — lawyer_management_system	A vulnerability was found in Project Worlds Lawyer Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file searchLawyer.php. The manipulation of the argument experience leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250603.	2024-01-13	6.3	CVE-2024-0498 cna@vuldb.com cna@vuldb.com cna@vuldb.com
proofpoint — proofpoint_enterprise_protection	Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.	2024-01-09	5.3	CVE-2023-5770 security@proofpoint.com
ptc — kepware_kepserverex	An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution.	2024-01-10	6.3	CVE-2023-29444 ot-cert@dragos.com ot-cert@dragos.com
ptc — kepware_kepserverex	An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication.	2024-01-10	5.7	CVE-2023-29447 ot-cert@dragos.com ot-cert@dragos.com ot-cert@dragos.com
ptc — kepware_kepserverex	An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline.	2024-01-10	4.7	CVE-2023-29446 ot-cert@dragos.com ot-cert@dragos.com ot-cert@dragos.com
pycryptodome — pycryptodome	PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.	2024-01-05	5.9	CVE-2023-52323 cve@mitre.org cve@mitre.org
pyload — pyload	pyLoad is the free and open-source Download Manager written in pure Python. A log injection vulnerability was identified in `pyload` allowing any unauthenticated actor to inject arbitrary messages into the logs gathered by `pyload`. Forged or otherwise, corrupted log files can be used to cover an attacker’s tracks or even to implicate another party in the commission of a malicious act. This vulnerability has been patched in version 0.5.0b3.dev77.	2024-01-08	5.3	CVE-2024-21645 security-advisories@github.com security-advisories@github.com
qnap — qumagie	A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: QuMagie 2.2.1 and later	2024-01-05	5.4	CVE-2023-47559 security@qnapsecurity.com.tw
qualys — policy_compliance	Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data	2024-01-09	6.5	CVE-2023-6147 bugreport@qualys.com
qualys — policy_compliance	Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access and access to configure or edit jobs to utilize the plugin to configure a potential rouge endpoint via which it was possible to control response for certain request which could be injected with XSS payloads leading to XSS while processing the response data	2024-01-09	5.4	CVE-2023-6148 bugreport@qualys.com
qualys — web_application_screening	Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data	2024-01-09	6.5	CVE-2023-6149 bugreport@qualys.com
quic-go — quic-go	quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large number of PATH_CHALLENGE frames. The receiver is supposed to respond to each PATH_CHALLENGE frame with a PATH_RESPONSE frame. The attacker can prevent the receiver from sending out (the vast majority of) these PATH_RESPONSE frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer’s RTT estimate. This vulnerability has been patched in versions 0.37.7, 0.38.2 and 0.39.4.	2024-01-10	6.4	CVE-2023-49295 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
red_hat — multiple_products	A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.	2024-01-10	6.5	CVE-2023-5455 secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com
red_hat — multiple_products	A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.	2024-01-09	6.5	CVE-2023-6476 secalert@redhat.com secalert@redhat.com
red_hat — multiple_products	A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a malicious authenticated VNC client to crash QEMU and trigger a denial of service.	2024-01-12	6.5	CVE-2023-6683 secalert@redhat.com secalert@redhat.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.	2024-01-10	6.5	CVE-2023-48242 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.	2024-01-10	6.5	CVE-2023-48245 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.	2024-01-10	6.5	CVE-2023-48246 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to steal session cookies of other active users.	2024-01-10	6.5	CVE-2023-48249 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned log.	2024-01-10	6.3	CVE-2023-48255 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.	2024-01-10	5.3	CVE-2023-48244 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request.	2024-01-10	5.3	CVE-2023-48247 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows an authenticated remote attacker to upload a malicious file to the SD card containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned file.	2024-01-10	5.5	CVE-2023-48248 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.	2024-01-10	5.3	CVE-2023-48254 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted URL or HTTP request.	2024-01-10	5.3	CVE-2023-48256 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’s session.	2024-01-10	5.5	CVE-2023-48258 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.	2024-01-10	5.3	CVE-2023-48259 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.	2024-01-10	5.3	CVE-2023-48260 psirt@bosch.com
rexroth — nexo_cordless_nutrunner_nxa015s-36v	The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.	2024-01-10	5.3	CVE-2023-48261 psirt@bosch.com
rubygems — rubygems	Rubygems.org is the Ruby community’s gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.	2024-01-12	4.8	CVE-2024-21654 security-advisories@github.com security-advisories@github.com
sap — marketing	SAP Marketing (Contacts App) – version 160, allows an attacker with low privileges to trick a user to open malicious page which could lead to a very convincing phishing attack with low impact on confidentiality and integrity of the application.	2024-01-09	5.4	CVE-2024-21734 cna@sap.com cna@sap.com
sap — netweaver_application_server_abap	SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation.	2024-01-09	5.4	CVE-2024-21738 cna@sap.com cna@sap.com
sap_se — sap_netweaver_(internet_communication_manager)	Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher – versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WEBDISP 7.53, WEBDISP 7.54, could allow an attacker to access information which would otherwise be restricted causing high impact on confidentiality.	2024-01-09	4.1	CVE-2024-22124 cna@sap.com cna@sap.com
sap_se — sap_s/4hana_finance_(advanced_payment_management)	SAP S/4HANA Finance for (Advanced Payment Management) – versions SAPSCORE 128, S4CORE 107, does not perform necessary authorization checks. A function import could be triggered allowing the attacker to create in-house bank accounts leading to low impact on the confidentiality of the application.	2024-01-09	6.4	CVE-2024-21736 cna@sap.com cna@sap.com
siemens — cp-8031_master_module	A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.20), CP-8050 MASTER MODULE (All versions < CPCI85 V05.20). The network configuration service of affected devices contains a flaw in the conversion of ipv4 addresses that could lead to an uninitialized variable being used in succeeding validation steps. By uploading specially crafted network configuration, an authenticated remote attacker could be able to inject commands that are executed on the device with root privileges during device startup.	2024-01-09	6.6	CVE-2023-42797 productcert@siemens.com
siemens — jt2go	A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V14.1 (All versions < V14.1.0.12), Teamcenter Visualization V14.2 (All versions < V14.2.0.9), Teamcenter Visualization V14.3 (All versions < V14.3.0.6). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.	2024-01-09	5.5	CVE-2023-51744 productcert@siemens.com
sourcecodester — engineers_online_portal	A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been classified as problematic. Affected is an unknown function of the component File Upload Handler. The manipulation leads to resource consumption. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250116.	2024-01-09	6.5	CVE-2024-0348 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sourcecodester — engineers_online_portal	A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-250118 is the identifier assigned to this vulnerability.	2024-01-09	6.5	CVE-2024-0350 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sourcecodester — house_rental_management_system	A vulnerability was found in SourceCodester House Rental Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file manage_user.php of the component Edit User. The manipulation of the argument id/name/username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250610 is the identifier assigned to this vulnerability.	2024-01-13	4.7	CVE-2024-0502 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sourcecodester — simple_house_rental_system	A vulnerability classified as problematic was found in CodeAstro Simple House Rental System 5.6. Affected by this vulnerability is an unknown functionality of the component Login Panel. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250111.	2024-01-09	6.1	CVE-2024-0343 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sourcecodester — student_attendance_system	A vulnerability, which was classified as critical, was found in SourceCodester Student Attendance System 1.0. Affected is an unknown function of the file attendance_report.php. The manipulation of the argument class_id leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250230 is the identifier assigned to this vulnerability.	2024-01-10	6.3	CVE-2024-0389 cna@vuldb.com cna@vuldb.com cna@vuldb.com
soxft — timemail	A vulnerability, which was classified as critical, has been found in soxft TimeMail up to 1.1. Affected by this issue is some unknown functionality of the file check.php. The manipulation of the argument c leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250112.	2024-01-09	5.5	CVE-2024-0344 cna@vuldb.com cna@vuldb.com cna@vuldb.com
splunk — splunk_enterprise_security_(es)	In Splunk Enterprise Security (ES) versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service (DoS). The malformed investigation prevents the generation and rendering of the Investigations manager until it is deleted. The vulnerability requires an authenticated session and access to create an Investigation. It only affects the availability of the Investigations manager, but without the manager, the Investigations functionality becomes unusable for most users.	2024-01-09	6.5	CVE-2024-22165 prodsec@splunk.com prodsec@splunk.com
splunk — splunk_enterprise_security_(es)	In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigation. The attachment endpoint does not properly limit the size of the request which lets an attacker cause the Investigation to become inaccessible.	2024-01-09	4.3	CVE-2024-22164 prodsec@splunk.com prodsec@splunk.com
ssm_shiro_blog — ssm_shiro_blog	A vulnerability has been found in Mandelo ssm_shiro_blog 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file updateRoles of the component Backend. The manipulation leads to improper access controls. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250123.	2024-01-10	4.3	CVE-2024-0356 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sumanbhattarai — send_users_email	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Suman Bhattarai Send Users Email.This issue affects Send Users Email: from n/a through 1.4.3.	2024-01-05	5.3	CVE-2023-52126 audit@patchstack.com
synopsys — devise-two-factor	Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm’s (TOTP) inherent entropy limitations, it’s possible for an attacker to bypass the 2FA mechanism through brute-force attacks.	2024-01-11	5	CVE-2024-0227 disclosure@synopsys.com
synopsys — seeker	Synopsys Seeker versions prior to 2023.12.0 are vulnerable to a stored cross-site scripting vulnerability through a specially crafted payload.	2024-01-09	5.4	CVE-2024-0226 disclosure@synopsys.com
taokeyun — taokeyun	A vulnerability was found in Taokeyun up to 1.0.5. It has been rated as critical. Affected by this issue is the function shopGoods of the file application/index/controller/app/store/Goods.php of the component HTTP POST Request Handler. The manipulation of the argument keyword leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250586 is the identifier assigned to this vulnerability.	2024-01-13	6.3	CVE-2024-0481 cna@vuldb.com cna@vuldb.com cna@vuldb.com
taokeyun — taokeyun	A vulnerability classified as critical has been found in Taokeyun up to 1.0.5. This affects the function index of the file application/index/controller/app/Video.php of the component HTTP POST Request Handler. The manipulation of the argument cid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250587.	2024-01-13	6.3	CVE-2024-0482 cna@vuldb.com cna@vuldb.com cna@vuldb.com
taokeyun — taokeyun	A vulnerability classified as critical was found in Taokeyun up to 1.0.5. This vulnerability affects the function index of the file application/index/controller/app/Task.php of the component HTTP POST Request Handler. The manipulation of the argument cid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250588.	2024-01-13	6.3	CVE-2024-0483 cna@vuldb.com cna@vuldb.com cna@vuldb.com
tasmoadmin — tasmoadmin	Lack of “current” GET parameter validation during the action of changing a language leads to an open redirect vulnerability.	2024-01-08	6.1	CVE-2023-6552 cvd@cert.pl cvd@cert.pl cvd@cert.pl
themeisle — rss_aggregator_by_feedzy	The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check when updating settings in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with author-level access or above to change the plugin’s settings including proxy settings, which are also exposed to authors.	2024-01-06	5.4	CVE-2023-6798 security@wordfence.com security@wordfence.com
themeisle — rss_aggregator_by_feedzy	The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-06	5.4	CVE-2023-6801 security@wordfence.com security@wordfence.com
themeum — wp_crowdfunding	The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin	2024-01-08	6.1	CVE-2023-6161 contact@wpscan.com
topazevolution — antifraud	The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process Light) process via an IOCTL (which will be named at a later time).	2024-01-08	6.5	CVE-2023-52271 cve@mitre.org cve@mitre.org
totolink — t6_firmware	A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923. This affects an unknown part of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249867. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-09	6.5	CVE-2023-7223 cna@vuldb.com cna@vuldb.com cna@vuldb.com
trellix — trellix_endpoint_security_(ens)_web_control	A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy configuration.	2024-01-10	6.1	CVE-2024-0310 trellixpsirt@trellix.com
uncannyowl — uncanny_automator	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Uncanny Automator, Uncanny Owl Uncanny Automator – Automate everything with the #1 no-code automation and integration plugin.This issue affects Uncanny Automator – Automate everything with the #1 no-code automation and integration plugin: from n/a through 5.1.0.2.	2024-01-05	5.3	CVE-2023-52151 audit@patchstack.com
vehicle_booking_system — vehicle_booking_system	A vulnerability, which was classified as problematic, was found in CodeAstro Vehicle Booking System 1.0. This affects an unknown part of the file usr/usr-register.php of the component User Registration. The manipulation of the argument Full_Name/Last_Name/Address with the input leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250113 was assigned to this vulnerability.	2024-01-09	4.3	CVE-2024-0345 cna@vuldb.com cna@vuldb.com cna@vuldb.com
videowhisper — rate_star_review	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in VideoWhisper Rate Star Review – AJAX Reviews for Content, with Star Ratings allows Reflected XSS.This issue affects Rate Star Review – AJAX Reviews for Content, with Star Ratings: from n/a through 1.5.1.	2024-01-08	6.1	CVE-2023-52213 audit@patchstack.com
weitong — mall	A vulnerability was found in Weitong Mall 1.0.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file platform-shopsrcmainresourcescomplatformdaoOrderDao.xml. The manipulation of the argument sidx/order leads to sql injection. The associated identifier of this vulnerability is VDB-250243.	2024-01-12	5.5	CVE-2022-4961 cna@vuldb.com cna@vuldb.com cna@vuldb.com
wordpress — wordpress	The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘esi’ shortcode in versions up to, and including, 5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	6.4	CVE-2023-4372 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘wcfm_stores’ shortcode in versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	6.4	CVE-2023-4960 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Doofinder Doofinder WP & WooCommerce Search. This issue affects Doofinder WP & WooCommerce Search: from n/a through 2.0.33.	2024-01-05	6.5	CVE-2023-51678 audit@patchstack.com
wordpress — wordpress	The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks.	2024-01-08	6.5	CVE-2023-6139 contact@wpscan.com
wordpress — wordpress	The EventON – WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evo_eventpost_update_meta function in all versions up to, and including, 4.5.4 (for Pro) and 2.2.7 (for free). This makes it possible for unauthenticated attackers to update and remove arbitrary post metadata. Note that certain parameters may allow for content injection.	2024-01-10	6.5	CVE-2023-6158 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The EventON – WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (for Pro) & 2.2.7 (for Free). This is due to missing or incorrect nonce validation on the evo_eventpost_update_meta function. This makes it possible for unauthenticated attackers to update arbitrary post metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2024-01-11	6.5	CVE-2023-6242 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The EventON – WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (Pro) & 2.2.8 (Free). This is due to missing or incorrect nonce validation on the save_virtual_event_settings function. This makes it possible for unauthenticated attackers to modify virtual event settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2024-01-11	6.5	CVE-2023-6244 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities.	2024-01-08	6.1	CVE-2023-6529 contact@wpscan.com
wordpress — wordpress	The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the featured image alt text in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	6.4	CVE-2023-6561 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of arbitrary files on the server including wp-config.php, which can contain sensitive information.	2024-01-11	6.6	CVE-2023-6583 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Happy Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via DOM in all versions up to and including 3.9.1.1 (versions up to 2.9.1.1 in Happy Addons for Elementor Pro) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	2024-01-11	6.1	CVE-2023-6632 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The CAOS \| Host Google Analytics Locally plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘update_settings’ function in versions up to, and including, 4.7.14. This makes it possible for unauthenticated attackers to update plugin settings.	2024-01-11	6.5	CVE-2023-6637 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The GTG Product Feed for Shopping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘update_settings’ function in versions up to, and including, 1.2.4. This makes it possible for unauthenticated attackers to update plugin settings.	2024-01-11	6.5	CVE-2023-6638 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions up to, and including, 2.2.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	6.4	CVE-2023-6645 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ive’ shortcode in versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on ‘width’ and ‘height’ user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	6.4	CVE-2023-6684 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Ready Function’ field in all versions up to, and including, 1.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	6.4	CVE-2023-6776 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s custom fields in all versions up to, and including, 2.10.26 due to insufficient input sanitization and output escaping on user supplied values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	6.4	CVE-2023-6781 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcode(s) in all versions up to, and including, 1.0.92 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	6.4	CVE-2023-6782 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated users to inject arbitrary HTML code into form fields. When the form data is viewed by an administrator in the Entries View Page, the injected HTML code is rendered, potentially leading to admin area defacement or redirection to malicious websites.	2024-01-09	6.5	CVE-2023-6830 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘environment_mode’ parameter in all versions up to, and including, 4.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	2024-01-11	6.1	CVE-2023-6882 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcode(s) in all versions up to, and including, 2.25.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	6.4	CVE-2023-6934 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Oxygen Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom field in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Version 4.8.1 of the Oxygen Builder plugin for WordPress addresses this vulnerability by implementing an optional filter to provide output escaping for dynamic data. Please see https://oxygenbuilder.com/documentation/other/security/#filtering-dynamic-data for more details.	2024-01-11	6.4	CVE-2023-6938 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s extend_builder_render_js shortcode in all versions up to, and including, 1.0.239 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	6.4	CVE-2023-6988 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘catlist’ shortcode in all versions up to, and including, 0.89.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	6.5	CVE-2023-6994 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s eeb_mailto shortcode in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	6.4	CVE-2023-7070 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table of Contents block in all versions up to, and including, 4.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	6.4	CVE-2023-7071 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Advanced Woo Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search parameter in all versions up to, and including, 2.96 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This only affects sites when the Dynamic Content for Elementor plugin is also installed.	2024-01-13	6.1	CVE-2024-0251 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_disconnect function. This makes it possible for unauthenticated attackers to deactivate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2024-01-11	5.4	CVE-2023-4247 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_stripe_disconnect_connect_stripe_account function. This makes it possible for unauthenticated attackers to deactivate the plugin’s stripe integration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2024-01-11	5.4	CVE-2023-4248 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in ShapedPlugin LLC WP Tabs – Responsive Tabs Plugin for WordPress allows Stored XSS.This issue affects WP Tabs – Responsive Tabs Plugin for WordPress: from n/a through 2.2.0.	2024-01-05	5.4	CVE-2023-52124 audit@patchstack.com
wordpress — wordpress	The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks.	2024-01-08	5.4	CVE-2023-6141 contact@wpscan.com
wordpress — wordpress	The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 2.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose sensitive information or perform unauthorized actions, such as saving advanced plugin settings.	2024-01-11	5.4	CVE-2023-6369 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via the card_famne_export_settings function. This makes it possible for unauthenticated attackers to obtain plugin settings.	2024-01-11	5.3	CVE-2023-6496 security@wordfence.com security@wordfence.com
wordpress — wordpress	The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via currency options in all versions up to, and including, 1.4.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	5.4	CVE-2023-6556 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.3 via the ekit_widgetarea_content function. This makes it possible for unauthenticated attackers to obtain contents of posts in draft, private or pending review status that should not be visible to the general public. This applies to posts created with Elementor only.	2024-01-11	5.3	CVE-2023-6582 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Laybuy Laybuy Payment Extension for WooCommerce allows Stored XSS.This issue affects Laybuy Payment Extension for WooCommerce: from n/a through 5.3.9.	2024-01-08	5.4	CVE-2024-21745 audit@patchstack.com
wordpress — wordpress	The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_remote_install_handler function. This makes it possible for unauthenticated attackers to install and activate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2024-01-11	4.3	CVE-2023-4246 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Chatbot for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 2.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	2024-01-11	4.4	CVE-2023-5691 security@wordfence.com security@wordfence.com
wordpress — wordpress	The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing validation on the ‘userID’ user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the details of another user’s course progress.	2024-01-11	4.3	CVE-2023-6223 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	2024-01-11	4.4	CVE-2023-6446 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Depicter Slider – Responsive Image Slider, Video Slider & Post Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the ‘save’ function. This makes it possible for unauthenticated attackers to modify the plugin’s settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2023-51491 appears to be a duplicate of this issue.	2024-01-05	4.3	CVE-2023-6493 security@wordfence.com security@wordfence.com
wordpress — wordpress	The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wppb_toolbox_usermeta_handler function in all versions up to, and including, 3.10.7. This makes it possible for authenticated attackers, with contributor-level access and above, to expose sensitive information within user metadata.	2024-01-11	4.3	CVE-2023-6504 security@wordfence.com security@wordfence.com
wordpress — wordpress	The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the send_backup_codes_email due to missing validation on a user controlled key. This makes it possible for subscriber-level attackers to email arbitrary users on the site.	2024-01-11	4.3	CVE-2023-6506 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the send_backup_codes_email function. This makes it possible for unauthenticated attackers to send emails with arbitrary content to registered users via a forged request granted they can trick a site administrator or other registered user into performing an action such as clicking on a link. While a nonce check is present, it is only executed if a nonce is set. By omitting a nonce from the request, the check can be bypassed.	2024-01-11	4.3	CVE-2023-6520 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Administrators can give button creation privileges to users with lower levels (contributor+) which would allow those lower-privileged users to carry out attacks.	2024-01-09	4.8	CVE-2023-6594 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcode(s) in all versions up to, and including, 1.24.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	4.9	CVE-2023-6624 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any post type, referencing the post by id and the meta by key.	2024-01-11	4.3	CVE-2023-6630 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all versions up to, and including, 4.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploiting this vulnerability requires the attacker to know the ID of an attachment uploaded by the user they are attacking.	2024-01-11	4.7	CVE-2023-6737 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the ‘envira_gallery_insert_images’ function in all versions up to, and including, 1.8.7.1. This makes it possible for authenticated attackers, with contributor access and above, to modify galleries on other users’ posts.	2024-01-11	4.3	CVE-2023-6742 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name field label and description field label parameter in all versions up to 6.7 (inclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this only affects multi-site installations and installations where unfiltered_html has been disabled. However, in the formidable settings admins can extend form creation, deletion and other management permissions to other user types, which makes it possible for this vulnerability to be exploited by lower level user types as long as they have been granted the proper permissions.	2024-01-09	4.4	CVE-2023-6842 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions, such as modifying the plugin’s Facebook and Instagram access tokens and updating group IDs.	2024-01-11	4.3	CVE-2023-6883 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in versions up to, and including, 1.8.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. It can also be exploited with a contributor-level permission with a page builder plugin.	2024-01-11	4.4	CVE-2023-6924 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the insert_template function in all versions up to, and including, 2.6.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to change page designs.	2024-01-11	4.3	CVE-2023-7019 security@wordfence.com security@wordfence.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in weDevs WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting.This issue affects WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting: from n/a through 1.12.8.	2024-01-08	4.9	CVE-2024-21747 audit@patchstack.com
wordpress — wordpress	The Video PopUp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘video_popup’ shortcode in versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	6.4	CVE-2023-4962 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to unauthorized modification of membership levels created by the plugin due to an incorrectly implemented capability check in the pmpro_rest_api_get_permissions_check function in all versions up to 2.12.5 (inclusive). This makes it possible for unauthenticated attackers to change membership levels including prices.	2024-01-11	5.3	CVE-2023-6855 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Weaver Xtreme theme for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user supplied meta (page-head-code). This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-11	5.4	CVE-2023-6990 security@wordfence.com security@wordfence.com
wordpress — wordpress	The SpeedyCache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the speedycache_save_varniship, speedycache_img_update_settings, speedycache_preloading_add_settings, and speedycache_preloading_delete_resource functions in all versions up to, and including, 1.1.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to update plugin options.	2024-01-11	4.3	CVE-2023-6598 security@wordfence.com security@wordfence.com
wpaffiliatemanager — affiliates_manager	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.30.	2024-01-05	5.3	CVE-2023-52148 audit@patchstack.com
wpmet — metform_elementor_contact_form_builder	The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.1. This is due to missing or incorrect nonce validation on the contents function. This makes it possible for unauthenticated attackers to update the options “mf_hubsopt_token”, “mf_hubsopt_refresh_token”, “mf_hubsopt_token_type”, and “mf_hubsopt_expires_in” via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This would allow an attacker to connect their own Hubspot account to a victim site’s metform to obtain leads and contacts.	2024-01-09	5.4	CVE-2023-6788 security@wordfence.com security@wordfence.com security@wordfence.com
wwbn — avideo	An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.	2024-01-10	6.5	CVE-2023-47171 talos-cna@cisco.com
wwbn — avideo	An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the `downloadURL_gifimage` parameter.	2024-01-10	6.5	CVE-2023-49862 talos-cna@cisco.com
wwbn — avideo	An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the `downloadURL_webpimage` parameter.	2024-01-10	6.5	CVE-2023-49863 talos-cna@cisco.com
wwbn — avideo	An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the `downloadURL_image` parameter.	2024-01-10	6.5	CVE-2023-49864 talos-cna@cisco.com
wwbn — avideo	A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to the silent creation of a recovery pass code for any user.	2024-01-10	5.3	CVE-2023-50172 talos-cna@cisco.com
wwbn — avideo	A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution when chained with an LFI vulnerability. An attacker can send a series of HTTP requests to trigger this vulnerability.	2024-01-10	4.3	CVE-2023-49715 talos-cna@cisco.com
xen — xen	When a transaction is committed, C Xenstored will first check the quota is correct before attempting to commit any nodes. It would be possible that accounting is temporarily negative if a node has been removed outside of the transaction. Unfortunately, some versions of C Xenstored are assuming that the quota cannot be negative and are using assert() to confirm it. This will lead to C Xenstored crash when tools are built without -DNDEBUG (this is the default).	2024-01-05	5.5	CVE-2023-34323 security@xen.org
xen — xen	[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs since ~2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen’s handling of the guest state, leading to denials of service. 1) CVE-2023-34327 – An HVM vCPU can end up operating in the context of a previous vCPUs debug mask state. 2) CVE-2023-34328 – A PV vCPU can place a breakpoint over the live GDT. This allows the PV vCPU to exploit XSA-156 / CVE-2015-8104 and lock up the CPU entirely.	2024-01-05	5.5	CVE-2023-34327 security@xen.org
xen — xen	[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs since ~2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen’s handling of the guest state, leading to denials of service. 1) CVE-2023-34327 – An HVM vCPU can end up operating in the context of a previous vCPUs debug mask state. 2) CVE-2023-34328 – A PV vCPU can place a breakpoint over the live GDT. This allows the PV vCPU to exploit XSA-156 / CVE-2015-8104 and lock up the CPU entirely.	2024-01-05	5.5	CVE-2023-34328 security@xen.org
xen — xen	The current setup of the quarantine page tables assumes that the quarantine domain (dom_io) has been initialized with an address width of DEFAULT_DOMAIN_ADDRESS_WIDTH (48) and hence 4 page table levels. However dom_io being a PV domain gets the AMD-Vi IOMMU page tables levels based on the maximum (hot pluggable) RAM address, and hence on systems with no RAM above the 512GB mark only 3 page-table levels are configured in the IOMMU. On systems without RAM above the 512GB boundary amd_iommu_quarantine_init() will setup page tables for the scratch page with 4 levels, while the IOMMU will be configured to use 3 levels only, resulting in the last page table directory (PDE) effectively becoming a page table entry (PTE), and hence a device in quarantine mode gaining write access to the page destined to be a PDE. Due to this page table level mismatch, the sink page the device gets read/write access to is no longer cleared between device assignment, possibly leading to data leaks.	2024-01-05	5.5	CVE-2023-46835 security@xen.org
xen — xen	The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one unconditionally, and one conditionally on whether XPTI was active. As BTC/SRSO and Meltdown affect different CPU vendors, the mitigations are not active together by default. Therefore, there is a race condition whereby a malicious PV guest can bypass BTC/SRSO protections and launch a BTC/SRSO attack against Xen.	2024-01-05	4.7	CVE-2023-46836 security@xen.org
xwiki — xwiki	XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user able to attach a file to a page can post a malformed TAR file by manipulating file modification times headers, which when parsed by Tika, could cause a denial of service issue via CPU consumption. This vulnerability has been patched in XWiki 14.10.18, 15.5.3 and 15.8 RC1.	2024-01-09	6.5	CVE-2024-21651 security-advisories@github.com security-advisories@github.com
yugeshverma — online_lawyer_management_system	A vulnerability classified as problematic has been found in Project Worlds Online Lawyer Management System 1.0. Affected is an unknown function of the component User Registration. The manipulation of the argument First Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249822 is the identifier assigned to this vulnerability.	2024-01-07	5.4	CVE-2024-0266 cna@vuldb.com cna@vuldb.com cna@vuldb.com
zte — mf258	There is a Cross-site scripting (XSS) vulnerability in ZTE MF258. Due to insufficient input validation of SMS interface parameter, an XSS attack will be triggered.	2024-01-10	5.7	CVE-2023-41781 psirt@zte.com.cn
zte — zxcloud_irai_firmware	There is a DLL hijacking vulnerability in ZTE ZXCLOUD iRAI, an attacker could place a fake DLL file in a specific directory and successfully exploit this vulnerability to execute malicious code.	2024-01-05	4.8	CVE-2023-41782 psirt@zte.com.cn
škoda — superb_iii	By sending a specific reset UDS request via OBDII port of Skoda vehicles, it is possible to cause vehicle engine shutdown and denial of service of other vehicle components even when the vehicle is moving at a high speed. No safety critical functions affected.	2024-01-12	4.7	CVE-2023-28899 cve@asrg.io

Low Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
blood_bank_&_donor_management — blood_bank_&_donor_management	A vulnerability, which was classified as problematic, was found in Blood Bank & Donor Management 1.0. This affects an unknown part of the file request-received-bydonar.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250581 was assigned to this vulnerability.	2024-01-13	2.4	CVE-2024-0476 cna@vuldb.com cna@vuldb.com cna@vuldb.com
cdo-utility-local-uuid — cdo-utility-local-uuid	cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`.	2024-01-11	2.2	CVE-2024-22194 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
cloudfavorites — favorites-web	A vulnerability, which was classified as problematic, has been found in cloudfavorites favorites-web 1.3.0. Affected by this issue is some unknown functionality of the component Nickname Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250238 is the identifier assigned to this vulnerability.	2024-01-12	3.5	CVE-2022-4960 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — dormitory_management_system	A vulnerability was found in code-projects Dormitory Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file modifyuser.php. The manipulation of the argument mname leads to information disclosure. The exploit has been disclosed to the public and may be used. The identifier VDB-250577 was assigned to this vulnerability.	2024-01-12	3.5	CVE-2024-0472 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — online_fir_system	A vulnerability was found in code-projects Online FIR System 1.0. It has been classified as problematic. This affects an unknown part of the file registercomplaint.php. The manipulation of the argument Name/Address leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250611.	2024-01-13	3.5	CVE-2024-0503 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — simple_online_hotel_reservation_system	A vulnerability has been found in code-projects Simple Online Hotel Reservation System 1.0 and classified as problematic. This vulnerability affects unknown code of the file add_reserve.php of the component Make a Reservation Page. The manipulation of the argument Firstname/Lastname with the input leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250618 is the identifier assigned to this vulnerability.	2024-01-13	3.5	CVE-2024-0504 cna@vuldb.com cna@vuldb.com cna@vuldb.com
discourse — discourse	Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4.	2024-01-12	3.1	CVE-2023-49099 security-advisories@github.com security-advisories@github.com
discourse — discourse-reactions	Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user’s reaction notifications could be exposed. This vulnerability was patched in commit 2c26939.	2024-01-12	3.5	CVE-2023-49098 security-advisories@github.com security-advisories@github.com
employee_profile_management_system — employee_profile_management_system	A vulnerability classified as problematic was found in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file download.php. The manipulation of the argument download_file leads to path traversal: ‘../filedir’. The exploit has been disclosed to the public and may be used. VDB-250570 is the identifier assigned to this vulnerability.	2024-01-12	3.5	CVE-2024-0465 cna@vuldb.com cna@vuldb.com cna@vuldb.com
employee_profile_management_system — employee_profile_management_system	A vulnerability, which was classified as problematic, was found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file edit_position_query.php. The manipulation of the argument pos_name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250572.	2024-01-12	3.5	CVE-2024-0467 cna@vuldb.com cna@vuldb.com cna@vuldb.com
gitlab — gitlab	An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits.	2024-01-12	3.5	CVE-2023-2030 cve@gitlab.com cve@gitlab.com
inis — inis	A vulnerability was found in Inis up to 2.0.1. It has been rated as problematic. This issue affects some unknown processing of the file /app/api/controller/default/File.php of the component GET Request Handler. The manipulation of the argument path leads to path traversal: ‘../filedir’. The exploit has been disclosed to the public and may be used. The identifier VDB-250109 was assigned to this vulnerability.	2024-01-09	3.5	CVE-2024-0341 cna@vuldb.com cna@vuldb.com cna@vuldb.com
online_food_ordering_system — online_food_ordering_system	A vulnerability was found in CodeAstro Online Food Ordering System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file dishes.php. The manipulation of the argument res_id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250442 is the identifier assigned to this vulnerability.	2024-01-11	3.5	CVE-2024-0423 cna@vuldb.com cna@vuldb.com cna@vuldb.com
pos_and_inventory_management_system — pos_and_inventory_management_system	A vulnerability was found in CodeAstro POS and Inventory Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /new_item of the component New Item Creation Page. The manipulation of the argument new_item leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250441 was assigned to this vulnerability.	2024-01-11	3.5	CVE-2024-0422 cna@vuldb.com cna@vuldb.com cna@vuldb.com
qkmc-rk — redbbs	A vulnerability classified as problematic has been found in qkmc-rk redbbs 1.0. Affected is an unknown function of the component Post Handler. The manipulation of the argument title leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250236.	2024-01-11	3.5	CVE-2022-4958 cna@vuldb.com cna@vuldb.com cna@vuldb.com
qkmc-rk — redbbs	A vulnerability classified as problematic was found in qkmc-rk redbbs 1.0. Affected by this vulnerability is an unknown functionality of the component Nickname Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250237 was assigned to this vulnerability.	2024-01-11	3.5	CVE-2022-4959 cna@vuldb.com cna@vuldb.com cna@vuldb.com
simple_banking_system — simple_banking_system	A vulnerability classified as problematic has been found in CodeAstro Simple Banking System 1.0. This affects an unknown part of the file createuser.php of the component Create a User Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250443.	2024-01-11	3.5	CVE-2024-0424 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sourcecodester — engineers_online_portal	A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file signup_teacher.php. The manipulation of the argument Password leads to weak password requirements. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250115.	2024-01-09	3.7	CVE-2024-0347 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sourcecodester — engineers_online_portal	A vulnerability classified as problematic has been found in SourceCodester Engineers Online Portal 1.0. This affects an unknown part. The manipulation leads to session fixiation. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250119.	2024-01-09	3.5	CVE-2024-0351 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sourcecodester — house_rental_management_system	A vulnerability, which was classified as problematic, has been found in SourceCodester House Rental Management System 1.0. This issue affects some unknown processing of the file index.php. The manipulation of the argument page leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250607.	2024-01-13	2.4	CVE-2024-0499 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sourcecodester — house_rental_management_system	A vulnerability, which was classified as problematic, was found in SourceCodester House Rental Management System 1.0. Affected is an unknown function of the component Manage Tenant Details. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250608.	2024-01-13	2.4	CVE-2024-0500 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sourcecodester — house_rental_management_system	A vulnerability has been found in SourceCodester House Rental Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Manage Invoice Details. The manipulation of the argument Invoice leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250609 was assigned to this vulnerability.	2024-01-13	2.4	CVE-2024-0501 cna@vuldb.com cna@vuldb.com cna@vuldb.com
vehicle_booking_system — vehicle_booking_system	A vulnerability has been found in CodeAstro Vehicle Booking System 1.0 and classified as problematic. This vulnerability affects unknown code of the file usr/user-give-feedback.php of the component Feedback Page. The manipulation of the argument My Testemonial leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250114 is the identifier assigned to this vulnerability.	2024-01-09	3.5	CVE-2024-0346 cna@vuldb.com cna@vuldb.com cna@vuldb.com
wordpress — wordpress	The My Sticky Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.6. This is due to missing or incorrect nonce validation in mystickymenu-contact-leads.php. This makes it possible for unauthenticated attackers to trigger the export of a CSV file containing contact leads via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Because the CSV file is exported to a public location, it can be downloaded during a very short window of time before it is automatically deleted by the export function.	2024-01-11	3.1	CVE-2023-7048 security@wordfence.com security@wordfence.com
xen — xen	Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest. Unfortunately, the arithmetics in the helpers can overflow and would then result to skip the cache cleaning/invalidation. Therefore there is no guarantee when all the writes will reach the memory.	2024-01-05	3.3	CVE-2023-34321 security@xen.org
xen — xen	Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest. Unfortunately, the arithmetics in the helpers can overflow and would then result to skip the cache cleaning/invalidation. Therefore there is no guarantee when all the writes will reach the memory. This undefined behavior was meant to be addressed by XSA-437, but the approach was not sufficient.	2024-01-05	3.3	CVE-2023-46837 security@xen.org

Severity Not Yet Assigned

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
amd — 3rd_gen_amd_epycâ„¢_processors	A privileged attacker can prevent delivery of debug exceptions to SEV-SNP guests potentially resulting in guests not receiving expected debug information.	2024-01-11	not yet calculated	CVE-2023-20573 psirt@amd.com
andriod — android_nfc	The ST ST54-android-packages-apps-Nfc package before 130-20230215-23W07p0 for Android has an out-of-bounds read.	2024-01-09	not yet calculated	CVE-2023-36629 cve@mitre.org cve@mitre.org cve@mitre.org
apache_software_foundation — apache_answer	Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) vulnerability in Apache Answer. This issue affects Apache Answer: through 1.2.0. Under normal circumstances, a user can only bookmark a question once, and will only increase the number of questions bookmarked once. However, repeat submissions through the script can increase the number of collection of the question many times. Users are recommended to upgrade to version [1.2.1], which fixes the issue.	2024-01-10	not yet calculated	CVE-2023-49619 security@apache.org security@apache.org
apple — ios_and_ipados	An integer overflow was addressed through improved input validation. This issue is fixed in tvOS 16.4, macOS Big Sur 11.7.5, iOS 16.4 and iPadOS 16.4, watchOS 9.4, macOS Monterey 12.6.4, iOS 15.7.4 and iPadOS 15.7.4. An app may be able to cause a denial-of-service.	2024-01-10	not yet calculated	CVE-2023-28185 product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com
apple — ios_and_ipados	The issue was addressed with improved memory handling. This issue is fixed in iOS 16.4 and iPadOS 16.4, watchOS 9.4. An attacker that has already achieved kernel code execution may be able to bypass kernel memory mitigations.	2024-01-10	not yet calculated	CVE-2023-32424 product-security@apple.com product-security@apple.com
apple — ios_and_ipados	A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app may be able to cause unexpected system termination or write kernel memory.	2024-01-10	not yet calculated	CVE-2023-38610 product-security@apple.com product-security@apple.com
apple — ios_and_ipados	The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, iOS 17 and iPadOS 17, macOS Sonoma 14, macOS Ventura 13.6. An app may be able to access protected user data.	2024-01-10	not yet calculated	CVE-2023-38612 product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com
apple — ios_and_ipados	This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, Safari 17, iOS 17 and iPadOS 17. A remote attacker may be able to view leaked DNS queries with Private Relay turned on.	2024-01-10	not yet calculated	CVE-2023-40385 product-security@apple.com product-security@apple.com product-security@apple.com
apple — ios_and_ipados	The issue was addressed with improved validation of environment variables. This issue is fixed in iOS 16.6 and iPadOS 16.6. An app may be able to access sensitive user data.	2024-01-10	not yet calculated	CVE-2023-40394 product-security@apple.com
apple — ios_and_ipados	A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 10, iOS 17 and iPadOS 17, tvOS 17, macOS Sonoma 14, Safari 17. Processing web content may lead to arbitrary code execution.	2024-01-10	not yet calculated	CVE-2023-40414 product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com
apple — ios_and_ipados	A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to read sensitive location information.	2024-01-10	not yet calculated	CVE-2023-40437 product-security@apple.com product-security@apple.com
apple — ios_and_ipados	An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14, iOS 16.7 and iPadOS 16.7. An app may be able to access edited photos saved to a temporary directory.	2024-01-10	not yet calculated	CVE-2023-40438 product-security@apple.com product-security@apple.com
apple — ios_and_ipados	A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to read sensitive location information.	2024-01-10	not yet calculated	CVE-2023-40439 product-security@apple.com product-security@apple.com
apple — ios_and_ipados	This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17 and iPadOS 17. A person with physical access to a device may be able to use VoiceOver to access private calendar information.	2024-01-10	not yet calculated	CVE-2023-40529 product-security@apple.com
apple — ios_and_ipados	A type confusion issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. A remote user may be able to cause kernel code execution.	2024-01-10	not yet calculated	CVE-2023-41060 product-security@apple.com product-security@apple.com
apple — ios_and_ipados	This issue was addressed by improving Face ID anti-spoofing models. This issue is fixed in iOS 17 and iPadOS 17. A 3D model constructed to look like the enrolled user may authenticate via Face ID.	2024-01-10	not yet calculated	CVE-2023-41069 product-security@apple.com
apple — ios_and_ipados	A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17. An app may be able to execute arbitrary code with kernel privileges.	2024-01-10	not yet calculated	CVE-2023-41974 product-security@apple.com
apple — ios_and_ipados	A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14, Safari 17, iOS 17 and iPadOS 17. Processing web content may lead to arbitrary code execution.	2024-01-10	not yet calculated	CVE-2023-42833 product-security@apple.com product-security@apple.com product-security@apple.com
apple — ios_and_ipados	A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app may be able to execute arbitrary code with kernel privileges.	2024-01-10	not yet calculated	CVE-2023-42870 product-security@apple.com product-security@apple.com
apple — ios_and_ipados	The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app may be able to execute arbitrary code with kernel privileges.	2024-01-10	not yet calculated	CVE-2023-42871 product-security@apple.com product-security@apple.com
apple — ios_and_ipados	The issue was addressed with additional permissions checks. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app may be able to access sensitive user data.	2024-01-10	not yet calculated	CVE-2023-42872 product-security@apple.com product-security@apple.com
apple — ios_and_ipados	An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app with root privileges may be able to access private information.	2024-01-10	not yet calculated	CVE-2023-42934 product-security@apple.com product-security@apple.com
apple — ios_and_ipados	The issue was addressed with improved checks. This issue is fixed in iOS 17.2 and iPadOS 17.2. An attacker in a privileged network position may be able to perform a denial-of-service attack using crafted Bluetooth packets.	2024-01-10	not yet calculated	CVE-2023-42941 product-security@apple.com product-security@apple.com
apple — macos	The issue was addressed with improved UI handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Visiting a website that frames malicious content may lead to UI spoofing.	2024-01-10	not yet calculated	CVE-2022-32919 product-security@apple.com product-security@apple.com
apple — macos	This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app with root privileges may be able to access private information.	2024-01-10	not yet calculated	CVE-2022-32931 product-security@apple.com
apple — macos	A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file system.	2024-01-10	not yet calculated	CVE-2022-42816 product-security@apple.com
apple — macos	This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be able to read sensitive location information.	2024-01-10	not yet calculated	CVE-2022-42839 product-security@apple.com product-security@apple.com
apple — macos	A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Location data may be shared via iCloud links even if Location metadata is disabled via the Share Sheet.	2024-01-10	not yet calculated	CVE-2022-46710 product-security@apple.com product-security@apple.com
apple — macos	The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.	2024-01-10	not yet calculated	CVE-2022-46721 product-security@apple.com
apple — macos	The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.	2024-01-10	not yet calculated	CVE-2022-47915 product-security@apple.com
apple — macos	The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.	2024-01-10	not yet calculated	CVE-2022-47965 product-security@apple.com
apple — macos	The issue was addressed with improved handling of caches. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data.	2024-01-10	not yet calculated	CVE-2022-48504 product-security@apple.com
apple — macos	An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data.	2024-01-10	not yet calculated	CVE-2022-48577 product-security@apple.com
apple — macos	An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.3, macOS Big Sur 11.7.5, macOS Monterey 12.6.4. An app may be able to access user-sensitive data.	2024-01-10	not yet calculated	CVE-2023-28197 product-security@apple.com product-security@apple.com product-security@apple.com
apple — macos	An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.7.5, macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4. Processing a font file may lead to arbitrary code execution.	2024-01-10	not yet calculated	CVE-2023-32366 product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com
apple — macos	A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.3, macOS Big Sur 11.7.5, macOS Monterey 12.6.4. An app may be able to execute arbitrary code with kernel privileges.	2024-01-10	not yet calculated	CVE-2023-32378 product-security@apple.com product-security@apple.com product-security@apple.com
apple — macos	This issue was addressed by forcing hardened runtime on the affected binaries at the system level. This issue is fixed in macOS Monterey 12.6.6, macOS Big Sur 11.7.7, macOS Ventura 13.4. An app may be able to inject code into sensitive binaries bundled with Xcode.	2024-01-10	not yet calculated	CVE-2023-32383 product-security@apple.com product-security@apple.com product-security@apple.com
apple — macos	A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.6.6, macOS Big Sur 11.7.7, macOS Ventura 13.4. Parsing an office document may lead to an unexpected app termination or arbitrary code execution.	2024-01-10	not yet calculated	CVE-2023-32401 product-security@apple.com product-security@apple.com product-security@apple.com
apple — macos	The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.3. An app may be able to cause unexpected system termination or write kernel memory.	2024-01-10	not yet calculated	CVE-2023-32436 product-security@apple.com
apple — macos	The issue was addressed with improved handling of caches. This issue is fixed in macOS Sonoma 14. An app may be able to modify Printer settings.	2024-01-10	not yet calculated	CVE-2023-38607 product-security@apple.com
apple — macos	A path handling issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. An app may be able to access user-sensitive data.	2024-01-10	not yet calculated	CVE-2023-40383 product-security@apple.com
apple — macos	An authentication issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14. Photos in the Hidden Photos Album may be viewed without authentication.	2024-01-10	not yet calculated	CVE-2023-40393 product-security@apple.com
apple — macos	A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3. An app may bypass Gatekeeper checks.	2024-01-10	not yet calculated	CVE-2023-40433 product-security@apple.com
apple — macos	A type confusion issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7.5, macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4. An app may be able to execute arbitrary code with kernel privileges.	2024-01-10	not yet calculated	CVE-2023-41075 product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com
apple — macos	This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.5. An app may be able to gain root privileges.	2024-01-10	not yet calculated	CVE-2023-42828 product-security@apple.com
apple — macos	The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to access SSH passphrases.	2024-01-10	not yet calculated	CVE-2023-42829 product-security@apple.com product-security@apple.com product-security@apple.com
apple — macos	A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. An app may be able to read sensitive location information.	2024-01-10	not yet calculated	CVE-2023-42830 product-security@apple.com product-security@apple.com
apple — macos	This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to fingerprint the user.	2024-01-10	not yet calculated	CVE-2023-42831 product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com
apple — macos	A race condition was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to gain root privileges.	2024-01-10	not yet calculated	CVE-2023-42832 product-security@apple.com product-security@apple.com product-security@apple.com
apple — macos	An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, tvOS 16.4, iOS 16.4 and iPadOS 16.4, watchOS 9.4. Processing an image may result in disclosure of process memory.	2024-01-10	not yet calculated	CVE-2023-42862 product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com
apple — macos	An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, tvOS 16.4, iOS 16.4 and iPadOS 16.4, watchOS 9.4. Processing an image may result in disclosure of process memory.	2024-01-10	not yet calculated	CVE-2023-42865 product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com
apple — macos	Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Ventura 13.4, iOS 16.5 and iPadOS 16.5. Multiple issues in libxml2.	2024-01-10	not yet calculated	CVE-2023-42869 product-security@apple.com product-security@apple.com
apple — magic_keyboard_firmware	A session management issue was addressed with improved checks. This issue is fixed in Magic Keyboard Firmware Update 2.0.6. An attacker with physical access to the accessory may be able to extract its Bluetooth pairing key and monitor Bluetooth traffic.	2024-01-12	not yet calculated	CVE-2024-0230 product-security@apple.com
apple — safari	The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, tvOS 16.6, Safari 16.6, watchOS 9.6. Processing web content may lead to arbitrary code execution.	2024-01-10	not yet calculated	CVE-2023-42866 product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com
apple — tvos	The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited against versions of iOS released before iOS 15.7.1.	2024-01-09	not yet calculated	CVE-2022-48618 product-security@apple.com product-security@apple.com product-security@apple.com product-security@apple.com
atos — soap_server	A directory traversal vulnerability in the SOAP Server integrated in Atos Unify OpenScape Voice V10 before V10R3.26.1 allows a remote attacker to view the contents of arbitrary files in the local file system. An unauthenticated attacker might obtain sensitive files that allow for the compromise of the underlying system.	2024-01-12	not yet calculated	CVE-2023-48166 cve@mitre.org cve@mitre.org
buffalo — ls210D	An issue in Buffalo LS210D v.1.78-0.03 allows a remote attacker to execute arbitrary code via the Firmware Update Script at /etc/init.d/update_notifications.sh.	2024-01-11	not yet calculated	CVE-2023-51073 cve@mitre.org cve@mitre.org
cassia — gateway	In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. This leads to injecting Bash code and executing it with root privileges on device startup.	2024-01-10	not yet calculated	CVE-2023-31446 cve@mitre.org cve@mitre.org
cisco — multiple_products	Hyland Perceptive Filters releases before 2023-12-08 (e.g., 11.4.0.2647), as used in Cisco IronPort Email Security Appliance Software, Cisco Secure Email Gateway, and various non-Cisco products, allow attackers to trigger a segmentation fault and execute arbitrary code via a crafted document.	2024-01-10	not yet calculated	CVE-2023-31488 cve@mitre.org
click2gov– centralsquare	An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. Lack of access control protections allows remote attackers to arbitrarily delete the contractors from any user’s account when the user ID and contractor information is known.	2024-01-12	not yet calculated	CVE-2023-40362 cve@mitre.org cve@mitre.org
d-link_dir-822+ — d-link_dir-822+	D-Link DIR-822+ V1.0.2 was found to contain a command injection in SetStaticRouteSettings function. allows remote attackers to execute arbitrary commands via shell.	2024-01-11	not yet calculated	CVE-2023-51984 cve@mitre.org
d-link_dir-822+ — d-link_dir-822+	D-Link DIR-822+ V1.0.2 contains a login bypass in the HNAP1 interface, which allows attackers to log in to administrator accounts with empty passwords.	2024-01-11	not yet calculated	CVE-2023-51987 cve@mitre.org
d-link_dir-822+ — d-link_dir-822+	D-Link DIR-822+ V1.0.2 contains a login bypass in the HNAP1 interface, which allows attackers to log in to administrator accounts with empty passwords.	2024-01-11	not yet calculated	CVE-2023-51989 cve@mitre.org
dir815 — dir815	An issue discovered in D-Link dir815 v.1.01SSb08.bin allows a remote attacker to execute arbitrary code via a crafted POST request to the service parameter in the soapcgi_main function of the cgibin binary component.	2024-01-10	not yet calculated	CVE-2023-51123 cve@mitre.org
elite — crm	Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/login endpoint.	2024-01-11	not yet calculated	CVE-2022-40361 cve@mitre.org cve@mitre.org
flaskcode_for_python — flaskcode_for_python	An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a GET request to a /resource-data/.txt URI (from views.py), allows attackers to read arbitrary files.	2024-01-13	not yet calculated	CVE-2023-52288 cve@mitre.org
flaskcode_for_python — flaskcode_for_python	An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a POST request to a /update-resource-data/ URI (from views.py), allows attackers to write to arbitrary files.	2024-01-13	not yet calculated	CVE-2023-52289 cve@mitre.org
flient — smart_door_lock	Flient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials. Due to default credentials on a debug interface, in combination with certain design choices, an attacker can unlock the Flient Smart Door Lock by replacing the fingerprint that is stored on the scanner.	2024-01-11	not yet calculated	CVE-2023-50124 cve@mitre.org
flient — smart_door_lock	Missing encryption in the NFC tags of the Flient Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original tags, which results in an attacker gaining access to the perimeter.	2024-01-11	not yet calculated	CVE-2023-50129 cve@mitre.org
flir — ax8	Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter.	2024-01-10	not yet calculated	CVE-2023-51126 cve@mitre.org
flir — ax8_thermal_sensor_cameras	FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction. This vulnerability allows an unauthenticated, remote attacker to obtain arbitrary sensitive file contents by uploading a specially crafted symbolic link file.	2024-01-10	not yet calculated	CVE-2023-51127 cve@mitre.org
follet_school_solutions — follet_school_solutions_destiny	Cross Site Scripting vulnerability in Follet School Solutions Destiny v.20_0_1_AU4 and later allows a remote attacker to run arbitrary code via presentonesearchresultsform.do.	2024-01-09	not yet calculated	CVE-2023-38827 cve@mitre.org
freeimage — memoryreadproc	An integer overflow vulnerability in FreeImageIO.cpp:: MemoryReadProc in FreeImage 3.18.0 allows attackers to obtain sensitive information, cause a denial-of-service attacks and/or run arbitrary code.	2024-01-09	not yet calculated	CVE-2023-47992 cve@mitre.org
freeimage_project– freeimage	A Buffer out-of-bound read vulnerability in Exif.cpp::ReadInt32 in FreeImage 3.18.0 allows attackers to cause a denial-of-service.	2024-01-09	not yet calculated	CVE-2023-47993 cve@mitre.org
freeimage_project– freeimage	An integer overflow vulnerability in LoadPixelDataRLE4 function in PluginBMP.cpp in Freeimage 3.18.0 allows attackers to obtain sensitive information, cause a denial of service and/or run arbitrary code.	2024-01-09	not yet calculated	CVE-2023-47994 cve@mitre.org
freeimage_project– freeimage	Buffer Overflow vulnerability in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of service.	2024-01-09	not yet calculated	CVE-2023-47995 cve@mitre.org
freeimage_project– freeimage	An integer overflow vulnerability in Exif.cpp::jpeg_read_exif_dir in FreeImage 3.18.0 allows attackers to obtain information and cause a denial of service.	2024-01-09	not yet calculated	CVE-2023-47996 cve@mitre.org
freeimage_project– freeimage	An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 leads to an infinite loop and allows attackers to cause a denial of service.	2024-01-10	not yet calculated	CVE-2023-47997 cve@mitre.org
gentoo — portage	In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification.	2024-01-12	not yet calculated	CVE-2016-20021 cve@mitre.org cve@mitre.org cve@mitre.org
gl.inet –gl.inet	An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.	2024-01-12	not yet calculated	CVE-2023-50919 cve@mitre.org
gl.inet –gl.inet	An issue was discovered on GL.iNet devices before version 4.5.0. They assign the same session ID after each user reboot, allowing attackers to share session identifiers between different sessions and bypass authentication or access control measures. Attackers can impersonate legitimate users or perform unauthorized actions. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.	2024-01-12	not yet calculated	CVE-2023-50920 cve@mitre.org
google — chrome	Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.216 allowed an attacker in a privileged network position to install a malicious extension via a crafted HTML page. (Chromium security severity: High)	2024-01-10	not yet calculated	CVE-2024-0333 chrome-cve-admin@google.com chrome-cve-admin@google.com chrome-cve-admin@google.com chrome-cve-admin@google.com
gradle_enterprise — gradle_enterprise	In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in.	2024-01-09	not yet calculated	CVE-2023-49238 cve@mitre.org cve@mitre.org
hongdian — h8951-4g-esp	Root user password is hardcoded into the device and cannot be changed in the user interface.	2024-01-12	not yet calculated	CVE-2023-49253 cvd@cert.pl cvd@cert.pl
hongdian — h8951-4g-esp	Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the “destination” field of the network test tools. This is similar to the vulnerability CVE-2021-28151 mitigated on the user interface level by blacklisting characters with JavaScript, however, it can still be exploited by sending POST requests directly.	2024-01-12	not yet calculated	CVE-2023-49254 cvd@cert.pl cvd@cert.pl
hongdian — h8951-4g-esp	The router console is accessible without authentication at “data” field, and while a user needs to be logged in in order to modify the configuration, the session state is shared. If any other user is currently logged in, the anonymous user can execute commands in the context of the authenticated one. If the logged in user has administrative privileges, it is possible to use webadmin service configuration commands to create a new admin user with a chosen password.	2024-01-12	not yet calculated	CVE-2023-49255 cvd@cert.pl cvd@cert.pl
hongdian — h8951-4g-esp	It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key.	2024-01-12	not yet calculated	CVE-2023-49256 cvd@cert.pl cvd@cert.pl
hongdian — h8951-4g-esp	An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility and execute it with the root user privileges.	2024-01-12	not yet calculated	CVE-2023-49257 cvd@cert.pl cvd@cert.pl
hongdian — h8951-4g-esp	User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging the XSS vulnerability located at “/gui/terminal_tool.cgi” in the “data” parameter.	2024-01-12	not yet calculated	CVE-2023-49258 cvd@cert.pl cvd@cert.pl
hongdian — h8951-4g-esp	The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a reasonable time.	2024-01-12	not yet calculated	CVE-2023-49259 cvd@cert.pl cvd@cert.pl
hongdian — h8951-4g-esp	An XSS attack can be performed by changing the MOTD banner and pointing the victim to the “terminal_tool.cgi” path. It can be used together with the vulnerability CVE-2023-49255.	2024-01-12	not yet calculated	CVE-2023-49260 cvd@cert.pl cvd@cert.pl
hongdian — h8951-4g-esp	The “tokenKey” value used in user authorization is visible in the HTML source of the login page.	2024-01-12	not yet calculated	CVE-2023-49261 cvd@cert.pl cvd@cert.pl
hongdian — h8951-4g-esp	The authentication mechanism can be bypassed by overflowing the value of the Cookie “authentication” field, provided there is an active user session.	2024-01-12	not yet calculated	CVE-2023-49262 cvd@cert.pl cvd@cert.pl
hospital_management_system — hospital_management_system	A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a crafted payload entered into the ‘Admin Remark’ parameter under the ‘Contact Us Queries -> Unread Query’ tab.	2024-01-10	not yet calculated	CVE-2020-26627 cve@mitre.org
hospital_management_system — hospital_management_system	A Cross-Site Scripting (XSS) vulnerability was discovered in Hospital Management System V4.0 which allows an attacker to execute arbitrary web scripts or HTML code via a malicious payload appended to a username on the ‘Edit Profile” page and triggered by another user visiting the profile.	2024-01-10	not yet calculated	CVE-2020-26628 cve@mitre.org
hospital_management_system — hospital_management_system	A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows an unauthenticated attacker to upload any file to the server.	2024-01-10	not yet calculated	CVE-2020-26629 cve@mitre.org
hospital_management_system — hospital_management_system	A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a special payload in the ‘Doctor Specialization’ field under the ‘Go to Doctors’ tab after logging in as an admin.	2024-01-10	not yet calculated	CVE-2020-26630 cve@mitre.org
hozard — alarmsysteem	A default engineer password set on the Hozard alarm system (Alarmsysteem) v1.0 allows an attacker to bring the alarm system to a disarmed state.	2024-01-11	not yet calculated	CVE-2023-50125 cve@mitre.org
hozard — alarmsysteem	Missing encryption in the RFID tags of the Hozard alarm system (Alarmsysteem) v1.0 allow attackers to create a cloned tag via brief physical proximity to one of the original tags, which results in an attacker being able to bring the alarm system to a disarmed state.	2024-01-11	not yet calculated	CVE-2023-50126 cve@mitre.org
hozard — alarmsysteem	Hozard alarm system (Alarmsysteem) v1.0 is vulnerable to Improper Authentication. Commands sent via the SMS functionality are accepted from random phone numbers, which allows an attacker to bring the alarm system to a disarmed state from any given phone number.	2024-01-11	not yet calculated	CVE-2023-50127 cve@mitre.org
hozard — alarmsysteem	The remote keyless system of the Hozard alarm system (alarmsystemen) v1.0 sends an identical radio frequency signal for each request, which results in an attacker being able to conduct replay attacks to bring the alarm system to a disarmed state.	2024-01-11	not yet calculated	CVE-2023-50128 cve@mitre.org cve@mitre.org
hozard — alarmsystemen	The number of attempts to bring the Hozard Alarm system (alarmsystemen) v1.0 to a disarmed state is not limited. This could allow an attacker to perform a brute force on the SMS authentication, to bring the alarm system to a disarmed state.	2024-01-11	not yet calculated	CVE-2023-50123 cve@mitre.org
jave2 — ffmpeg	An issue was discovered in Jave2 version 3.3.1, allows attackers to execute arbitrary code via the FFmpeg function.	2024-01-12	not yet calculated	CVE-2023-48909 cve@mitre.org cve@mitre.org
jfinalcms — jfinalcms	A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or HTML.	2024-01-12	not yet calculated	CVE-2024-22492 cve@mitre.org
jfinalcms — jfinalcms	A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML.	2024-01-12	not yet calculated	CVE-2024-22493 cve@mitre.org
jfinalcms — jfinalcms	A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile parameter, which allows remote attackers to inject arbitrary web script or HTML.	2024-01-12	not yet calculated	CVE-2024-22494 cve@mitre.org
jfinalcms — jfinalcms	Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table.	2024-01-09	not yet calculated	CVE-2023-50136 cve@mitre.org
judging_management_system — oretnom23	SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via sub_event_id parameter in sub_event_stat_update.php.	2024-01-12	not yet calculated	CVE-2023-30014 cve@mitre.org
judging_management_system — oretnom23	SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via txtsearch parameter in review_search.php.	2024-01-12	not yet calculated	CVE-2023-30015 cve@mitre.org
judging_management_system — oretnom23	SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via sub_event_id parameter in sub_event_details_edit.php.	2024-01-12	not yet calculated	CVE-2023-30016 cve@mitre.org
karlomikus — karlomikus_bar_assistant	Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before making a request through Image::make(), which could allow authenticated remote attackers to execute arbitrary code.	2024-01-10	not yet calculated	CVE-2023-49471 cve@mitre.org
kyocera_device — kyocera_device_manager	Kyocera Device Manager before 3.1.1213.0 allows NTLM credential exposure during UNC path authentication via a crafted change from a local path to a UNC path. It allows administrators to configure the backup location of the database used by the application. Attempting to change this location to a UNC path via the GUI is rejected due to the use of a (backslash) character, which is supposed to be disallowed in a pathname. Intercepting and modifying this request via a proxy, or sending the request directly to the application endpoint, allows UNC paths to be set for the backup location. Once such a location is set, Kyocera Device Manager attempts to confirm access and will try to authenticate to the UNC path; depending on the configuration of the environment, this may authenticate to the UNC with Windows NTLM hashes. This could allow NTLM credential relaying or cracking attacks.	2024-01-10	not yet calculated	CVE-2023-50916 cve@mitre.org cve@mitre.org cve@mitre.org
libebml — libebml	In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or writing. It may result in buffer overflows.	2024-01-12	not yet calculated	CVE-2023-52339 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
linux — kernel	An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.	2024-01-11	not yet calculated	CVE-2023-51_ker780 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
linux — kernel	An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition.	2024-01-11	not yet calculated	CVE-2023-51781 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
linux — kernel	An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-after-free because of a rose_accept race condition.	2024-01-11	not yet calculated	CVE-2023-51782 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
linux — kernel	An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service (panic) because input_set_capability mishandles the situation in which an event code falls outside of a bitmap.	2024-01-12	not yet calculated	CVE-2022-48619 cve@mitre.org cve@mitre.org
live555– live555	A heap-use-after-free vulnerability was found in live555 version 2023.05.10 while handling the SETUP.	2024-01-12	not yet calculated	CVE-2023-37117 cve@mitre.org cve@mitre.org
mediawiki — mediawiki	An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:EventDetails page allows XSS via the x-xss language setting for internationalization (i18n).	2024-01-12	not yet calculated	CVE-2024-23171 cve@mitre.org cve@mitre.org
mediawiki — mediawiki	An issue was discovered in the CheckUser extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via message definitions. e.g., in SpecialCheckUserLog.	2024-01-12	not yet calculated	CVE-2024-23172 cve@mitre.org cve@mitre.org
mediawiki — mediawiki	An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php.	2024-01-12	not yet calculated	CVE-2024-23173 cve@mitre.org cve@mitre.org
mediawiki — mediawiki	An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via the rev-deleted-user, pagetriage-tags-quickfilter-label, pagetriage-triage, pagetriage-filter-date-range-format-placeholder, pagetriage-filter-date-range-to, pagetriage-filter-date-range-from, pagetriage-filter-date-range-heading, pagetriage-filter-set-button, or pagetriage-filter-reset-button message.	2024-01-12	not yet calculated	CVE-2024-23174 cve@mitre.org cve@mitre.org
mediawiki — mediawiki	An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2. XSS can occur via the Special:PageStatistics page parameter.	2024-01-12	not yet calculated	CVE-2024-23177 cve@mitre.org cve@mitre.org
mediawiki — mediawiki	An issue was discovered in the Phonos extension in MediaWiki before 1.40.2. PhonosButton.js allows i18n-based XSS via the phonos-purge-needed-error message.	2024-01-12	not yet calculated	CVE-2024-23178 cve@mitre.org cve@mitre.org
mediawiki — mediawiki	An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. For a Special:GlobalBlock?uselang=x-xss URI, i18n-based XSS can occur via the parentheses message. This affects subtitle links in buildSubtitleLinks.	2024-01-12	not yet calculated	CVE-2024-23179 cve@mitre.org cve@mitre.org
mp4box — mp4box_gpac	MP4Box GPAC version 2.3-DEV-rev636-gfbd7e13aa-master was discovered to contain an infinite loop in the function av1_uvlc at media_tools/av_parsers.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.	2024-01-10	not yet calculated	CVE-2023-50120 cve@mitre.org
nikon — exiftags	In exiftags 1.01, nikon_prop1 in nikon.c has a heap-based buffer overflow (write of size 28) because snprintf can write to an unexpected address.	2024-01-11	not yet calculated	CVE-2023-50671 cve@mitre.org cve@mitre.org
npm — package@evershop/evershop	Lack of authentication in NPM’s package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints.	2024-01-13	not yet calculated	CVE-2023-46942 cve@mitre.org cve@mitre.org
npm — package@evershop/evershop	An issue was discovered in NPM’s package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as “secret”. A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.	2024-01-13	not yet calculated	CVE-2023-46943 cve@mitre.org
openkm — openkm	A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension that allows an authenticated user to upload a note on a file which acts as a stored XSS payload. Any user who opens the note of a document file will trigger the XSS.	2024-01-13	not yet calculated	CVE-2023-50072 cve@mitre.org
openssl — openssl	Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs restores the contents of vector registers in a different order than they are saved. Thus the contents of some of these vector registers are corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions. The consequences of this kind of internal application state corruption can be various – from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However unless the compiler uses the vector registers for storing pointers, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3. If this cipher is enabled on the server a malicious client can influence whether this AEAD cipher is used. This implies that TLS server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue.	2024-01-09	not yet calculated	CVE-2023-6129 openssl-security@openssl.org openssl-security@openssl.org openssl-security@openssl.org openssl-security@openssl.org
parsexlsx_for_perl — parsexlsx_for_perl	The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during parsing of a crafted XLSX document. This occurs because the memoize implementation does not have appropriate constraints on merged cells.	2024-01-09	not yet calculated	CVE-2024-22368 cve@mitre.org cve@mitre.org cve@mitre.org
phpgurukul_art_gallery_management_system — phpgurukul_art_gallery_management_system	In PHPGurukul Art Gallery Management System v1.1, “Update Artist Image” functionality of “imageid” parameter is vulnerable to SQL Injection.	2024-01-12	not yet calculated	CVE-2023-51978 cve@mitre.org
piwigo — piwigo	Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in the Admin Tools plug-in component.	2024-01-12	not yet calculated	CVE-2023-51790 cve@mitre.org cve@mitre.org
pmb — pmb	File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uploaded to the start_import.php file.	2024-01-11	not yet calculated	CVE-2023-46474 cve@mitre.org cve@mitre.org
publiccms — publiccms	PublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS). Because files can be uploaded and online preview function is provided, pdf files and html files containing malicious code are uploaded, an XSS popup window is realized through online viewing.	2024-01-10	not yet calculated	CVE-2023-51252 cve@mitre.org
qstar — archive_solutions	An unauthenticated log file read in the component log-smblog-save of QStar Archive Solutions RELEASE_3-0 Build 7 Patch 0 allows attackers to disclose the SMB Log contents via executing a crafted command.	2024-01-13	not yet calculated	CVE-2023-51062 cve@mitre.org
qstar — archive_solutions	QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 was discovered to contain a DOM Based Reflected Cross Site Scripting (XSS) vulnerability within the component qnme-ajax?method=tree_level.	2024-01-13	not yet calculated	CVE-2023-51063 cve@mitre.org
qstar — archive_solutions	QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 was discovered to contain a DOM Based reflected XSS vulnerability within the component qnme-ajax?method=tree_table.	2024-01-13	not yet calculated	CVE-2023-51064 cve@mitre.org
qstar — archive_solutions	Incorrect access control in QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 allows unauthenticated attackers to obtain system backups and other sensitive information from the QStar Server.	2024-01-13	not yet calculated	CVE-2023-51065 cve@mitre.org
qstar — archive_solutions	An authenticated remote code execution vulnerability in QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 allows attackers to arbitrarily execute commands.	2024-01-13	not yet calculated	CVE-2023-51066 cve@mitre.org
qstar — archive_solutions	An unauthenticated reflected cross-site scripting (XSS) vulnerability in QStar Archive Solutions Release RELEASE_3-0 Build 7 allows attackers to execute arbitrary javascript on a victim’s browser via a crafted link.	2024-01-13	not yet calculated	CVE-2023-51067 cve@mitre.org
qstar — archive_solutions	An authenticated reflected cross-site scripting (XSS) vulnerability in QStar Archive Solutions Release RELEASE_3-0 Build 7 allows attackers to execute arbitrary javascript on a victim’s browser via a crafted link.	2024-01-13	not yet calculated	CVE-2023-51068 cve@mitre.org
qstar — archive_solutions	An access control issue in QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 allows unauthenticated attackers to arbitrarily adjust sensitive SMB settings on the QStar Server.	2024-01-13	not yet calculated	CVE-2023-51070 cve@mitre.org
qstar — archive_solutions	An access control issue in QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 allows unauthenticated attackers to arbitrarily disable the SMB service on a victim’s Qstar instance by executing a specific command in a link.	2024-01-13	not yet calculated	CVE-2023-51071 cve@mitre.org
relax-and-recover — relax-and-recover	Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.	2024-01-12	not yet calculated	CVE-2024-23301 cve@mitre.org cve@mitre.org
rymcu_forest — rymcu_forest	An issue in rymcu forest v.0.02 allows a remote attacker to obtain sensitive information via manipulation of the HTTP body URL in the com.rymcu.forest.web.api.common.UploadController file.	2024-01-13	not yet calculated	CVE-2023-51804 cve@mitre.org
scada — lts	An issue was discovered in Scada-LTS v2.7.5.2 build 4551883606 and before, allows remote attackers with low-level authentication to escalate privileges, execute arbitrary code, and obtain sensitive information via Event Handlers function.	2024-01-13	not yet calculated	CVE-2023-33472 cve@mitre.org
scalefusion — edge	ScaleFusion 10.5.2 does not properly limit users to the Edge application because Ctrl-O and Ctrl-S can be used.	2024-01-11	not yet calculated	CVE-2023-51748 cve@mitre.org cve@mitre.org
scalefusion — edge	ScaleFusion 10.5.2 does not properly limit users to the Edge application because a search can be made from a tooltip.	2024-01-11	not yet calculated	CVE-2023-51749 cve@mitre.org cve@mitre.org
scalefusion — edge	ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur.	2024-01-11	not yet calculated	CVE-2023-51750 cve@mitre.org cve@mitre.org
scalefusion — edge	ScaleFusion 10.5.2 does not properly limit users to the Edge application because Alt-F4 can be used.	2024-01-11	not yet calculated	CVE-2023-51751 cve@mitre.org cve@mitre.org
semcms — semcms	SEMCMS v4.8 was discovered to contain a SQL injection vulnerability via the languageID parameter in /web_inc.php.	2024-01-10	not yet calculated	CVE-2023-48864 cve@mitre.org
sfwtools — swftools	SWFTools 0.9.2 772e55a allows attackers to trigger a large memory-allocation attempt via a crafted document, as demonstrated by pdf2swf. This occurs in png_read_chunk in lib/png.c.	2024-01-11	not yet calculated	CVE-2023-37644 cve@mitre.org
tduck-platform — tduck-platform	SQL Injection vulnerability in TDuckCLoud tduck-platform v.4.0 allows a remote attacker to obtain sensitive information via the getFormKey parameter in the search function of FormDataMysqlService.java file.	2024-01-13	not yet calculated	CVE-2023-51805 cve@mitre.org
tecnick — tcexam	When access to the “admin” folder is not protected by some external authorization mechanisms e.g. Apache Basic Auth, it is possible for any user to download protected information like exam answers.	2024-01-11	not yet calculated	CVE-2023-6554 cvd@cert.pl cvd@cert.pl cvd@cert.pl
totolink — a3300r	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the hostName parameter in the setWanCfg function.	2024-01-11	not yet calculated	CVE-2024-22942 cve@mitre.org
totolink — a3300r	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the tz parameter in the setNtpCfg function.	2024-01-11	not yet calculated	CVE-2024-23057 cve@mitre.org
totolink — a3300r	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pass parameter in the setTr069Cfg function.	2024-01-11	not yet calculated	CVE-2024-23058 cve@mitre.org
totolink — a3300r	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdnsCfg function.	2024-01-11	not yet calculated	CVE-2024-23059 cve@mitre.org
totolink — a3300r	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDmzCfg function.	2024-01-11	not yet calculated	CVE-2024-23060 cve@mitre.org
totolink — a3300r	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the minute parameter in the setScheduleCfg function.	2024-01-11	not yet calculated	CVE-2024-23061 cve@mitre.org
totolink — a3700r	TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the NTPSyncWithHost function.	2024-01-11	not yet calculated	CVE-2023-52027 cve@mitre.org
totolink — a3700r	TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setTracerouteCfg function.	2024-01-11	not yet calculated	CVE-2023-52028 cve@mitre.org
totolink — a3700r	TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setDiagnosisCfg function.	2024-01-11	not yet calculated	CVE-2023-52029 cve@mitre.org
totolink — a3700r	TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setOpModeCfg function.	2024-01-11	not yet calculated	CVE-2023-52030 cve@mitre.org
totolink — a3700r	TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the UploadFirmwareFile function.	2024-01-11	not yet calculated	CVE-2023-52031 cve@mitre.org
totolink — ex1200t	TOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via the “main” function.	2024-01-11	not yet calculated	CVE-2023-52032 cve@mitre.org
totolink — ex1800t	TOTOlink EX1800T V9.1.0cu.2112_B20220316 was discovered to contain a remote command execution (RCE) vulnerability via the telnet_enabled parameter of the setTelnetCfg interface	2024-01-12	not yet calculated	CVE-2023-52026 cve@mitre.org
totolink — totolink	Totolink N200RE_V5 V9.3.5u.6255_B20211224 is vulnerable to Incorrect Access Control. The device allows remote attackers to obtain Wi-Fi system information, such as Wi-Fi SSID and Wi-Fi password, without logging into the management page.	2024-01-10	not yet calculated	CVE-2022-46025 cve@mitre.org
tp-link — archer_ax3000	Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. Affected products/versions are as follows: Archer AX3000 firmware versions prior to “Archer AX3000(JP)_V1_1.1.2 Build 20231115”, Archer AX5400 firmware versions prior to “Archer AX5400(JP)_V1_1.1.2 Build 20231115”, Deco X50 firmware versions prior to “Deco X50(JP)_V1_1.4.1 Build 20231122”, and Deco XE200 firmware versions prior to “Deco XE200(JP)_V1_1.2.5 Build 20231120”.	2024-01-11	not yet calculated	CVE-2024-21773 vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp
tp-link — archer_ax3000	Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer AX3000 firmware versions prior to “Archer AX3000(JP)_V1_1.1.2 Build 20231115”, Archer AX5400 firmware versions prior to “Archer AX5400(JP)_V1_1.1.2 Build 20231115”, and Archer AXE75 firmware versions prior to “Archer AXE75(JP)_V1_231115”.	2024-01-11	not yet calculated	CVE-2024-21821 vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp
tp-link — archer_ax3000	Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. Affected products/versions are as follows: Archer AX3000 firmware versions prior to “Archer AX3000(JP)_V1_1.1.2 Build 20231115”, Archer AX5400 firmware versions prior to “Archer AX5400(JP)_V1_1.1.2 Build 20231115”, Archer AXE75 firmware versions prior to “Archer AXE75(JP)_V1_231115”, Deco X50 firmware versions prior to “Deco X50(JP)_V1_1.4.1 Build 20231122”, and Deco XE200 firmware versions prior to “Deco XE200(JP)_V1_1.2.5 Build 20231120”.	2024-01-11	not yet calculated	CVE-2024-21833 vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp vultures@jpcert.or.jp
trendnet — davinci	An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Command injection can occur because the system function is used by davinci to unpack language packs without strict filtering of URL strings.	2024-01-09	not yet calculated	CVE-2023-49237 cve@mitre.org cve@mitre.org
uev –epoll_wait	uev (aka libuev) before 2.4.1 has a buffer overflow in epoll_wait if maxevents is a large number.	2024-01-12	not yet calculated	CVE-2022-48620 cve@mitre.org cve@mitre.org cve@mitre.org
ujcms — ujcms	A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the X-Forwarded-For function in the header.	2024-01-11	not yet calculated	CVE-2023-51350 cve@mitre.org cve@mitre.org cve@mitre.org
ujcms– ujcms	File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file.	2024-01-12	not yet calculated	CVE-2023-51806 cve@mitre.org cve@mitre.org cve@mitre.org
verydows — verydows	Verydows v2.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /protected/controller/backend/role_controller	2024-01-12	not yet calculated	CVE-2023-51949 cve@mitre.org
windows– scalefusion	In ScaleFusion (Windows Desktop App) agent v10.5.2, Kiosk mode application restrictions can be bypassed allowing arbitrary code to be executed.	2024-01-11	not yet calculated	CVE-2023-50159 cve@mitre.org cve@mitre.org
wordpress — wordpress	Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a Denial of Service (DoS) attack against external services.	2024-01-12	not yet calculated	CVE-2024-22027 vultures@jpcert.or.jp vultures@jpcert.or.jp
wuzhicms — wuzhicms	Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords parameter at /core/admin/copyfrom.php.	2024-01-10	not yet calculated	CVE-2023-52064 cve@mitre.org cve@mitre.org
yzmcms –yzmcms	member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header.	2024-01-11	not yet calculated	CVE-2023-52274 cve@mitre.org cve@mitre.org
zentao –zentao	Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly.	2024-01-10	not yet calculated	CVE-2023-49394 cve@mitre.org cve@mitre.org

alerts

CISA and FBI Release Known IOCs Associated with Androxgh0st Malware

Post author By admin
Post date January 16, 2024

Today, CISA and the Federal Bureau of Investigation (FBI) released a joint Cybersecurity Advisory (CSA), Known Indicators of Compromise Associated with Androxgh0st Malware, to disseminate known indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with threat actors deploying Androxgh0st malware.

Androxgh0st malware establishes a botnet for victim identification and exploitation in vulnerable networks, and targets files that contain confidential information, such as credentials, for various high profile applications. Threat actors deploying Androxgh0st malware have been observed exploiting specific vulnerabilities which could lead to remote code execution, including:

CVE-2017-9841 (PHP Unit Command)
CVE-2021-41773 (Apache HTTP Server versions), and
CVE-2018-15133 (Laravel applications).

In response, CISA is adding these CVEs to its Known Exploited Vulnerabilities Catalog.

CISA and FBI encourage organizations to review and implement the mitigations found in the joint CSA to reduce the likelihood and impact of cybersecurity incidents caused by Androxgh0st malware. For more information, visit CISA’s Malware, Phishing, and Ransomware page.

alerts

Known Indicators of Compromise Associated with Androxgh0st Malware

Post author By admin
Post date January 16, 2024

SUMMARY

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint Cybersecurity Advisory (CSA) to disseminate known indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with threat actors deploying Androxgh0st malware. Multiple, ongoing investigations and trusted third party reporting yielded the IOCs and TTPs, and provided information on Androxgh0st malware’s ability to establish a botnet that can further identify and compromise vulnerable networks.

The FBI and CISA encourage organizations to implement the recommendations in the Mitigations section of this CSA to reduce the likelihood and impact of cybersecurity incidents caused by Androxgh0st infections.

Download the PDF version of this report:

AA24-016A Known Indicators of Compromise Associated with Androxgh0st Malware
(PDF, 569.31 KB
)

TECHNICAL DETAILS

Note: This advisory uses the MITRE ATT&CK^® for Enterprise framework, version 14. See the MITRE ATT&CK Tactics and Techniques section for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques with corresponding mitigation and/or detection recommendations. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

Overview

Androxgh0st malware has been observed establishing a botnet [T1583.005] for victim identification and exploitation in target networks. According to open source reporting[1], Androxgh0st is a Python-scripted malware [T1059.006] primarily used to target .env files that contain confidential information, such as credentials [T1552.001] for various high profile applications (i.e., Amazon Web Services [AWS], Microsoft Office 365, SendGrid, and Twilio from the Laravel web application framework). Androxgh0st malware also supports numerous functions capable of abusing the Simple Mail Transfer Protocol (SMTP), such as scanning [T1046] and exploiting exposed credentials [T1078] and application programming interfaces (APIs) [T1114], and web shell deployment [T1505.003].

Targeting the PHPUnit

Androxgh0st malware TTPs commonly involves the use of scripts, conducting scanning [T1595] and searching for websites with specific vulnerabilities. In particular, threat actors deploying Androxgh0st have been observed exploiting CVE-2017-9841 to remotely run hypertext preprocessor (PHP) code on fallible websites via PHPUnit [T1190]. Websites using the PHPUnit module that have internet-accessible (exposed) /vendor folders are subject to malicious HTTP POST requests to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php uniform resource identifier (URI). This PHP page runs PHP code submitted through a POST request, which allows the threat actors to remotely execute code.

Malicious actors likely use Androxgh0st to download malicious files [T1105] to the system hosting the website. Threat actors are further able to set up a fake (illegitimate) page accessible via the URI to provide backdoor access to the website. This allows threat actors to download additional malicious files for their operations and access databases.

Laravel Framework Targeting

Androxgh0st malware establishes a botnet to scan for websites using the Laravel web application framework. After identifying websites using the Laravel web application, threat actors attempt to determine if the domain’s root-level .env file is exposed and contains credentials for accessing additional services. Note: .env files commonly store credentials and tokens. Threat actors often target .env files to steal these credentials within the environment variables.

If the .env file is exposed, threat actors will issue a GET request to the /.env URI to attempt to access the data on the page. Alternatively, Androxgh0st may issue a POST request to the same URI with a POST variable named 0x[] containing certain data sent to the web server. This data is frequently used as an identifier for the threat actor. This method appears to be used for websites in debug mode (i.e., when non-production websites are exposed to the internet). A successful response from either of these methods allows the threat actors to look for usernames, passwords, and/or other credentials pertaining to services such as email (via SMTP) and AWS accounts.

Androxgh0st malware can also access the application key [TA0006] for the Laravel application on the website. If the threat actors successfully identify the Laravel application key, they will attempt exploitation by using the key to encrypt PHP code [T1027.010]. The encrypted code is then passed to the website as a value in the cross-site forgery request (XSRF) token cookie, XSRF-TOKEN, and included in a future GET request to the website. The vulnerability defined in CVE-2018-15133 indicates that on Laravel applications, XSRF token values are subject to an un-serialized call, which can allow for remote code execution. In doing so, the threat actors can upload files to the website via remote access.

Apache Web Server Targeting

In correlation with CVE-2021-41773, Androxgh0st actors have been observed scanning vulnerable web servers [T1595.002] running Apache HTTP Server versions 2.4.49 or 2.4.50. Threat actors can identify uniform resource locators (URLs) for files outside root directory through a path traversal attack [T1083]. If these files are not protected by the “request all denied” configuration and Common Gateway Interface (CGI) scripts are enabled, this may allow for remote code execution.

If threat actors obtain credentials for any services using the above methods, they may use these credentials to access sensitive data or use these services to conduct additional malicious operations. For example, when threat actors successfully identify and compromise AWS credentials from a vulnerable website, they have been observed attempting to create new users and user policies [T1136]. Additionally, Andoxgh0st actors have been observed creating new AWS instances to use for conducting additional scanning activity [T1583.006].

INDICATORS OF COMPROMISE (IOCs)

Based on investigations and analysis, the following requests are associated with Androxgh0st activity:

Incoming GET and POST requests to the following URIs:
- /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
- /.env
Incoming POST requests with the following strings:
- [0x%5B%5D=androxgh0st]
- ImmutableMultiDict([('0x[]', 'androxgh0st')])

In both previously listed POST request strings, the name androxgh0st has been observed to be replaced with other monikers.

Additional URIs observed by the FBI and a trusted third party used by these threat actors for credential exfiltration include:

/info
/phpinfo
/phpinfo.php
/?phpinfo=1
/frontend_dev.php/$
/_profiler/phpinfo
/debug/default/view?panel=config
/config.json
/.json
/.git/config
/live_env
/.env.dist
/.env.save
/environments/.env.production
/.env.production.local
/.env.project
/.env.development
/.env.production
/.env.prod
/.env.development.local
/.env.old
//.env
- Note: the actor may attempt multiple different potential URI endpoints scanning for the .env file, for example /docker/.env or /local/.env.
/.aws/credentials
/aws/credentials
/.aws/config
/.git
/.test
/admin
/backend
/app
/current
/demo
/api
/backup
/beta
/cron
/develop
/Laravel
/laravel/core
/gists/cache
/test.php
/info.php
//.env
/admin-app/.env%20
/laravel/.env%20
/shared/.env%20
/.env.project%20
/apps/.env%20
/development/.env%20
/live_env%20
/.env.development%20

Targeted URIs for web-shell drop:

/.env/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//dev/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//lib/phpunit/phpunit/Util/PHP/eval-stdin.php
//lib/phpunit/src/Util/PHP/eval-stdin.php
//lib/phpunit/Util/PHP/eval-stdin.php
//new/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//old/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//phpunit/phpunit/src/Util/PHP/eval-stdin.php
//phpunit/phpunit/Util/PHP/eval-stdin.php
//phpunit/src/Util/PHP/eval-stdin.php
//phpunit/Util/PHP/eval-stdin.php
//protected/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//sites/all/libraries/mailchimp/vendor/phpunit/phpunit/src/Util/PHP/evalstdin.php
//vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//vendor/phpunit/phpunit/Util/PHP/eval-stdin.php
//vendor/phpunit/src/Util/PHP/eval-stdin.php
//vendor/phpunit/Util/PHP/eval-stdin.php
//wp-content/plugins/cloudflare/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//wp-content/plugins/dzs-videogallery/class_parts/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//wp-content/plugins/jekyll-exporter/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//wp-content/plugins/mm-plugin/inc/vendors/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/admin/ckeditor/plugins/ajaxplorer/phpunit/src/Util/PHP/eval-stdin.php
/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/api/vendor/phpunit/phpunit/src/Util/PHP/Template/eval-stdin.php
/lab/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/laravel_web/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/laravel52/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/laravelao/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/lib/phpunit/phpunit/Util/PHP/eval-stdin.php
/lib/phpunit/phpunit/Util/PHP/eval
stdin.php%20/lib/phpunit/src/Util/PHP/eval-stdin.php
/lib/phpunit/src/Util/PHP/eval-stdin.php
/lib/phpunit/Util/PHP/eval-stdin.php
/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/libraries/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/phpunit/phpunit/Util/PHP/eval-stdin.php
/phpunit/phpunit/Util/PHP/eval-stdin.php%20/phpunit/src/Util/PHP/evalstdin.php
/phpunit/src/Util/PHP/eval-stdin.php
./phpunit/Util/PHP/eval-stdin.php
/phpunit/Util/PHP/eval-stdin.php%20/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php.dev
/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php
/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php%20/vendor/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/Util/PHP/eval-stdin.php
/vendor/phpunit/Util/PHP/eval-stdin.php%20
/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

An example of attempted credential exfiltration through (honeypot) open proxies:

POST /.aws/credentials HTTP/1.1 host: www.example.com user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36 accept-encoding: gzip, deflate accept: */* connection: keep-alive content-length: 20 content-type: application/x-www-form-urlencoded

0x%5B%5D=androxgh0st

An example of attempted web-shell drop through (honeypot) open proxies:

GET http://www.example.com/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 host: www.example.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.76 accept-encoding: gzip, deflate accept: */* connection: keep-alive x-forwarded-for: 200.172.238.135 content-length: 279

Monikers used instead of Androxgh0st (0x%5B%5D=???):

Ridho
Aws
0x_0x
x_X
nopebee7
SMTPEX
evileyes0
privangga
drcrypter
errorcool
drosteam
androxmen
crack3rz
b4bbyghost
0x0day
janc0xsec
blackb0x
0x1331day
Graber

Example malware drops through eval-stdin.php:

hxxps://mc.rockylinux[.]si/seoforce/triggers/files/evil.txt 59e90be75e51c86b4b9b69dcede2cf815da5a79f7e05cac27c95ec35294151f4

hxxps://chainventures.co[.]uk/.well-known/aas
dcf8f640dd7cc27d2399cce96b1cf4b75e3b9f2dfdf19cee0a170e5a6d2ce6b6

hxxp://download.asyncfox[.]xyz/download/xmrig.x86_64
23fc51fde90d98daee27499a7ff94065f7ed4ac09c22867ebd9199e025dee066

hxxps://pastebin[.]com/raw/zw0gAmpC
ca45a14d0e88e4aa408a6ac2ee3012bf9994b16b74e3c66b588c7eabaaec4d72

hxxp://raw.githubusercontent[.]com/0x5a455553/MARIJUANA/master/MARIJUANA.php
0df17ad20bf796ed549c240856ac2bf9ceb19f21a8cae2dbd7d99369ecd317ef

hxxp://45.95.147[.]236/tmp.x86_64
6b5846f32d8009e6b54743d6f817f0c3519be6f370a0917bf455d3d114820bbc

hxxp://main.dsn[.]ovh/dns/pwer
bb7070cbede294963328119d1145546c2e26709c5cea1d876d234b991682c0b7

hxxp://tangible-drink.surge[.]sh/configx.txt
de1114a09cbab5ae9c1011ddd11719f15087cc29c8303da2e71d861b0594a1ba

MITRE ATT&CK TACTICS AND TECHNIQUES

See Tables 1-10 for all referenced threat actor tactics and techniques in this advisory.

*Table 1: Reconnaissance*
Technique Title	ID	Use
Active Scanning: Vulnerability Scanning	T1595.002	The threat actor scans websites for specific vulnerabilities to exploit.

*Table 2: Resource Development*
Technique Title	ID	Use
Acquire Infrastructure: Botnet	T1583.005	The threat actor establishes a botnet to identify and exploit victims.
Acquire Infrastructure: Web Services	T1583.006	The threat actor creates new AWS instances to use for scanning.

*Table 3: Initial Access*
Technique Title	ID	Use
Exploit Public-Facing Application	T1190	The threat actor exploits CVE-2017-9841 to remotely run hypertext preprocessor (PHP) code on websites via PHPUnit.

*Table 4: Execution*
Technique Title	ID	Use
Command and Scripting Interpreter: Python	T1059.006	The threat actor uses Androxgh0st, a Python-scripted malware, to target victim files.

*Table 5: Persistence*
Technique Title	ID	Use
Valid Accounts	T1078	The threat actor abuses the simple mail transfer protocol (SMTP) by exploiting exposed credentials.
Server Software Component: Web Shell	T1505.003	The threat actor deploys web shells to maintain persistent access to systems.
Create Account	T1136	The threat actor attempts to create new users and user policies with compromised AWS credentials from a vulnerable website.

*Table 6: Defense Evasion*
Technique Title	ID	Use
Obfuscated Files or Information: Command Obfuscation	T1027.010	The threat actor can exploit a successfully identified Laravel application key to encrypt PHP code, which is then passed to the site as a value in the XSRF-TOKEN cookie.

*Table 7: Credential Access*
Technique Title	ID	Use
Credential Access	TA0006	The threat actor can access the application key of the Laravel application on the site.
Unsecured Credentials: Credentials in Files	T1552.001	The threat actor targets .env files that contain confidential credential information.

*Table 8: Discovery*
Technique Title	ID	Use
File and Directory Discovery	T1083	The threat actor can identify URLs for files outside root directory through a path traversal attack.
Network Service Discovery	T1046	The threat actor uses Androxgh0st to abuse simple mail transfer protocol (SMTP) via scanning.

*Table 9: Collection*
Technique Title	ID	Use
Email Collection	T1114	The threat actor interacts with application programming interfaces (APIs) to gather information.

*Table 10: Command and Control*
Technique Title	ID	Use
Ingress Tool Transfer	T1105	The threat actor runs PHP code through a POST request to download malicious files to the system hosting the website.

MITIGATIONS

The FBI and CISA recommend implementing the mitigations below to improve your organization’s cybersecurity posture based on Androxgh0st threat actor activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s Cross-Sector Cybersecurity Performance Goals for more information on the CPGs, including additional recommended baseline protections.

These mitigations apply to all critical infrastructure organizations and network defenders. FBI and CISA recommend that software manufacturers incorporate secure by design principles and tactics into their software development practices, limiting the impact of actor techniques and strengthening their customers’ security posture. For more information on secure by design, see CISA’s Secure by Design webpage.

The FBI and CISA recommend network defenders apply the following mitigations to limit potential adversarial use of common system and network discovery techniques and to reduce the risk of compromise by actors using Androxgh0st malware.

Keep all operating systems, software, and firmware up to date. Specifically, ensure that Apache servers are not running versions 2.4.49 or 2.4.50. Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats. Prioritize patching known exploited vulnerabilities in internet-facing systems.
Verify that the default configuration for all URIs is to deny all requests unless there is a specific need for it to be accessible.
Ensure that any live Laravel applications are not in “debug” or testing mode. Remove all cloud credentials from .env files and revoke them. All cloud providers have safer ways to provide temporary, frequently rotated credentials to code running inside a web server without storing them in any file.
On a one-time basis for previously stored cloud credentials, and on an on-going basis for other types of credentials that cannot be removed, review any platforms or services that have credentials listed in the .env file for unauthorized access or use.
Scan the server’s file system for unrecognized PHP files, particularly in the root directory or /vendor/phpunit/phpunit/src/Util/PHP folder.
Review outgoing GET requests (via cURL command) to file hosting sites such as GitHub, pastebin, etc., particularly when the request accesses a .php file.

VALIDATE SECURITY CONTROLS

In addition to applying mitigations, FBI and CISA recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. The authoring agencies recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.

To get started:

Select an ATT&CK technique described in this advisory (see Tables 1-10).
Align your security technologies against the technique.
Test your technologies against the technique.
Analyze your detection and prevention technologies’ performance.
Repeat the process for all security technologies to obtain a set of comprehensive performance data.
Tune your security program, including people, processes, and technologies, based on the data generated by this process.

FBI and CISA recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

REPORTING

The FBI encourages organizations to report information concerning suspicious or criminal activity to their local FBI field office. With regards to specific information that appears in this CSA, indicators should always be evaluated in light of an organization’s complete security situation.

When available, each report submitted should include the date, time, location, type of activity, number of people, and type of equipment used for the activity, the name of the submitting company or organization, and a designated point of contact. Reports can be submitted to the FBI Internet Crime Complaint Center (IC3), a local FBI Field Office, or to CISA via its Incident Reporting System or its 24/7 Operations Center at report@cisa.gov or (888) 282-0870.

RESOURCES

REFERENCES

Fortinet – FortiGuard Labs: Threat Signal Report: AndroxGh0st Malware Actively Used in the Wild

ACKNOWLEDGEMENTS

Amazon contributed to this CSA.

DISCLAIMER

The information in this report is being provided “as is” for informational purposes only. FBI and CISA do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by FBI and CISA.

VERSION HISTORY

January 16, 2024: Initial version.

alerts

Cisco Releases Security Advisory for Cisco Unity Connection

Post author By admin
Post date January 11, 2024

Cisco released a security advisory to address a vulnerability (CVE-2024-20272) in Cisco Unity Connection. A cyber threat actor could exploit this vulnerability to take control of an affected system.

CISA encourages users and administrators to review the Cisco Unity Connection Unauthenticated Arbitrary File Upload Vulnerability advisory and apply the necessary updates.

alerts

Juniper Networks Releases Security Bulletin for Junos OS and Junos OS Evolved

Post author By admin
Post date January 11, 2024

Juniper Networks has released a security advisory to address a vulnerability (CVE-2024-21611) in Junos OS and Junos OS Evolved. A cyber threat actor could exploit this vulnerability to cause a denial-of-service condition.

CISA encourages users and administrators to review the Juniper Advisory JSA75752 and apply the necessary updates.

alerts

Ivanti Releases Security Update for Connect Secure and Policy Secure Gateways

Post author By admin
Post date January 10, 2024

Ivanti has released a security update to address an authentication bypass vulnerability (CVE-2023-46805) and a command injection vulnerability (CVE-2024-21887) in all supported versions (9.x and 22.x) of Connect Secure and Policy Secure gateways. A cyber threat actor could exploit these vulnerabilities to take control of an affected system.

Ivanti reports active exploitation of both CVE-2023-46805 and CVE-2024-21887.

CISA urges users and administrators to immediately review Ivanti’s security update and apply the current workaround. CISA will update this alert as Ivanti releases patches.

alerts

Vulnerability Summary for the Week of January 1, 2024

Post author By admin
Post date January 8, 2024

High Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
7-card — fakabao	A vulnerability has been found in 7-card Fakabao up to 1.0_build20230805 and classified as critical. Affected by this vulnerability is an unknown functionality of the file shop/alipay_notify.php. The manipulation of the argument out_trade_no leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249385 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-31	8.8	CVE-2023-7183 cna@vuldb.com cna@vuldb.com cna@vuldb.com
7-card — fakabao	A vulnerability was found in 7-card Fakabao up to 1.0_build20230805 and classified as critical. Affected by this issue is some unknown functionality of the file shop/notify.php. The manipulation of the argument out_trade_no leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-249386 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-31	8.8	CVE-2023-7184 cna@vuldb.com cna@vuldb.com cna@vuldb.com
7-card — fakabao	A vulnerability was found in 7-card Fakabao up to 1.0_build20230805. It has been classified as critical. This affects an unknown part of the file shop/wxpay_notify.php. The manipulation of the argument out_trade_no leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249387. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-31	8.8	CVE-2023-7185 cna@vuldb.com cna@vuldb.com cna@vuldb.com
7-card — fakabao	A vulnerability was found in 7-card Fakabao up to 1.0_build20230805. It has been declared as critical. This vulnerability affects unknown code of the file member/notify.php. The manipulation of the argument out_trade_no leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249388. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-31	8.8	CVE-2023-7186 cna@vuldb.com cna@vuldb.com cna@vuldb.com
amazon-ion — ion-java	Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.	2024-01-03	7.5	CVE-2024-21634 security-advisories@github.com
apache — dolphinscheduler	Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue.	2023-12-30	8.8	CVE-2023-49299 security@apache.org security@apache.org
apktool — apktool	Apktool is a tool for reverse engineering Android APK files. In versions 2.9.1 and prior, Apktool infers resource files’ output path according to their resource names which can be manipulated by attacker to place files at desired location on the system Apktool runs on. Affected environments are those in which an attacker may write/overwrite any file that user has write access, and either username is known or cwd is under user folder. Commit d348c43b24a9de350ff6e5bd610545a10c1fc712 contains a patch for this issue.	2024-01-03	7.8	CVE-2024-21633 security-advisories@github.com security-advisories@github.com
campcodes — chic_beauty_salon	A vulnerability classified as critical was found in Campcodes Chic Beauty Salon 20230703. Affected by this vulnerability is an unknown functionality of the file product-list.php of the component Product Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249157 was assigned to this vulnerability.	2023-12-29	8.8	CVE-2023-7150 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
campcodes — online_college_library_system	A vulnerability has been found in Campcodes Online College Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file index.php of the component Search. The manipulation of the argument category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249178 is the identifier assigned to this vulnerability.	2023-12-29	9.8	CVE-2023-7156 cna@vuldb.com cna@vuldb.com cna@vuldb.com
campcodes — online_college_library_system	A vulnerability, which was classified as critical, has been found in Campcodes Online College Library System 1.0. This issue affects some unknown processing of the file /admin/book_row.php of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249365 was assigned to this vulnerability.	2023-12-30	7.2	CVE-2023-7178 cna@vuldb.com cna@vuldb.com cna@vuldb.com
campcodes — online_college_library_system	A vulnerability classified as critical has been found in Campcodes Online College Library System 1.0. This affects an unknown part of the file /admin/return_add.php of the component HTTP POST Request Handler. The manipulation of the argument student leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249363.	2023-12-30	8.8	CVE-2023-7176 cna@vuldb.com cna@vuldb.com cna@vuldb.com
campcodes — online_college_library_system	A vulnerability classified as critical was found in Campcodes Online College Library System 1.0. This vulnerability affects unknown code of the file /admin/book_add.php of the component HTTP POST Request Handler. The manipulation of the argument category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249364.	2023-12-30	8.8	CVE-2023-7177 cna@vuldb.com cna@vuldb.com cna@vuldb.com
campcodes — online_college_library_system	A vulnerability, which was classified as critical, was found in Campcodes Online College Library System 1.0. Affected is an unknown function of the file /admin/category_row.php of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249366 is the identifier assigned to this vulnerability.	2023-12-30	8.8	CVE-2023-7179 cna@vuldb.com cna@vuldb.com cna@vuldb.com
cesanta — mjs	An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component.	2024-01-02	7.5	CVE-2023-49550 cve@mitre.org
cesanta — mjs	An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file.	2024-01-02	7.5	CVE-2023-49551 cve@mitre.org
cloudflare,_inc. — miniflare	Sending specially crafted HTTP requests to Miniflare’s server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.	2023-12-29	8.1	CVE-2023-7078 cna@cloudflare.com cna@cloudflare.com
cloudflare,_inc. — wrangler	The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector server listening on all network interfaces. This would allow an attacker on the local network to connect to the inspector and run arbitrary code. Additionally, the inspector server did not validate Origin/Host headers, granting an attacker that can trick any user on the local network into opening a malicious website the ability to run code. If wrangler dev –remote was being used, an attacker could access production resources if they were bound to the worker. This issue was fixed in wrangler@3.19.0 and wrangler@2.20.2. Whilst wrangler dev’s inspector server listens on local interfaces by default as of wrangler@3.16.0, an SSRF vulnerability in miniflare https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7 (CVE-2023-7078) allowed access from the local network until wrangler@3.18.0. wrangler@3.19.0 and wrangler@2.20.2 introduced validation for the Origin/Host headers.	2023-12-29	8	CVE-2023-7080 cna@cloudflare.com cna@cloudflare.com cna@cloudflare.com cna@cloudflare.com cna@cloudflare.com
code-projects — client_details_system	A vulnerability was found in code-projects Client Details System 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/update-clients.php. The manipulation of the argument uid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249144.	2023-12-29	9.8	CVE-2023-7141 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — client_details_system	A vulnerability was found in code-projects Client Details System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/clientview.php. The manipulation of the argument ID leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249145 was assigned to this vulnerability.	2023-12-29	9.8	CVE-2023-7142 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — college_notes_gallery	A vulnerability has been found in code-projects College Notes Gallery 2.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument user leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249133 was assigned to this vulnerability.	2023-12-31	8.8	CVE-2023-7130 cna@vuldb.com cna@vuldb.com cna@vuldb.com
codeastro — online_food_ordering_system	A vulnerability classified as critical was found in CodeAstro Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /admin/ of the component Admin Panel. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249778 is the identifier assigned to this vulnerability.	2024-01-05	7.3	CVE-2024-0247 cna@vuldb.com cna@vuldb.com cna@vuldb.com
coolkit_technology — ewelink-smart_home_for_android_and_ios	Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass. This issue affects eWeLink before 5.2.0.	2023-12-30	7.7	CVE-2023-6998 cvd@cert.pl cvd@cert.pl cvd@cert.pl
dedebiz — dedebiz	A vulnerability was found in Muyun DedeBIZ up to 6.2.12 and classified as critical. Affected by this issue is some unknown functionality of the component Add Attachment Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249368. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-30	7.2	CVE-2023-7181 cna@vuldb.com cna@vuldb.com cna@vuldb.com
documize — documize	SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint.	2023-12-29	9.8	CVE-2023-23634 cve@mitre.org
easy-rules-mvel — easy-rules-mvel	easy-rules-mvel v4.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component MVELRule.	2023-12-29	7.8	CVE-2023-50571 cve@mitre.org
ekol_informatics — website_template	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Ekol Informatics Website Template allows SQL Injection. This issue affects Website Template: through 20231215.	2024-01-02	9.8	CVE-2023-6436 iletisim@usom.gov.tr
embras — geosiap_erp	Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page.	2023-12-30	9.8	CVE-2023-50589 cve@mitre.org cve@mitre.org cve@mitre.org
flarum — flarum	Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation. The vulnerability has been fixed and published as flarum/core v1.8.5. As a workaround, some extensions modifying the logout route can remedy this issue if their implementation is safe.	2024-01-05	7.5	CVE-2024-21641 security-advisories@github.com security-advisories@github.com security-advisories@github.com
follow-redirects — follow-redirects	Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.	2024-01-02	7.3	CVE-2023-26159 report@snyk.io report@snyk.io report@snyk.io
froxlor — froxlor	Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements (e.g. surname, company name) established by the system. Version 2.1.2 fixes this issue.	2024-01-03	7.5	CVE-2023-50256 security-advisories@github.com security-advisories@github.com security-advisories@github.com
gm_information_technologies — multi-disciplinary_design_optimization	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in GM Information Technologies MDO allows SQL Injection. This issue affects MDO: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-29	9.8	CVE-2023-4675 iletisim@usom.gov.tr
google — android	In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01161825; Issue ID: MOLY01161825 (MSV-895).	2024-01-02	7.5	CVE-2023-32889 security@mediatek.com
google — google_nest_mini	An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege	2024-01-02	10	CVE-2023-48419 dsap-vuln-management@google.com
google — pixel_watch	In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation	2024-01-02	10	CVE-2023-48418 dsap-vuln-management@google.com
google — pixel_watch	There is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of health data with no additional execution privileges needed.	2024-01-02	8.4	CVE-2023-4164 dsap-vuln-management@google.com
google — wifi_pro	Google Nest WiFi Pro root code-execution & user-data compromise	2024-01-02	10	CVE-2023-6339 dsap-vuln-management@google.com
hcl_software — dryice_myxalytics	HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory. The product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Potential exploits can completely disrupt or take over the application.	2024-01-03	8.8	CVE-2023-45722 psirt@hcl.com
hcl_software — dryice_myxalytics	HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file without requiring user authentication.	2024-01-03	8.2	CVE-2023-45724 psirt@hcl.com
hcl_software — dryice_myxalytics	HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability. Certain API endpoints are accessible to Customer Admin Users that can allow access to sensitive information about other users.	2024-01-03	8.3	CVE-2023-50343 psirt@hcl.com
hcl_software — dryice_myxalytics	HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption, potentially giving an attacker ability to decrypt sensitive information.	2024-01-03	8.2	CVE-2023-50350 psirt@hcl.com
hcl_software — dryice_myxalytics	HCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or integrity of data.	2024-01-03	8.2	CVE-2023-50351 psirt@hcl.com
hcl_software — dryice_myxalytics	HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability. Certain endpoints permit users to manipulate the path (including the file name) where these files are stored on the server.	2024-01-03	7.6	CVE-2023-45723 psirt@hcl.com
hcl_software — dryice_myxalytics	HCL DRYiCE MyXalytics is impacted by Improper Access Control (Obsolete web pages) vulnerability. Discovery of outdated and accessible web pages, reflects a “Missing Access Control” vulnerability, which could lead to inadvertent exposure of sensitive information and/or exposing a vulnerable endpoint.	2024-01-03	7.6	CVE-2023-50341 psirt@hcl.com
hcl_software — dryice_myxalytics	HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability. A user can obtain certain details about another user as a result of improper access control.	2024-01-03	7.1	CVE-2023-50342 psirt@hcl.com
hihonor — magic_os	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.	2023-12-29	7.5	CVE-2023-23427 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_os	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.	2023-12-29	7.5	CVE-2023-23428 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_os	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.	2023-12-29	7.5	CVE-2023-23429 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_os	Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file	2023-12-29	7.1	CVE-2023-23435 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_os	Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file	2023-12-29	7.1	CVE-2023-23436 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_os	Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.	2023-12-29	7.1	CVE-2023-23442 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_os	Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.	2023-12-29	7.1	CVE-2023-23443 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_os	Some Honor products are affected by type confusion vulnerability; successful exploitation could cause information leak.	2023-12-29	7.1	CVE-2023-51426 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_os	Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.	2023-12-29	7.1	CVE-2023-51427 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_os	Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.	2023-12-29	7.1	CVE-2023-51428 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_ui	Some Honor products are affected by buffer overflow vulnerability, successful exploitation could cause code execution.	2023-12-29	7.8	CVE-2023-51434 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_ui	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.	2023-12-29	7.1	CVE-2023-51435 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magichome	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.	2023-12-29	7.5	CVE-2023-23430 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — nth-an00_firmware	Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution	2023-12-29	9.8	CVE-2023-23424 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — nth-an00_firmware	Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.	2023-12-29	7.1	CVE-2023-23431 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — nth-an00_firmware	Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.	2023-12-29	7.1	CVE-2023-23432 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — nth-an00_firmware	Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.	2023-12-29	7.1	CVE-2023-23433 3836d913-7555-4dd0-a509-f5667fdf5fe4
hitachi_energy — rtu500_series_cmu_firmware	A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is enabled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500 in a high rate, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a lack of flood control which eventually if exploited causes an internal stack overflow in the HCI Modbus TCP function.	2024-01-04	7.5	CVE-2022-2081 cybersecurity@hitachienergy.com
hospital_management_system — hospital_management_system	A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the component Admin Dashboard. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249356.	2023-12-30	7.3	CVE-2023-7172 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
jeecg — jeecg_boot	SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.	2023-12-30	9.8	CVE-2023-41542 cve@mitre.org
jeecg — jeecg_boot	SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicate/check.	2023-12-30	9.8	CVE-2023-41543 cve@mitre.org cve@mitre.org
jeecg — jeecg_boot	SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.	2023-12-30	9.8	CVE-2023-41544 cve@mitre.org
kashipara_group — billing_software	Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘itemnameid’ parameter of the material_bill.php?action=itemRelation resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-49622 help@fluidattacks.com help@fluidattacks.com
kashipara_group — billing_software	Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘cancelid’ parameter of the material_bill.php resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-49624 help@fluidattacks.com help@fluidattacks.com
kashipara_group — billing_software	Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘id’ parameter of the partylist_edit_submit.php resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-49625 help@fluidattacks.com help@fluidattacks.com
kashipara_group — billing_software	Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘buyer_address’ parameter of the buyer_detail_submit.php resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-49633 help@fluidattacks.com help@fluidattacks.com
kashipara_group — billing_software	Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘customer_details’ parameter of the buyer_invoice_submit.php resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-49639 help@fluidattacks.com help@fluidattacks.com
kashipara_group — billing_software	Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘bank_details’ parameter of the party_submit.php resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-49658 help@fluidattacks.com help@fluidattacks.com
kashipara_group — billing_software	Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘quantity[]’ parameter of the submit_delivery_list.php resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-49665 help@fluidattacks.com help@fluidattacks.com
kashipara_group — billing_software	Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘custmer_details’ parameter of the submit_material_list.php resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-49666 help@fluidattacks.com help@fluidattacks.com
kashipara_group — online_notice_board_system	Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘dd’ parameter of the registration.php resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-50743 help@fluidattacks.com help@fluidattacks.com
kashipara_group — online_notice_board_system	Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘e’ parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-50752 help@fluidattacks.com help@fluidattacks.com
kashipara_group — online_notice_board_system	Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘dd’ parameter of the user/update_profile.php resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-50753 help@fluidattacks.com help@fluidattacks.com
kashipara_group — online_notice_board_system	Online Notice Board System v1.0 is vulnerable to an Insecure File Upload vulnerability on the ‘f’ parameter of user/update_profile_pic.php page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application.	2024-01-04	8.8	CVE-2023-50760 help@fluidattacks.com help@fluidattacks.com
kashipara_group — travel_website	Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘hotelIDHidden’ parameter of the booking.php resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-50862 help@fluidattacks.com help@fluidattacks.com
kashipara_group — travel_website	Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘hotelIDHidden’ parameter of the generateReceipt.php resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-50863 help@fluidattacks.com help@fluidattacks.com
kashipara_group — travel_website	Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘hotelId’ parameter of the hotelDetails.php resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-50864 help@fluidattacks.com help@fluidattacks.com
kashipara_group — travel_website	Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘city’ parameter of the hotelSearch.php resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-50865 help@fluidattacks.com help@fluidattacks.com
kashipara_group — travel_website	Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘username’ parameter of the loginAction.php resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-50866 help@fluidattacks.com help@fluidattacks.com
kashipara_group — travel_website	Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘username’ parameter of the signupAction.php resource does not validate the characters received and they are sent unfiltered to the database.	2024-01-04	9.8	CVE-2023-50867 help@fluidattacks.com help@fluidattacks.com
laf — laf	Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which allows authenticated users to obtain any pod logs under the same namespace through this method, thereby obtaining sensitive information printed in the logs. As of time of publication, no known patched versions exist.	2024-01-03	9.6	CVE-2023-50253 security-advisories@github.com security-advisories@github.com
lenovo — universal_device_client	Uncontrolled search path vulnerabilities were reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute code with elevated privileges.	2024-01-03	7.8	CVE-2023-6338 psirt@lenovo.com
linux — kernel	A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial-of-service condition or potential code execution.	2024-01-04	7	CVE-2023-6270 secalert@redhat.com secalert@redhat.com
linux — kernel	A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system.	2024-01-02	7.8	CVE-2024-0193 secalert@redhat.com secalert@redhat.com
man-group — dtale	D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery (SSRF), allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the `Load From the Web` input is turned off by default. The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.	2024-01-05	7.5	CVE-2024-21642 security-advisories@github.com security-advisories@github.com security-advisories@github.com
masterlab — masterlab	A vulnerability classified as critical has been found in gopeak MasterLab up to 3.3.10. This affects the function sqlInject of the file app/ctrl/framework/Feature.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249147.	2023-12-29	9.8	CVE-2023-7144 cna@vuldb.com cna@vuldb.com cna@vuldb.com
masterlab — masterlab	A vulnerability classified as critical was found in gopeak MasterLab up to 3.3.10. This vulnerability affects the function sqlInject of the file app/ctrl/Framework.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249148.	2023-12-29	9.8	CVE-2023-7145 cna@vuldb.com cna@vuldb.com cna@vuldb.com
masterlab — masterlab	A vulnerability, which was classified as critical, has been found in gopeak MasterLab up to 3.3.10. This issue affects the function sqlInjectDelete of the file app/ctrl/framework/Feature.php of the component HTTP POST Request Handler. The manipulation of the argument phone leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249149 was assigned to this vulnerability.	2023-12-29	9.8	CVE-2023-7146 cna@vuldb.com cna@vuldb.com cna@vuldb.com
masterlab — masterlab	A vulnerability, which was classified as critical, was found in gopeak MasterLab up to 3.3.10. Affected is the function base64ImageContent of the file app/ctrl/User.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. VDB-249150 is the identifier assigned to this vulnerability.	2023-12-29	9.8	CVE-2023-7147 cna@vuldb.com cna@vuldb.com cna@vuldb.com
masterlab — masterlab	A vulnerability was found in gopeak MasterLab up to 3.3.10. It has been declared as critical. Affected by this vulnerability is the function add/update of the file app/ctrl/admin/User.php. The manipulation of the argument avatar leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249181 was assigned to this vulnerability.	2023-12-29	9.8	CVE-2023-7159 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
mattermost — mattermost	Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server.	2023-12-29	8.8	CVE-2023-7114 responsibledisclosure@mattermost.com
mediatek — lr13	In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01161803; Issue ID: MOLY01161803 (MSV-893).	2024-01-02	9.8	CVE-2023-32874 security@mediatek.com
mediatek — lr13	In modem EMM, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01183647; Issue ID: MOLY01183647 (MSV-963).	2024-01-02	7.5	CVE-2023-32890 security@mediatek.com
mediatek — nr15	In Modem IMS SMS UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00730807; Issue ID: MOLY00730807.	2024-01-02	7.5	CVE-2023-32886 security@mediatek.com
mediatek — nr15	In Modem IMS Stack, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01161837; Issue ID: MOLY01161837 (MSV-892).	2024-01-02	7.5	CVE-2023-32887 security@mediatek.com
mediatek — nr15	In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01161830; Issue ID: MOLY01161830 (MSV-894).	2024-01-02	7.5	CVE-2023-32888 security@mediatek.com
micropython — micropython	A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.	2023-12-29	9.8	CVE-2023-7152 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
micropython — micropython	A vulnerability was found in MicroPython up to 1.21.0. It has been classified as critical. Affected is the function slice_indices of the file objslice.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.22.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249180.	2023-12-29	9.8	CVE-2023-7158 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
microsoft — python_extension	Visual Studio Code Python Extension Remote Code Execution Vulnerability	2023-12-29	7.8	CVE-2020-17163 secure@microsoft.com
misskey — misskey	Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L805) without the user’s permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version [2023.12.1](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64).	2023-12-29	9.6	CVE-2023-52139 security-advisories@github.com security-advisories@github.com
mtab — bookmark	A vulnerability was found in MTab Bookmark up to 1.2.6 and classified as critical. This issue affects some unknown processing of the file public/install.php of the component Installation. The manipulation leads to improper access controls. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249395. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-31	8.1	CVE-2023-7193 cna@vuldb.com cna@vuldb.com cna@vuldb.com
netentsec — application_security_gateway_firmware	A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1. This affects an unknown part of the file index.php?para=index of the component Login. The manipulation of the argument check_VirtualSiteId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249183.	2023-12-29	9.8	CVE-2023-7161 cna@vuldb.com cna@vuldb.com cna@vuldb.com
omniauth-microsoft_graph — omniauth-microsoft_graph	omniauth-microsoft_graph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the `email` attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases when the `email` is used as a trusted user identifier. This could lead to account takeover. Version 2.0.0 contains a fix for this issue.	2024-01-02	8.6	CVE-2024-21632 security-advisories@github.com security-advisories@github.com security-advisories@github.com
otclient — otclient	OTCLient is an alternative tibia client for otserv. Prior to commit db560de0b56476c87a2f967466407939196dd254, the /mehah/otclient “`Analysis – SonarCloud`” workflow is vulnerable to an expression injection in Actions, allowing an attacker to run commands remotely on the runner, leak secrets, and alter the repository using this workflow. Commit db560de0b56476c87a2f967466407939196dd254 contains a fix for this issue.	2024-01-02	9.8	CVE-2024-21623 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
paddlepaddle — paddlepaddle	Stack overflow in paddle.searchsorted in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage.	2024-01-03	9.8	CVE-2023-52304 paddle-security@baidu.com
paddlepaddle — paddlepaddle	Stack overflow in paddle.linalg.lu_unpack in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage.	2024-01-03	9.8	CVE-2023-52307 paddle-security@baidu.com
paddlepaddle — paddlepaddle	Heap buffer overflow in paddle.repeat_interleave in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible.	2024-01-03	9.8	CVE-2023-52309 paddle-security@baidu.com
paddlepaddle — paddlepaddle	PaddlePaddle before 2.6.0 has a command injection in get_online_pass_interval. This resulted in the ability to execute arbitrary commands on the operating system.	2024-01-03	9.8	CVE-2023-52310 paddle-security@baidu.com
paddlepaddle — paddlepaddle	PaddlePaddle before 2.6.0 has a command injection in _wget_download. This resulted in the ability to execute arbitrary commands on the operating system.	2024-01-03	9.8	CVE-2023-52311 paddle-security@baidu.com
paddlepaddle — paddlepaddle	PaddlePaddle before 2.6.0 has a command injection in convert_shape_compare. This resulted in the ability to execute arbitrary commands on the operating system.	2024-01-03	9.8	CVE-2023-52314 paddle-security@baidu.com
paddlepaddle — paddlepaddle	FPE in paddle.nanmedian in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.	2024-01-03	7.5	CVE-2023-38674 paddle-security@baidu.com
paddlepaddle — paddlepaddle	FPE in paddle.linalg.matrix_rank in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.	2024-01-03	7.5	CVE-2023-38675 paddle-security@baidu.com
paddlepaddle — paddlepaddle	Nullptr in paddle.dot in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.	2024-01-03	7.5	CVE-2023-38676 paddle-security@baidu.com
paddlepaddle — paddlepaddle	FPE in paddle.linalg.eig in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.	2024-01-03	7.5	CVE-2023-38677 paddle-security@baidu.com
paddlepaddle — paddlepaddle	OOB access in paddle.mode in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.	2024-01-03	7.5	CVE-2023-38678 paddle-security@baidu.com
paddlepaddle — paddlepaddle	Nullptr in paddle.nextafter in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.	2024-01-03	7.5	CVE-2023-52302 paddle-security@baidu.com
paddlepaddle — paddlepaddle	Nullptr in paddle.put_along_axis in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.	2024-01-03	7.5	CVE-2023-52303 paddle-security@baidu.com
paddlepaddle — paddlepaddle	FPE in paddle.topk in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.	2024-01-03	7.5	CVE-2023-52305 paddle-security@baidu.com
paddlepaddle — paddlepaddle	FPE in paddle.lerp in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.	2024-01-03	7.5	CVE-2023-52306 paddle-security@baidu.com
paddlepaddle — paddlepaddle	FPE in paddle.amin in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.	2024-01-03	7.5	CVE-2023-52308 paddle-security@baidu.com
paddlepaddle — paddlepaddle	Nullptr dereference in paddle.crop in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.	2024-01-03	7.5	CVE-2023-52312 paddle-security@baidu.com
paddlepaddle — paddlepaddle	FPE in paddle.argmin and paddle.argmax in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.	2024-01-03	7.5	CVE-2023-52313 paddle-security@baidu.com
pandorafms — pandora_fms	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects Pandora FMS: from 700 through 774.	2023-12-29	8.8	CVE-2023-44088 security@pandorafms.com
perl — perl	A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and execute `cmd.exe` within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. This flaw allows an attacker with limited privileges to place`cmd.exe` in locations with weak permissions, such as `C:ProgramData`. By doing so, arbitrary code can be executed when an administrator attempts to use this executable from these compromised locations.	2024-01-02	7.8	CVE-2023-47039 secalert@redhat.com secalert@redhat.com secalert@redhat.com
poly — multiple_products	A vulnerability classified as problematic was found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument Cookie leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249256.	2023-12-29	7.5	CVE-2023-4463 cna@vuldb.com cna@vuldb.com nvd@nist.gov cna@vuldb.com cna@vuldb.com
poly — multiple_products	A vulnerability, which was classified as critical, has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This issue affects some unknown processing of the component Diagnostic Telnet Mode. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-249257 was assigned to this vulnerability.	2023-12-29	7.2	CVE-2023-4464 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
poly — trio_8800/trio_c60	A vulnerability was found in Poly Trio 8800 and Trio C60. It has been classified as problematic. This affects an unknown part of the component Poly Lens Management Cloud Registration. The manipulation leads to missing authorization. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier VDB-249261 was assigned to this vulnerability.	2023-12-29	7.6	CVE-2023-4468 cna@vuldb.com cna@vuldb.com nvd@nist.gov cna@vuldb.com cna@vuldb.com
prestashop — prestashop	PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Some modules using the `isCleanHTML` method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the `HTMLPurifier` library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of `HTML` type will call `isCleanHTML`.	2024-01-02	8.1	CVE-2024-21627 security-advisories@github.com security-advisories@github.com security-advisories@github.com
priva — topcontrol_suite	The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calculate the login credentials for the Priva TopControll suite.	2024-01-02	7.5	CVE-2022-3010 csirt@divd.nl csirt@divd.nl csirt@divd.nl
qnap_systems_inc. — qts/quts_hero	A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that have incompatible type, which may lead to a crash via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later	2024-01-05	7.5	CVE-2023-39296 security@qnapsecurity.com.tw
qnap_systems_inc. — qumagie	An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: QuMagie 2.2.1 and later	2024-01-05	7.4	CVE-2023-47560 security@qnapsecurity.com.tw
qnap_systems_inc. — video_station	An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 ( 2023/11/23 ) and later	2024-01-05	8.8	CVE-2023-41288 security@qnapsecurity.com.tw
qualcomm,_inc. — snapdragon	Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call.	2024-01-02	9.8	CVE-2023-33025 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Memory corruption in HLOS while running playready use-case.	2024-01-02	9.3	CVE-2023-33030 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.	2024-01-02	9.3	CVE-2023-33032 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Memory corruption in Audio during playback with speaker protection.	2024-01-02	8.4	CVE-2023-33033 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Memory corruption while running VK synchronization with KASAN enabled.	2024-01-02	8.4	CVE-2023-33094 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Memory corruption in Graphics Driver when destroying a context with KGSL_GPU_AUX_COMMAND_TIMELINE objects queued.	2024-01-02	8.4	CVE-2023-33108 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.	2024-01-02	8.4	CVE-2023-33113 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.	2024-01-02	8.4	CVE-2023-33114 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.	2024-01-02	8.4	CVE-2023-43514 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Information disclosure in Core services while processing a Diag command.	2024-01-02	7.6	CVE-2023-33014 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.	2024-01-02	7.1	CVE-2023-33036 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.	2024-01-02	7.1	CVE-2023-33037 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Transient DOS in Data Modem during DTLS handshake.	2024-01-02	7.5	CVE-2023-33040 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Transient DOS in WLAN Firmware while parsing a BTM request.	2024-01-02	7.5	CVE-2023-33062 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Memory corruption in wearables while processing data from AON.	2024-01-02	7.8	CVE-2023-33085 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.	2024-01-02	7.5	CVE-2023-33109 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback – PCM close and reset session index causing memory corruption.	2024-01-02	7.8	CVE-2023-33110 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Transient DOS when WLAN firmware receives “reassoc response” frame including RIC_DATA element.	2024-01-02	7.5	CVE-2023-33112 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.	2024-01-02	7.5	CVE-2023-33116 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.	2024-01-02	7.8	CVE-2023-33117 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.	2024-01-02	7.8	CVE-2023-33118 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Memory corruption in Audio when memory map command is executed consecutively in ADSP.	2024-01-02	7.8	CVE-2023-33120 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.	2024-01-02	7.5	CVE-2023-43511 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the services buffer.	2024-01-02	7.5	CVE-2023-43512 product-security@qualcomm.com
red_hat — red_hat_developer_hub	A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, including the raw access token. Upon gaining access to this token and depending on permissions, an attacker could push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately.	2024-01-04	7.3	CVE-2023-6944 secalert@redhat.com secalert@redhat.com
s-cms — s-cms	A vulnerability classified as critical was found in S-CMS up to 2.0_build20220529-20231006. Affected by this vulnerability is an unknown functionality of the file /s/index.php?action=statistics. The manipulation of the argument lid leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249391. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-31	8.8	CVE-2023-7189 cna@vuldb.com cna@vuldb.com cna@vuldb.com
s-cms — s-cms	A vulnerability, which was classified as critical, has been found in S-CMS up to 2.0_build20220529-20231006. Affected by this issue is some unknown functionality of the file /member/ad.php?action=ad. The manipulation of the argument A_text/A_url/A_contact leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249392. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-31	8.8	CVE-2023-7190 cna@vuldb.com cna@vuldb.com cna@vuldb.com
s-cms — s-cms	A vulnerability, which was classified as critical, was found in S-CMS up to 2.0_build20220529-20231006. This affects an unknown part of the file member/reg.php. The manipulation of the argument M_login/M_email leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249393 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-31	8.8	CVE-2023-7191 cna@vuldb.com cna@vuldb.com cna@vuldb.com
scone — scone	Improper initialization of x87 and SSE floating-point configuration registers in the __scone_entry component of SCONE before 5.8.0 for Intel SGX allows a local attacker to compromise the execution integrity of floating-point operations in an enclave or access sensitive information via side-channel analysis.	2023-12-30	7.8	CVE-2022-46487 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
shifuml — shifu	A vulnerability has been found in ShifuML shifu 0.12.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file src/main/java/ml/shifu/shifu/core/DataPurifier.java of the component Java Expression Language Handler. The manipulation of the argument FilterExpression leads to code injection. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249151.	2023-12-29	8.1	CVE-2023-7148 cna@vuldb.com cna@vuldb.com cna@vuldb.com
shipping_100_fahuo100 — shipping_100_fahuo100	A vulnerability classified as critical has been found in Shipping 100 Fahuo100 up to 1.1. Affected is an unknown function of the file member/login.php. The manipulation of the argument M_pwd leads to sql injection. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-249390 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-31	8.1	CVE-2023-7188 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sidequestvr — sidequest	SideQuest is a place to get virtual reality applications for Oculus Quest. The SideQuest desktop application uses deep links with a custom protocol (`sidequest://`) to trigger actions in the application from its web contents. Because, prior to version 0.10.35, the deep link URLs were not sanitized properly in all cases, a one-click remote code execution can be achieved in cases when a device is connected, the user is presented with a malicious link and clicks it from within the application. As of version 0.10.35, the custom protocol links within the electron application are now being parsed and sanitized properly.	2024-01-04	8.8	CVE-2024-21625 security-advisories@github.com
siemens — syngo_fastview	A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied data when parsing DICOM files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15097)	2024-01-04	7.8	CVE-2021-40367 productcert@siemens.com
siemens — syngo_fastview	A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied data when parsing BMP files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-14860)	2024-01-04	7.8	CVE-2021-42028 productcert@siemens.com
siemens — syngo_fastview	A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied data when parsing BMP files. This could result in a write-what-where condition and an attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15696)	2024-01-04	7.8	CVE-2021-45465 productcert@siemens.com
silicon_labs — gecko_sdk	An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory from the untrusted region.	2024-01-02	9.3	CVE-2023-4280 product-security@silabs.com product-security@silabs.com
small_crm — small_crm	PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection on the Users login panel because of “password” parameter is directly used in the SQL query without any sanitization and the SQL Injection payload being executed.	2023-12-29	9.8	CVE-2023-50035 cve@mitre.org
sourcecodester — customer_support_system	Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_ticket via department_id, customer_id, and subject.	2023-12-29	8.8	CVE-2023-50070 cve@mitre.org cve@mitre.org
sourcecodester — customer_support_system	Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_department via id or name.	2023-12-29	8.8	CVE-2023-50071 cve@mitre.org cve@mitre.org
sourcecodester — engineers_online_portal	A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ of the component Admin Login. The manipulation of the argument username/password leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-249440.	2024-01-01	7.3	CVE-2024-0182 cna@vuldb.com cna@vuldb.com
sourcecodester — free_and_open_source_inventory_management_system	A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /app/ajax/sell_return_data.php. The manipulation of the argument columns[0][data] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249179.	2023-12-29	9.8	CVE-2023-7157 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sourcecodester — free_and_open_source_inventory_management_system	A vulnerability, which was classified as critical, was found in SourceCodester Free and Open Source Inventory Management System 1.0. This affects an unknown part of the file /ample/app/action/edit_product.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249177 was assigned to this vulnerability.	2023-12-29	8.8	CVE-2023-7155 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sqlite — sqlite3	A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.	2023-12-29	9.8	CVE-2023-7104 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
tencent — tencent_distributed_sql	Tencent tdsqlpcloud through 1.8.5 allows unauthenticated remote attackers to discover database credentials via an index.php/api/install/get_db_info request, a related issue to CVE-2023-42387.	2023-12-31	7.5	CVE-2023-52286 cve@mitre.org
testlink — testlink	TestLink through 1.9.20 allows type juggling for authentication bypass because === is not used.	2023-12-30	7.5	CVE-2023-50110 cve@mitre.org
tj-actions — verify-changed-files	The [`tj-actions/verify-changed-files`](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. The [`verify-changed-files`](https://github.com/tj-actions/verify-changed-files) workflow returns the list of files changed within a workflow execution. This could potentially allow filenames that contain special characters such as `;` which can be used by an attacker to take over the [GitHub Runner](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners) if the output value is used in a raw fashion (thus being directly replaced before execution) inside a `run` block. By running custom commands, an attacker may be able to steal secrets such as `GITHUB_TOKEN` if triggered on other events than `pull_request`. This has been patched in versions [17](https://github.com/tj-actions/verify-changed-files/releases/tag/v17) and [17.0.0](https://github.com/tj-actions/verify-changed-files/releases/tag/v17.0.0) by enabling `safe_output` by default and returning filename paths escaping special characters for bash environments.	2023-12-29	7.7	CVE-2023-52137 security-advisories@github.com security-advisories@github.com security-advisories@github.com
totolink — n350rt_firmware	A vulnerability was found in Totolink N350RT 9.3.5u.6139_B20201216. It has been rated as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi?action=login&flag=ie8 of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. The exploit has been disclosed to the public and may be used. The identifier VDB-249389 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-31	8.8	CVE-2023-7187 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — x2000r_firmware	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRoute.	2023-12-30	9.8	CVE-2023-51133 cve@mitre.org cve@mitre.org
totolink — x2000r_firmware	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPasswordSetup.	2023-12-30	9.8	CVE-2023-51135 cve@mitre.org cve@mitre.org
totolink — x2000r_firmware	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRebootSchedule.	2023-12-30	9.8	CVE-2023-51136 cve@mitre.org cve@mitre.org
totolink — x6000r_firmware	TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi.	2023-12-30	9.8	CVE-2023-50651 cve@mitre.org cve@mitre.org
unified_remote — unified_remote	Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint.	2023-12-30	9.8	CVE-2023-52252 cve@mitre.org cve@mitre.org
ween_software — admin_panel	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Ween Software Admin Panel allows SQL Injection. This issue affects Admin Panel: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-29	9.8	CVE-2023-4541 iletisim@usom.gov.tr
wireshark_foundation — wireshark	HTTP3 dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file	2024-01-03	7.8	CVE-2024-0207 cve@gitlab.com cve@gitlab.com
wireshark_foundation — wireshark	GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file	2024-01-03	7.8	CVE-2024-0208 cve@gitlab.com cve@gitlab.com
wireshark_foundation — wireshark	IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file	2024-01-03	7.8	CVE-2024-0209 cve@gitlab.com cve@gitlab.com
wireshark_foundation — wireshark	Zigbee TLV dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file	2024-01-03	7.8	CVE-2024-0210 cve@gitlab.com cve@gitlab.com
wireshark_foundation — wireshark	DOCSIS dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file	2024-01-03	7.8	CVE-2024-0211 cve@gitlab.com cve@gitlab.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin. This issue affects JS Help Desk – Best Help Desk & Support Plugin through 2.7.1.	2024-01-05	10	CVE-2022-46839 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in IOSS WP MLM SOFTWARE PLUGIN. This issue affects WP MLM SOFTWARE PLUGIN through 4.0.	2023-12-29	10	CVE-2023-51475 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in David F. Carr RSVPMaker. This issue affects RSVPMaker through 10.6.6.	2023-12-29	9.8	CVE-2023-25054 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps. This issue affects Frontend Admin by DynamiApps through 3.18.3.	2023-12-29	9.8	CVE-2023-51411 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Piotnet Piotnet Forms. This issue affects Piotnet Forms through 1.0.25.	2023-12-29	9.8	CVE-2023-51412 audit@patchstack.com
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters. This issue affects EnvíaloSimple: Email Marketing y Newslettersthrough 2.1.	2023-12-29	9.8	CVE-2023-51414 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your AI co-pilot for WordPress and Chrome. This issue affects BERTHA AI. Your AI co-pilot for WordPress and Chrome through 1.11.10.7.	2023-12-29	9.8	CVE-2023-51419 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce. This issue affects Verge3D Publishing and E-Commerce through 4.5.2.	2023-12-29	9.9	CVE-2023-51421 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings \| WebinarIgnition. This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings \| WebinarIgnition through 3.05.0.	2023-12-31	9.8	CVE-2023-51423 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Jacques Malgrange Rencontre – Dating Site. This issue affects Rencontre – Dating Site through 3.10.1.	2023-12-29	9.8	CVE-2023-51468 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Mestres do WP Checkout Mestres WP. This issue affects Checkout Mestres WP through 7.1.9.6.	2023-12-31	9.8	CVE-2023-51469 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Pixelemu TerraClassifieds – Simple Classifieds Plugin. This issue affects TerraClassifieds – Simple Classifieds Plugin through 2.0.3.	2023-12-29	9.8	CVE-2023-51473 audit@patchstack.com
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store. This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce store through 1.0.6.	2023-12-29	9.8	CVE-2023-51505 audit@patchstack.com
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in Presslabs Theme per user. This issue affects Theme per userthrough 1.0.1.	2023-12-31	9.8	CVE-2023-52181 audit@patchstack.com
wordpress — wordpress	Missing Authorization vulnerability in Anders Thorborg. This issue affects Anders Thorborg through 1.4.12.	2023-12-29	8.8	CVE-2023-22676 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in BinaryStash WP Booklet. This issue affects WP Booklet through 2.1.8.	2023-12-29	8.8	CVE-2023-22677 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Milan Dini? Rename Media Files. This issue affects Rename Media Files through 1.0.1.	2023-12-29	8.8	CVE-2023-32095 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Crocoblock JetElements For Elementor. This issue affects JetElements For Elementor through 2.6.10.	2023-12-31	8.8	CVE-2023-39157 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in TienCOP WP EXtra. This issue affects WP EXtra through 6.2.	2023-12-29	8.8	CVE-2023-46623 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Qode Interactive Qode Essential Addons. This issue affects Qode Essential Addons through 1.5.2.	2023-12-29	8.8	CVE-2023-47840 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Brainstorm Force Astra Pro. This issue affects Astra Pro through 4.3.1.	2023-12-29	8.8	CVE-2023-49830 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in InspireUI MStore API. This issue affects MStore API through 4.10.1.	2023-12-29	8.8	CVE-2023-50878 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve. This issue affects New User Approve through 2.5.1.	2023-12-29	8.8	CVE-2023-50902 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in WebbaPlugins Appointment & Event Booking Calendar Plugin – Webba Booking. This issue affects Appointment & Event Booking Calendar Plugin – Webba Booking through 4.5.33.	2023-12-29	8.8	CVE-2023-51354 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Bright Plugins Block IPs for Gravity Forms. This issue affects Block IPs for Gravity Forms through 1.0.1.	2023-12-29	8.8	CVE-2023-51358 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Rise Themes Rise Blocks – A Complete Gutenberg Page Builder. This issue affects Rise Blocks – A Complete Gutenberg Page Builder through 3.1.	2023-12-29	8.8	CVE-2023-51378 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Brain Storm Force Ultimate Addons for WPBakery Page Builder. This issue affects Ultimate Addons for WPBakery Page Builder through 3.19.17.	2023-12-29	8.8	CVE-2023-51402 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in WPVibes WP Mail Log. This issue affects WP Mail Log through 1.1.2.	2023-12-29	8.8	CVE-2023-51410 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons. This issue affects JVM Gutenberg Rich Text Icons through 1.2.3.	2023-12-29	8.8	CVE-2023-51417 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce. This issue affects Verge3D Publishing and E-Commerce through 4.5.2.	2023-12-29	8.8	CVE-2023-51420 audit@patchstack.com
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings \| WebinarIgnition. This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings \| WebinarIgnition through 3.05.0.	2023-12-29	8.8	CVE-2023-51422 audit@patchstack.com
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in Jacques Malgrange Rencontre – Dating Site. This issue affects Rencontre – Dating Site through 3.11.1.	2023-12-29	8.8	CVE-2023-51470 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments. This issue affects Job Manager & Career – Manage job board listings, and recruitments through 1.4.4.	2023-12-29	8.8	CVE-2023-51545 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in WhileTrue Most And Least Read Posts Widget. This issue affects Most And Least Read Posts Widget through 2.5.16.	2023-12-31	8.8	CVE-2023-52133 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Ovation S.R.L. Dynamic Content for Elementor. This issue affects Dynamic Content for Elementor before 2.12.5.	2024-01-05	8.8	CVE-2023-52150 audit@patchstack.com
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder. This issue affects ARI Stream Quiz – WordPress Quizzes Builder through 1.3.0.	2023-12-31	8.8	CVE-2023-52182 audit@patchstack.com
wordpress — wordpress	The OMGF \| GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting due to a missing capability check on the update_settings() function hooked via admin_init in all versions up to, and including, 5.7.9. This makes it possible for unauthenticated attackers to update the plugin’s settings which can be used to inject Cross-Site Scripting payloads and delete entire directories. PLease note there were several attempted patched, and we consider 5.7.10 to be the most sufficiently patched.	2024-01-03	8.6	CVE-2023-6600 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange’s Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email \| Passwordless login. This issue affects miniOrange’s Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email \| Passwordless login through 5.6.1.	2023-12-29	7.5	CVE-2022-44589 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Kanban for WordPress Kanban Boards for WordPress. This issue affects Kanban Boards for WordPress through 2.5.21.	2023-12-29	7.2	CVE-2023-40606 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in POSIMYTH Nexter Extension. This issue affects Nexter Extension through 2.0.3.	2023-12-29	7.2	CVE-2023-45751 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in WebFactory Ltd Login Lockdown – Protect Login Form. This issue affects Login Lockdown – Protect Login Form through 2.06.	2023-12-29	7.2	CVE-2023-50837 audit@patchstack.com
wordpress — wordpress	Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway. This issue affects WooCommerce Stripe Payment Gateway through 7.6.1.	2024-01-05	7.5	CVE-2023-51502 audit@patchstack.com
wordpress — wordpress	Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo. This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo through 6.9.2.	2023-12-31	7.5	CVE-2023-51503 audit@patchstack.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4. This issue affects AI Power: Complete AI Pack – Powered by GPT-4 through 1.8.2.	2023-12-29	7.5	CVE-2023-51527 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in WPManageNinja LLC Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin. This issue affects Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin through 1.7.6.	2023-12-31	7.2	CVE-2023-51547 audit@patchstack.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode Product Catalog Simple. This issue affects Product Catalog Simple through 1.7.6.	2023-12-29	7.5	CVE-2023-51687 audit@patchstack.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress. This issue affects eCommerce Product Catalog Plugin for WordPress through 3.3.26.	2023-12-29	7.5	CVE-2023-51688 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in WP Zinc Page Generator. This issue affects Page Generator through 1.7.1.	2023-12-31	7.2	CVE-2023-52131 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Jewel Theme WP Adminify. This issue affects WP Adminify through 3.1.6.	2023-12-31	7.2	CVE-2023-52132 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Eyal Fitoussi GEO my WordPress. This issue affects GEO my WordPress through 4.0.2.	2023-12-31	7.2	CVE-2023-52134 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in WS Form WS Form LITE – Drag & Drop Contact Form Builder for WordPress. This issue affects WS Form LITE – Drag & Drop Contact Form Builder for WordPress through 1.9.170.	2023-12-29	7.2	CVE-2023-52135 audit@patchstack.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Naa986 WP Stripe Checkout. This issue affects WP Stripe Checkout through 1.2.2.37.	2024-01-05	7.5	CVE-2023-52143 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes. This issue affects Recipe Maker For Your Food Blog from Zip Recipes through 8.1.0.	2023-12-31	7.6	CVE-2023-52180 audit@patchstack.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Everestthemes Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin. This issue affects Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin through 2.1.9.	2023-12-31	7.5	CVE-2023-52185 audit@patchstack.com
wordpress — wordpress	The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ header in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-03	7.2	CVE-2023-7027 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons. This issue affects YITH WooCommerce Product Add-Ons through 4.3.0.	2023-12-31	9.1	CVE-2023-49777 audit@patchstack.com
xnview — xnview_classic	XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3ADBD0.	2023-12-29	9.8	CVE-2023-52173 cve@mitre.org cve@mitre.org
xnview — xnview_classic	XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3125D6.	2023-12-29	9.8	CVE-2023-52174 cve@mitre.org cve@mitre.org
yaztek_software_technologies_and_computer_systems — e-commerce_software	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Yaztek Software Technologies and Computer Systems E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-29	9.8	CVE-2023-4674 iletisim@usom.gov.tr
zzcms — zzcms	ZZCMS 2023 has a file upload vulnerability in 3/E_bak5.1/upload/index.php, allowing attackers to exploit this loophole to gain server privileges and execute arbitrary code.	2023-12-29	9.8	CVE-2023-50104 cve@mitre.org

Medium Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
antisamy-dotnet — antisamy-dotnet	OWASP AntiSamy .NET is a library for performing cleansing of HTML coming from untrusted sources. Prior to version 1.2.0, there is a potential for a mutation cross-site scripting (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy’s sanitized output. This is patched in OWASP AntiSamy .NET 1.2.0 and later. See important remediation details in the reference given below. As a workaround, manually edit the AntiSamy policy file (e.g., antisamy.xml) by deleting the `preserveComments` directive or setting its value to `false`, if present. Also, it would be useful to make AntiSamy remove the `noscript` tag by adding a line described in the GitHub Security Advisory to the tag definitions under the `` node or deleting it entirely if present. As the previously mentioned policy settings are preconditions for the mXSS attack to work, changing them as recommended should be sufficient to protect you against this vulnerability when using a vulnerable version of this library. However, the existing bug would still be present in AntiSamy or its parser dependency (HtmlAgilityPack). The safety of this workaround relies on configurations that may change in the future and don’t address the root cause of the vulnerability. As such, it is strongly recommended to upgrade to a fixed version of AntiSamy.	2024-01-02	6.1	CVE-2023-51652 security-advisories@github.com security-advisories@github.com security-advisories@github.com
campcodes — online_college_library_system	A vulnerability was found in Campcodes Online College Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/borrow_add.php of the component HTTP POST Request Handler. The manipulation of the argument student leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249362 is the identifier assigned to this vulnerability.	2023-12-30	4.7	CVE-2023-7175 cna@vuldb.com cna@vuldb.com cna@vuldb.com
cloudflare,_inc. — wrangler	Sending specially crafted HTTP requests and inspector messages to Wrangler’s dev server could result in any file on the user’s computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.	2023-12-29	5.7	CVE-2023-7079 cna@cloudflare.com cna@cloudflare.com cna@cloudflare.com
cloudflare,_inc. — zlib	Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.	2024-01-04	4	CVE-2023-6992 cna@cloudflare.com cna@cloudflare.com
code-projects — client_details_system	A vulnerability was found in code-projects Client Details System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/regester.php. The manipulation of the argument fname/lname/email/contact leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249146 is the identifier assigned to this vulnerability.	2023-12-29	4.8	CVE-2023-7143 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — qr_code_generator	A vulnerability was found in code-projects QR Code Generator 1.0. It has been classified as problematic. This affects an unknown part of the file /download.php?file=author.png. The manipulation of the argument file with the input “> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249153 was assigned to this vulnerability.	2023-12-29	6.1	CVE-2023-7149 cna@vuldb.com cna@vuldb.com cna@vuldb.com
codeastro — internet_banking_system	A vulnerability, which was classified as critical, has been found in CodeAstro Internet Banking System up to 1.0. This issue affects some unknown processing of the file pages_account.php of the component Profile Picture Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249509 was assigned to this vulnerability.	2024-01-02	6.3	CVE-2024-0194 cna@vuldb.com cna@vuldb.com cna@vuldb.com
craft_cms — craft_cms	Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.	2024-01-03	5.4	CVE-2024-21622 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
cubefs — cubefs	CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow authenticated users to send maliciously crafted requests that would crash the ObjectNode and deny other users from using it. The root cause was improper handling of incoming HTTP requests that could allow an attacker to control the amount of memory that the ObjectNode would allocate. A malicious request could make the ObjectNode allocate more memory that the machine had available, and the attacker could exhaust memory by way of a single malicious request. An attacker would need to be authenticated in order to invoke the vulnerable code with their malicious request and have permissions to delete objects. In addition, the attacker would need to know the names of existing buckets of the CubeFS deployment – otherwise the request would be rejected before it reached the vulnerable code. As such, the most likely attacker is an inside user or an attacker that has breached the account of an existing user in the cluster. The issue has been patched in v3.3.1. There is no other mitigation besides upgrading.	2024-01-03	6.5	CVE-2023-46738 security-advisories@github.com security-advisories@github.com
cubefs — cubefs	CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS used raw string comparison of passwords. The vulnerable part of CubeFS was the UserService of the master component. The UserService gets instantiated when starting the server of the master component. The issue has been patched in v3.3.1. For impacted users, there is no other way to mitigate the issue besides upgrading.	2024-01-03	6.5	CVE-2023-46739 security-advisories@github.com security-advisories@github.com
cubefs — cubefs	CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates new users, it creates a piece of sensitive information for the user called the “accessKey”. To create the “accesKey”, CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user. An attacker could leverage the predictable random string generator and guess a users access key and impersonate the user to obtain higher privileges. The issue has been fixed in v3.3.1. There is no other mitigation than to upgrade.	2024-01-03	6.5	CVE-2023-46740 security-advisories@github.com security-advisories@github.com
cubefs — cubefs	CubeFS is an open-source cloud-native file storage system. A vulnerability was found in CubeFS prior to version 3.3.1 that could allow users to read sensitive data from the logs which could allow them escalate privileges. CubeFS leaks configuration keys in plaintext format in the logs. These keys could allow anyone to carry out operations on blobs that they otherwise do not have permissions for. For example, an attacker that has successfully retrieved a secret key from the logs can delete blogs from the blob store. The attacker can either be an internal user with limited privileges to read the log, or they can be an external user who has escalated privileges sufficiently to access the logs. The vulnerability has been patched in v3.3.1. There is no other mitigation than upgrading.	2024-01-03	4.8	CVE-2023-46741 security-advisories@github.com security-advisories@github.com
cubefs — cubefs	CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak user’s secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the user’s secret key. This could allow a lower-privileged user with access to the logs to retrieve sensitive information and impersonate other users with higher privileges than themselves. The issue has been patched in v3.3.1. There is no other mitigation than upgrading CubeFS.	2024-01-03	4.8	CVE-2023-46742 security-advisories@github.com security-advisories@github.com
google — android	In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308607; Issue ID: ALPS08308607.	2024-01-02	6.7	CVE-2023-32872 security@mediatek.com
google — android	In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308070; Issue ID: ALPS08308070.	2024-01-02	6.7	CVE-2023-32877 security@mediatek.com
google — android	In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308070; Issue ID: ALPS08308064.	2024-01-02	6.7	CVE-2023-32879 security@mediatek.com
google — android	In battery, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308070; Issue ID: ALPS08308616.	2024-01-02	6.7	CVE-2023-32882 security@mediatek.com
google — android	In Engineer Mode, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08282249; Issue ID: ALPS08282249.	2024-01-02	6.7	CVE-2023-32883 security@mediatek.com
google — android	In netdagent, there is a possible information disclosure due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07944011; Issue ID: ALPS07944011.	2024-01-02	6.7	CVE-2023-32884 security@mediatek.com
google — android	In display drm, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07780685; Issue ID: ALPS07780685.	2024-01-02	6.7	CVE-2023-32885 security@mediatek.com
google — android	In bluetooth service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07933038; Issue ID: MSV-559.	2024-01-02	6.7	CVE-2023-32891 security@mediatek.com
google — android	In keyInstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308607; Issue ID: ALPS08304217.	2024-01-02	4.4	CVE-2023-32875 security@mediatek.com
google — android	In keyInstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308612; Issue ID: ALPS08308612.	2024-01-02	4.4	CVE-2023-32876 security@mediatek.com
google — android	In battery, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308070; Issue ID: ALPS08307992.	2024-01-02	4.4	CVE-2023-32878 security@mediatek.com
google — android	In battery, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308070; Issue ID: ALPS08308076.	2024-01-02	4.4	CVE-2023-32880 security@mediatek.com
google — android	In battery, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308070; Issue ID: ALPS08308080.	2024-01-02	4.4	CVE-2023-32881 security@mediatek.com
hail — hail	Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect (OIDC) email addresses from ID tokens to verify the validity of a user’s domain, but because users have the ability to change their email address, they could create accounts and use resources in clusters that they should not have access to. For example, a user could create a Microsoft or Google account and then change their email to `test@example.org`. This account can then be used to create a Hail Batch account in Hail Batch clusters whose organization domain is `example.org`. The attacker is not able to access private data or impersonate another user, but they would have the ability to run jobs if Hail Batch billing projects are enabled and create Azure Tenants if they have Azure Active Directory Administrator access.	2023-12-29	5.3	CVE-2023-51663 security-advisories@github.com
hcl_software — dryice_myxalytics	HCL DRYiCE MyXalytics is impacted by improper access control (Unauthenticated File Download) vulnerability. An unauthenticated user can download certain files.	2024-01-03	5.4	CVE-2023-50344 psirt@hcl.com
hihonor — fri-an00_firmware	Some Honor products are affected by file writing vulnerability, successful exploitation could cause information disclosure.	2023-12-29	5.5	CVE-2023-23426 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — honorboardapp	Some Honor products are affected by information leak vulnerability; successful exploitation could cause the information leak.	2023-12-29	5.5	CVE-2023-23434 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — lge-an00_firmware	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions	2023-12-29	5.5	CVE-2023-23438 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — lge-an00_firmware	Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.	2023-12-29	5.5	CVE-2023-23439 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — lge-an00_firmware	Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.	2023-12-29	5.5	CVE-2023-23440 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_os	Some Honor products are affected by incorrect privilege assignment vulnerability; successful exploitation could cause information leak.	2023-12-29	5.5	CVE-2023-51429 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_ui	Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.	2023-12-29	5.5	CVE-2023-23441 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_ui	Some Honor products are affected by incorrect privilege assignment vulnerability; successful exploitation could cause information leak.	2023-12-29	5.5	CVE-2023-51430 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_ui	Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.	2023-12-29	5.5	CVE-2023-51432 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_ui	Some Honor products are affected by incorrect privilege assignment vulnerability; successful exploitation could cause information leak.	2023-12-29	5.5	CVE-2023-51433 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — magic_ui	Some Honor products are affected by type confusion vulnerability; successful exploitation could cause denial of service.	2023-12-29	5.5	CVE-2023-6939 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — phoneservice	Some Honor products are affected by incorrect privilege assignment vulnerability; successful exploitation could cause device service exceptions.	2023-12-29	5.5	CVE-2023-51431 3836d913-7555-4dd0-a509-f5667fdf5fe4
hihonor — vmall	Some Honor products are affected by information leak vulnerability; successful exploitation could cause the information leak	2023-12-29	5.5	CVE-2023-23437 3836d913-7555-4dd0-a509-f5667fdf5fe4
hitachi_energy — multiple_products	A vulnerability exists in the Relion update package signature validation. A tampered update package could cause the IED to restart. After restart the device is back to normal operation. An attacker could exploit the vulnerability by first gaining access to the system with security privileges and attempt to update the IED with a malicious update package. Successful exploitation of this vulnerability will cause the IED to restart, causing a temporary Denial of Service.	2024-01-04	4.5	CVE-2022-3864 cybersecurity@hitachienergy.com
hospital_management_system — hospital_management_system	A vulnerability, which was classified as problematic, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file registration.php. The manipulation of the argument First Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249357 was assigned to this vulnerability.	2023-12-30	4.3	CVE-2023-7173 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
icewarp — icewarp	A vulnerability classified as problematic has been found in IceWarp 12.0.2.1/12.0.3.1. This affects an unknown part of the file /install/ of the component Utility Download Handler. The manipulation of the argument lang with the input 1%27″()%26%25 leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249759. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2024-01-05	4.3	CVE-2024-0246 cna@vuldb.com cna@vuldb.com
ipaddress — ipaddress	An issue in the component IPAddressBitsDivision of IPAddress v5.1.0 leads to an infinite loop.	2023-12-29	5.5	CVE-2023-50570 cve@mitre.org
jline — jline	An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM (OutofMemory) error.	2023-12-29	5.5	CVE-2023-50572 cve@mitre.org
kernelsu — kernelsu	KernelSU is a Kernel-based root solution for Android devices. In versions 0.7.1 and prior, the logic of get apk path in KernelSU kernel module can be bypassed, which causes any malicious apk named `me.weishu.kernelsu` get root permission. If a KernelSU module installed device try to install any not checked apk which package name equal to the official KernelSU Manager, it can take over root privileges on the device. As of time of publication, a patched version is not available.	2024-01-02	6.7	CVE-2023-49794 security-advisories@github.com security-advisories@github.com
kruise — kruise	Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, the attacker can leverage the “captured” secrets (e.g. the kruise-manager service account token) to gain extra privileges such as pod modification. Versions 1.3.1, 1.4.1, and 1.5.2 fix this issue. A workaround is available. For users that do not require imagepulljob functions, they can modify kruise-daemon-role to drop the cluster level secret get/list privilege.	2024-01-03	6.5	CVE-2023-30617 security-advisories@github.com
lenovo — lenovo_browser_mobile	A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a payload that could result in the disclosure of sensitive information.	2024-01-03	6.5	CVE-2023-6540 psirt@lenovo.com
libredwg — libredwg	Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in decode_r2007.c.	2024-01-02	5.5	CVE-2023-26157 report@snyk.io report@snyk.io report@snyk.io
linux — kernel	A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.	2024-01-02	6.1	CVE-2023-7192 secalert@redhat.com secalert@redhat.com secalert@redhat.com
logobee — logobee	LogoBee 0.2 allows updates.php?id= XSS.	2023-12-30	6.1	CVE-2023-52257 cve@mitre.org
magic-api — magic-api	A vulnerability has been found in Magic-Api up to 2.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /resource/file/api/save?auto=1. The manipulation leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249511.	2024-01-02	6.3	CVE-2024-0196 cna@vuldb.com cna@vuldb.com cna@vuldb.com
mattermost — mattermost	Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.	2023-12-29	6.1	CVE-2023-7113 responsibledisclosure@mattermost.com
mattermost — mattermost	Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams//channels/deleted endpoint.	2024-01-02	4.3	CVE-2023-47858 responsibledisclosure@mattermost.com
mattermost — mattermost	Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.	2024-01-02	4.3	CVE-2023-48732 responsibledisclosure@mattermost.com
mdaemon — securitygateway	MDaemon SecurityGateway through 9.0.3 allows XSS via a crafted Message Content Filtering rule. This might allow domain administrators to conduct attacks against global administrators.	2023-12-31	4.8	CVE-2023-52269 cve@mitre.org cve@mitre.org
mediatek — software_development_kit	In wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure with no execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00325055; Issue ID: MSV-868.	2024-01-02	5.5	CVE-2023-32831 security@mediatek.com
moxa– oncell_g3150a-lte_series	A clickjacking vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. This vulnerability is caused by incorrectly restricts frame objects, which can lead to user confusion about which interface the user is interacting with. This vulnerability may lead the attacker to trick the user into interacting with the application.	2023-12-31	5.3	CVE-2023-6093 psirt@moxa.com
moxa– oncell_g3150a-lte_series	A vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. The vulnerability results from lack of protection for sensitive information during transmission. An attacker eavesdropping on the traffic between the web browser and server may obtain sensitive information. This type of attack could be executed to gather sensitive information or to facilitate a subsequent attack against the target.	2023-12-31	5.3	CVE-2023-6094 psirt@moxa.com
novel-plus — novel-plus	A vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0. This affects an unknown part of the file /user/updateUserInfo of the component HTTP POST Request Handler. The manipulation of the argument nickName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c62da9bb3a9b3603014d0edb436146512631100d. It is recommended to apply a patch to fix this issue. The identifier VDB-249201 was assigned to this vulnerability.	2023-12-29	5.4	CVE-2023-7166 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
novel-plus — novel-plus	A vulnerability was found in Novel-Plus up to 4.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file novel-admin/src/main/java/com/java2nb/novel/controller/FriendLinkController.java of the component Friendly Link Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named d6093d8182362422370d7eaf6c53afde9ee45215. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-249307.	2023-12-29	4.8	CVE-2023-7171 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
nueva_ecija_engineer_online_portal — nueva_ecija_engineer_online_portal	A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file downloadable.php of the component Add Downloadable. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249505 was assigned to this vulnerability.	2024-01-02	6.3	CVE-2024-0192 cna@vuldb.com cna@vuldb.com cna@vuldb.com
nueva_ecija_engineer_online_portal — nueva_ecija_engineer_online_portal	A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/uploads/. The manipulation leads to file and directory information exposure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249504.	2024-01-02	5.3	CVE-2024-0191 cna@vuldb.com cna@vuldb.com cna@vuldb.com
nueva_ecija_engineer_online_portal — nueva_ecija_engineer_online_portal	A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file dasboard_teacher.php of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249443.	2024-01-02	4.7	CVE-2024-0185 cna@vuldb.com cna@vuldb.com cna@vuldb.com
ocsinventory — ocsinventory	OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.	2024-01-04	4.9	CVE-2023-3726 help@fluidattacks.com help@fluidattacks.com
openharmony — openharmony	in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through occupy all resources	2024-01-02	5.5	CVE-2023-47216 scy@openharmony.io
openharmony — openharmony	in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia camera crash through modify a released pointer.	2024-01-02	5.5	CVE-2023-47857 scy@openharmony.io
openharmony — openharmony	in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia player crash through modify a released pointer.	2024-01-02	5.5	CVE-2023-48360 scy@openharmony.io
openharmony — openharmony	in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia player crash through modify a released pointer.	2024-01-02	5.5	CVE-2023-49135 scy@openharmony.io
openxiangshan — xiangshan	An issue was discovered in XiangShan v2.1, allows local attackers to obtain sensitive information via the L1D cache.	2023-12-30	5.5	CVE-2023-50559 cve@mitre.org cve@mitre.org
own_health_record — own_health_record	A vulnerability was found in MdAlAmin-aol Own Health Record 0.1-alpha/0.2-alpha/0.3-alpha/0.3.1-alpha. It has been rated as problematic. This issue affects some unknown processing of the file includes/logout.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 0.4-alpha is able to address this issue. The patch is named 58b413aa40820b49070782c786c526850ab7748f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249191.	2023-12-30	4.3	CVE-2018-25096 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
pandora_fms — pandora_fms	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Allows you to edit the Web Console user notification options. This issue affects Pandora FMS: from 700 through 774.	2023-12-29	6.1	CVE-2023-41813 security@pandorafms.com
pandora_fms — pandora_fms	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Through an HTML payload (iframe tag) it is possible to carry out XSS attacks when the user receiving the messages opens their notifications. This issue affects Pandora FMS: from 700 through 774.	2023-12-29	6.1	CVE-2023-41814 security@pandorafms.com
pandora_fms — pandora_fms	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Malicious code could be executed in the File Manager section. This issue affects Pandora FMS: from 700 through 774.	2023-12-29	6.1	CVE-2023-41815 security@pandorafms.com
pandora_fms — pandora_fms	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). It was possible to execute malicious JS code on Visual Consoles. This issue affects Pandora FMS: from 700 through 774.	2023-12-29	6.1	CVE-2023-44089 security@pandorafms.com
poly — multiple_products	A vulnerability, which was classified as problematic, was found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. Affected is an unknown function of the component Configuration File Import. The manipulation of the argument device.auth.localAdminPassword leads to unverified password change. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249258 is the identifier assigned to this vulnerability.	2023-12-29	6.5	CVE-2023-4465 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
poly — multiple_products	A vulnerability classified as problematic has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This affects an unknown part of the component Web Configuration Application. The manipulation leads to insufficiently random values. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249255.	2023-12-29	5.9	CVE-2023-4462 cna@vuldb.com cna@vuldb.com nvd@nist.gov cna@vuldb.com cna@vuldb.com
poly — multiple_products	A vulnerability has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation leads to protection mechanism failure. The attack can be launched remotely. The vendor explains that they do not regard this as a vulnerability as this is a feature that they offer to their customers who have a variety of environmental needs that are met through different firmware builds. To avoid potential roll-back attacks, they remove vulnerable builds from the public servers as a remediation effort. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249259.	2023-12-29	4.9	CVE-2023-4466 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
poly — trio_8800_firmware	A vulnerability was found in Poly Trio 8800 7.2.6.0019 and classified as critical. Affected by this issue is some unknown functionality of the component Test Automation Mode. The manipulation leads to backdoor. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249260.	2023-12-29	6.6	CVE-2023-4467 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
prestashop — prestashop	PrestaShop is an open-source e-commerce platform. Prior to version 8.1.3, the isCleanHtml method is not used on this this form, which makes it possible to store a cross-site scripting payload in the database. The impact is low because the HTML is not interpreted in BO, thanks to twig’s escape mechanism. In FO, the cross-site scripting attack is effective, but only impacts the customer sending it, or the customer session from which it was sent. This issue affects those who have a module fetching these messages from the DB and displaying it without escaping HTML. Version 8.1.3 contains a patch for this issue.	2024-01-02	5.4	CVE-2024-21628 security-advisories@github.com security-advisories@github.com
qemu — qemu	A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory and send it to the wire, causing an information leak.	2024-01-02	4.9	CVE-2023-6693 secalert@redhat.com secalert@redhat.com
qnap_systems_inc. — qcalagent	An OS command injection vulnerability has been reported to affect QcalAgent. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: QcalAgent 1.1.8 and later	2024-01-05	6.3	CVE-2023-41289 security@qnapsecurity.com.tw
qnap_systems_inc. — qts/quts_hero	An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later	2024-01-05	6.6	CVE-2023-39294 security@qnapsecurity.com.tw
qnap_systems_inc. — qumagie	A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: QuMagie 2.2.1 and later	2024-01-05	5.5	CVE-2023-47559 security@qnapsecurity.com.tw
qnap_systems_inc. — video_station	A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 ( 2023/11/23 ) and later	2024-01-05	4.3	CVE-2023-41287 security@qnapsecurity.com.tw
qualcomm,_inc. — snapdragon	Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.	2024-01-02	6.7	CVE-2023-28583 product-security@qualcomm.com
qualcomm,_inc. — snapdragon	Memory corruption while receiving a message in Bus Socket Transport Server.	2024-01-02	6.7	CVE-2023-33038 product-security@qualcomm.com
rust-ethereum — rust-ethereum	Rust EVM is an Ethereum Virtual Machine interpreter. In `rust-evm`, a feature called `record_external_operation` was introduced, allowing library users to record custom gas changes. This feature can have some bogus interactions with the call stack. In particular, during finalization of a `CREATE` or `CREATE2`, in the case that the substack execution happens successfully, `rust-evm` will first commit the substate, and then call `record_external_operation(Write(out_code.len()))`. If `record_external_operation` later fails, this error is returned to the parent call stack, instead of `Succeeded`. Yet, the substate commitment already happened. This causes smart contracts able to commit state changes, when the parent caller contract receives zero address (which usually indicates that the execution has failed). This issue only impacts library users with custom `record_external_operation` that returns errors. The issue is patched in release 0.41.1. No known workarounds are available.	2024-01-02	5.9	CVE-2024-21629 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
rust-vmm — rust-vmm	vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the `FamStructWrapper::deserialize` implementation provided by the crate for `vmm_sys_util::fam::FamStructWrapper` can lead to out of bounds memory accesses. The deserialization does not check that the length stored in the header matches the flexible array length. Mismatch in the lengths might allow out of bounds memory access through Rust-safe methods. The issue was corrected in version 0.12.0 by inserting a check that verifies the lengths of compared flexible arrays are equal for any deserialized header and aborting deserialization otherwise. Moreover, the API was changed so that header length can only be modified through Rust-unsafe code. This ensures that users cannot trigger out-of-bounds memory access from Rust-safe code.	2024-01-02	5.7	CVE-2023-50711 security-advisories@github.com security-advisories@github.com
samsung_mobile — nearby_device_scanning	Improper access control vulnerability in Nearby device scanning prior version 11.1.14.7 allows local attacker to access data.	2024-01-04	4	CVE-2024-20808 mobile.security@samsung.com
samsung_mobile — nearby_device_scanning	Improper access control vulnerability in Nearby device scanning prior version 11.1.14.7 allows local attacker to access data.	2024-01-04	4	CVE-2024-20809 mobile.security@samsung.com
samsung_mobile — samsung_mobile_devices	Improper authentication vulnerability in Bluetooth pairing process prior to SMR Jan-2024 Release 1 allows remote attackers to establish pairing process without user interaction.	2024-01-04	6.8	CVE-2024-20803 mobile.security@samsung.com
samsung_mobile — samsung_mobile_devices	Improper access control in Notification service prior to SMR Jan-2024 Release 1 allows local attacker to access notification data.	2024-01-04	6.2	CVE-2024-20806 mobile.security@samsung.com
samsung_mobile — samsung_mobile_devices	Improper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows owner to access other users’ notification in a multi-user environment.	2024-01-04	4.6	CVE-2024-20802 mobile.security@samsung.com
samsung_mobile — samsung_mobile_devices	Path traversal vulnerability in FileUriConverter of MyFiles prior to SMR Jan-2024 Release 1 in Android 11 and Android 12, and version 14.5.00.21 in Android 13 allows attackers to write arbitrary file.	2024-01-04	4	CVE-2024-20804 mobile.security@samsung.com
sesami — cash_point_&_transport_optimizer	An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows local attackers to obtain sensitive information and bypass authentication via “Back Button Refresh” attack.	2023-12-29	5.5	CVE-2023-31292 cve@mitre.org
sesami — cash_point_&_transport_optimizer	CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows attackers to obtain sensitive information via the User Name field.	2023-12-29	5.3	CVE-2023-31296 cve@mitre.org
sesami — cash_point_&_transport_optimizer	Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code and obtain sensitive information via the User ID field when creating a new system user.	2023-12-29	4.8	CVE-2023-31298 cve@mitre.org
sesami — cash_point_&_transport_optimizer	Stored Cross Site Scripting (XSS) Vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code and obtain sensitive information via the Username field of the login form and application log.	2023-12-29	6.1	CVE-2023-31301 cve@mitre.org
silicon_labs — gecko_sdk	Glitch detection is not enabled by default for the CortexM33 core in Silicon Labs secure vault high parts EFx32xG2xB, except EFR32xG21B.	2024-01-03	6.8	CVE-2023-5138 product-security@silabs.com product-security@silabs.com
sourcecodester — engineers_online_portal	A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Add Engineer Handler. The manipulation of the argument first name/last name with the input leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249182 is the identifier assigned to this vulnerability.	2023-12-29	6.1	CVE-2023-7160 cna@vuldb.com cna@vuldb.com
spider-flow — spider-flow	A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249510 is the identifier assigned to this vulnerability.	2024-01-02	6.3	CVE-2024-0195 cna@vuldb.com cna@vuldb.com cna@vuldb.com
thirtybees — bees_blog	The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing_url is mishandled.	2023-12-30	6.1	CVE-2023-52264 cve@mitre.org cve@mitre.org cve@mitre.org
tongda — office_anywhere_2017	A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file general/project/proj/delete.php. The manipulation of the argument PROJ_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249367. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-30	4.3	CVE-2023-7180 cna@vuldb.com cna@vuldb.com cna@vuldb.com
vapor — vapor	Vapor is an HTTP web framework for Swift. Prior to version 4.90.0, Vapor’s `vapor_urlparser_parse` function uses `uint16_t` indexes when parsing a URI’s components, which may cause integer overflows when parsing untrusted inputs. This vulnerability does not affect Vapor directly but could impact applications relying on the URI type for validating user input. The URI type is used in several places in Vapor. A developer may decide to use URI to represent a URL in their application (especially if that URL is then passed to the HTTP Client) and rely on its public properties and methods. However, URI may fail to properly parse a valid (albeit abnormally long) URL, due to string ranges being converted to 16-bit integers. An attacker may use this behavior to trick the application into accepting a URL to an untrusted destination. By padding the port number with zeros, an attacker can cause an integer overflow to occur when the URL authority is parsed and, as a result, spoof the host. Version 4.90.0 contains a patch for this issue. As a workaround, validate user input before parsing as a URI or, if possible, use Foundation’s `URL` and `URLComponents` utilities.	2024-01-03	6.5	CVE-2024-21631 security-advisories@github.com security-advisories@github.com
view_component — view_component	view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a `#call` method (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content. In addition, the return value of the `#output_postamble` methodis not sanitized, which can also lead to cross-site scripting issues. Versions 3.9.0 has been released and fully mitigates both the `#call` and the `#output_postamble` vulnerabilities. As a workaround, sanitize the return value of `#call`.	2024-01-04	6.1	CVE-2024-21636 security-advisories@github.com security-advisories@github.com security-advisories@github.com
winter_cms — winter_cms	Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.	2023-12-29	5.4	CVE-2023-52085 security-advisories@github.com security-advisories@github.com
wiremock — wiremock	WireMock with GUI versions 3.2.0.0 through 3.0.4.0 are vulnerable to stored cross-site scripting (SXSS) through the recording feature. An attacker can host a malicious payload and perform a test mapping pointing to the attacker’s file, and the result will render on the Matched page in the Body area, resulting in the execution of the payload. This occurs because the response body is not validated or sanitized.	2023-12-29	6.1	CVE-2023-50069 cve@mitre.org
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms. Thís issue affects Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms through 1.2.8.	2023-12-29	6.1	CVE-2023-31095 audit@patchstack.com
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in WP Directory Kit. This issue affects WP Directory Kit through 1.1.9.	2023-12-29	6.1	CVE-2023-31229 audit@patchstack.com
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in Dylan James Zephyr Project Manager. This issue affects Zephyr Project Manager through 3.3.9.	2023-12-29	6.1	CVE-2023-31237 audit@patchstack.com
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in Pexle Chris Library Viewer. This issue affects Library Viewer through 2.0.6.	2023-12-29	6.1	CVE-2023-32101 audit@patchstack.com
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in PluginOps MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder. This issue affects MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder through 4.0.9.3.	2023-12-29	6.1	CVE-2023-32517 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in CodexThemes TheGem – Creative Multi-Purpose & WooCommerce WordPress Theme allows Reflected XSS. This issue affects TheGem – Creative Multi-Purpose & WooCommerce WordPress Theme through 5.9.1.	2023-12-29	6.1	CVE-2023-50892 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in UpSolution Impreza – WordPress Website and WooCommerce Builder allows Reflected XSS. This issue affects Impreza – WordPress Website and WooCommerce Builder through 8.17.4.	2023-12-29	6.1	CVE-2023-50893 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in HasThemes HT Mega – Absolute Addons For Elementor allows Reflected XSS. This issue affects HT Mega – Absolute Addons For Elementor through 2.3.8.	2023-12-29	6.1	CVE-2023-50901 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Ian Kennerley Google Photos Gallery with Shortcodes allows Reflected XSS. This issue affects Google Photos Gallery with Shortcodes through 4.0.2.	2023-12-29	6.1	CVE-2023-51373 audit@patchstack.com
wordpress — wordpress	Server-Side Request Forgery (SSRF) vulnerability in Leevio Happy Addons for Elementor. This issue affects Happy Addons for Elementor through 3.9.1.1.	2023-12-29	6.5	CVE-2023-51676 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in ShapedPlugin LLC WP Tabs – Responsive Tabs Plugin for WordPress allows Stored XSS. This issue affects WP Tabs – Responsive Tabs Plugin for WordPressthrough 2.2.0.	2024-01-05	6.5	CVE-2023-52124 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in webvitaly iframe allows Stored XSS. This issue affects iframe through 4.8.	2024-01-05	6.5	CVE-2023-52125 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress. This issue affects teachPress through 9.0.4.	2024-01-05	6.3	CVE-2023-52129 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in MojofyWP WP Affiliate Disclosure allows Stored XSS. This issue affects WP Affiliate Disclosure through 1.2.7.	2024-01-05	6.5	CVE-2023-52178 audit@patchstack.com
wordpress — wordpress	The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the map title parameter in all versions up to and including 2.88.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-03	6.4	CVE-2023-6524 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘msg’ parameter in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	2024-01-03	6.1	CVE-2023-6629 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmem_field shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including user emails, password hashes, usernames, and more.	2024-01-04	6.5	CVE-2023-6733 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for contributors and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-03	6.4	CVE-2023-6747 security@wordfence.com security@wordfence.com
wordpress — wordpress	The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-06	6.4	CVE-2023-6801 security@wordfence.com security@wordfence.com
wordpress — wordpress	The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to SQL Injection via the ‘group_id’ parameter in all versions up to, and including, 6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be leveraged to achieve Reflected Cross-site Scripting.	2024-01-03	6.1	CVE-2023-6981 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s embed_oembed_html shortcode in all versions up to 3.9.5 (exclusive) due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-03	6.4	CVE-2023-6986 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom ID in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access and higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2024-01-04	6.4	CVE-2023-7044 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Automattic WordPress.Com Editing Toolkit allows Stored XSS. This issue affects WordPress.Com Editing Toolkit through 3.78784.	2023-12-29	5.4	CVE-2023-50879 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in The BuddyPress Community BuddyPress allows Stored XSS. This issue affects BuddyPress through 11.3.1.	2023-12-29	5.4	CVE-2023-50880 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS. This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More through 6.9.15.	2023-12-29	5.4	CVE-2023-50881 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in The Beaver Builder Team Beaver Builder – WordPress Page Builder allows Stored XSS. This issue affects Beaver Builder – WordPress Page Builder through 2.7.2.	2023-12-29	5.4	CVE-2023-50889 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Zoho Forms Form plugin for WordPress – Zoho Forms allows Stored XSS. This issue affects Form plugin for WordPress – Zoho Forms through 3.0.1.	2023-12-29	5.4	CVE-2023-50891 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Brizy.Io Brizy – Page Builder allows Stored XSS. This issue affects Brizy – Page Builder through 2.4.29.	2023-12-29	5.4	CVE-2023-51396 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Brainstorm Force WP Remote Site Search allows Stored XSS. This issue affects WP Remote Site Search through 1.0.4.	2023-12-29	5.4	CVE-2023-51397 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in WPFactory Back Button Widget allows Stored XSS. This issue affects Back Button Widget through 1.6.3.	2023-12-29	5.4	CVE-2023-51399 audit@patchstack.com
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in CodePeople Calculated Fields Form. This issue affects Calculated Fields Form through 1.2.28.	2023-12-29	5.4	CVE-2023-51517 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Aleksandar Uroševi? Stock Ticker allows Stored XSS. This issue affects Stock Ticker through 3.23.4.	2023-12-29	5.4	CVE-2023-51541 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Designful Stylish Price List – Price Table Builder & QR Code Restaurant Menu. This issue affects Stylish Price List – Price Table Builder & QR Code Restaurant Menu through 7.0.17.	2024-01-05	5.4	CVE-2023-51673 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more. This issue affects NEX-Forms – Ultimate Form Builder – Contact forms and much more through 8.5.2.	2024-01-05	5.4	CVE-2023-52120 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in NitroPack Inc. NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images. This issue affects NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images through 1.10.2.	2024-01-05	5.4	CVE-2023-52121 audit@patchstack.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Suman Bhattarai Send Users Email. This issue affects Send Users Email through 1.4.3.	2024-01-05	5.3	CVE-2023-52126 audit@patchstack.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aaron J 404 Solution. This issue affects 404 Solution through 2.33.0.	2024-01-05	5.3	CVE-2023-52146 audit@patchstack.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager. This issue affects Affiliates Manager through 2.9.30.	2024-01-05	5.3	CVE-2023-52148 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Floating Button. This issue affects Floating Button through 6.0.	2024-01-05	5.4	CVE-2023-52149 audit@patchstack.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Uncanny Automator, Uncanny Owl Uncanny Automator – Automate everything with the #1 no-code automation and integration plugin. This issue affects Uncanny Automator – Automate everything with the #1 no-code automation and integration plugin through 5.1.0.2.	2024-01-05	5.3	CVE-2023-52151 audit@patchstack.com
wordpress — wordpress	The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pagelayer_header_code’, ‘pagelayer_body_open_code’, and ‘pagelayer_footer_code’ meta fields in all versions up to, and including, 1.7.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This appears to be a reintroduction of a vulnerability patched in version 1.7.7.	2024-01-04	5.4	CVE-2023-6738 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check when updating settings in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with author-level access or above to change the plugin’s settings including proxy settings, which are also exposed to authors.	2024-01-06	5.4	CVE-2023-6798 security@wordfence.com security@wordfence.com
wordpress — wordpress	The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.13. This is due to missing or incorrect nonce validation in the powerpack-lite-for-elementor/classes/class-pp-admin-settings.php file. This makes it possible for unauthenticated attackers to modify and reset plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2024-01-03	5.3	CVE-2023-6984 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘save_settings’ function in versions up to, and including, 2.5. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings.	2024-01-03	5.4	CVE-2024-0201 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in weForms weForms – Easy Drag & Drop Contact Form Builder For WordPress allows Stored XSS. This issue affects weForms – Easy Drag & Drop Contact Form Builder For WordPress through 1.6.17.	2023-12-29	4.8	CVE-2023-50896 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Ginger Plugins Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button allows Stored XSS. This issue affects Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button through 1.1.8.	2023-12-29	4.8	CVE-2023-51361 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Bit Assist Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget allows Stored XSS. This issue affects Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget through 1.1.9.	2023-12-29	4.8	CVE-2023-51371 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in HasThemes HashBar – WordPress Notification Bar allows Stored XSS. This issue affects HashBar – WordPress Notification Bar through 1.4.1.	2023-12-29	4.8	CVE-2023-51372 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in ZeroBounce ZeroBounce Email Verification & Validation allows Stored XSS. This issue affects ZeroBounce Email Verification & Validation through 1.0.11.	2023-12-29	4.8	CVE-2023-51374 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in CleanTalk – Anti-Spam Protection Spam protection, Anti-Spam, FireWall by CleanTalk. This issue affects Spam protection, Anti-Spam, FireWall by CleanTalk through 6.20.	2024-01-05	4.3	CVE-2023-51535 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin. This issue affects Awesome Support – WordPress HelpDesk & Support Plugin through 6.1.5.	2024-01-05	4.3	CVE-2023-51538 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Apollo13Themes Apollo13 Framework Extensions. This issue affects Apollo13 Framework Extensions through 1.9.1.	2024-01-05	4.3	CVE-2023-51539 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in WP Zone Inline Image Upload for BBPress. This issue affects Inline Image Upload for BBPress through 1.1.18.	2024-01-05	4.3	CVE-2023-51668 audit@patchstack.com
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More. This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More through 6.9.18.	2023-12-29	4.7	CVE-2023-51675 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Doofinder Doofinder WP & WooCommerce Search. This issue affects Doofinder WP & WooCommerce Search through 2.0.33.	2024-01-05	4.3	CVE-2023-51678 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building. This issue affects Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building through 3.1.18.	2024-01-05	4.3	CVE-2023-52119 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board. This issue affects Simple Job Board through 2.10.6.	2024-01-05	4.3	CVE-2023-52122 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in WPChill Strong Testimonials. This issue affects Strong Testimonials through 3.1.10.	2024-01-05	4.3	CVE-2023-52123 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Product Bundles for WooCommerce. This issue affects WPC Product Bundles for WooCommerce through 7.3.1.	2024-01-05	4.3	CVE-2023-52127 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard. This issue affects White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard through 2.9.0.	2024-01-05	4.3	CVE-2023-52128 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager. This issue affects Affiliates Manager through 2.9.31.	2024-01-05	4.3	CVE-2023-52130 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget. This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget through 2.1.2.	2024-01-05	4.3	CVE-2023-52136 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Republish Old Posts. This issue affects Republish Old Posts through 1.21.	2024-01-05	4.3	CVE-2023-52145 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in WP Job Portal WP Job Portal – A Complete Job Board. This issue affects WP Job Portal – A Complete Job Board through 2.0.6.	2024-01-05	4.3	CVE-2023-52184 audit@patchstack.com
wordpress — wordpress	The Depicter Slider – Responsive Image Slider, Video Slider & Post Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the ‘save’ function. This makes it possible for unauthenticated attackers to modify the plugin’s settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2023-51491 appears to be a duplicate of this issue.	2024-01-05	4.3	CVE-2023-6493 security@wordfence.com security@wordfence.com
wordpress — wordpress	The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 6.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	2024-01-04	4.4	CVE-2023-6498 security@wordfence.com security@wordfence.com
wordpress — wordpress	The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5. This is due to missing or incorrect nonce validation on the ‘delete’ action of the wp-sms-subscribers page. This makes it possible for unauthenticated attackers to delete subscribers via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	2024-01-03	4.3	CVE-2023-6980 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on theprint_packinglist action in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to export orders which can contain sensitive information.	2024-01-03	4.3	CVE-2023-7068 security@wordfence.com security@wordfence.com
zte — red_magic_8_pro	Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro	2024-01-04	6.6	CVE-2023-41784 psirt@zte.com.cn
zte — zxcloud_irai	There is a local privilege escalation vulnerability of ZTE’s ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate local privileges.	2024-01-03	6.7	CVE-2023-41776 psirt@zte.com.cn
zte — zxcloud_irai	There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the program failed to adequately validate the user’s input, an attacker could exploit this vulnerability to escalate local privileges.	2024-01-03	6.4	CVE-2023-41780 psirt@zte.com.cn
zte — zxcloud_irai	There is an illegal memory access vulnerability of ZTE’s ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permission, the physical machine will be crashed.	2024-01-03	4.4	CVE-2023-41779 psirt@zte.com.cn
zte — zxcloud_irai	There is a command injection vulnerability of ZTE’s ZXCLOUD iRAI. Due to the program failed to adequately validate the user’s input, an attacker could exploit this vulnerability to escalate local privileges.	2024-01-03	4.3	CVE-2023-41783 psirt@zte.com.cn

Low Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
acumos — design_studio	A vulnerability, which was classified as problematic, was found in Acumos Design Studio up to 2.0.7. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.8 is able to address this issue. The name of the patch is 0df8a5e8722188744973168648e4c74c69ce67fd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249420.	2024-01-02	3.5	CVE-2018-25097 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
collective_idea, inc. — audited	A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.	2024-01-04	3.1	CVE-2024-22047 disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com
hcl_software — dryice_myxalytics	HCL DRYiCE MyXalytics is impacted by an Open Redirect vulnerability which could allow an attacker to redirect users to malicious sites, potentially leading to phishing attacks or other security threats.	2024-01-03	3.7	CVE-2023-50345 psirt@hcl.com
hcl_software — dryice_myxalytics	HCL DRYiCE MyXalytics is impacted by an information disclosure vulnerability. Certain endpoints within the application disclose detailed file information.	2024-01-03	3.1	CVE-2023-50346 psirt@hcl.com
hcl_software — dryice_myxalytics	HCL DRYiCE MyXalytics is impacted by an improper error handling vulnerability. The application returns detailed error messages that can provide an attacker with insight into the application, system, etc.	2024-01-03	3.1	CVE-2023-50348 psirt@hcl.com
huiran — host_reseller_system	A vulnerability classified as problematic has been found in HuiRan Host Reseller System up to 2.0.0. Affected is an unknown function of the file /user/index/findpass?do=4 of the component HTTP POST Request Handler. The manipulation leads to weak password recovery. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249444.	2024-01-02	3.7	CVE-2024-0186 cna@vuldb.com cna@vuldb.com cna@vuldb.com
libssh — libssh	A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.	2024-01-03	3.9	CVE-2023-6004 secalert@redhat.com secalert@redhat.com secalert@redhat.com
mattermost — mattermost	Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names.	2024-01-02	3.7	CVE-2023-50333 responsibledisclosure@mattermost.com
nueva_ecija_engineer_online_portal — nueva_ecija_engineer_online_portal	A vulnerability, which was classified as problematic, was found in RRJ Nueva Ecija Engineer Online Portal 1.0. This affects an unknown part of the file change_password_teacher.php. The manipulation leads to weak password requirements. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-249501 was assigned to this vulnerability.	2024-01-02	3.1	CVE-2024-0188 cna@vuldb.com cna@vuldb.com cna@vuldb.com
nueva_ecija_engineer_online_portal — nueva_ecija_engineer_online_portal	A vulnerability has been found in RRJ Nueva Ecija Engineer Online Portal 1.0 and classified as problematic. This vulnerability affects unknown code of the file teacher_message.php of the component Create Message Handler. The manipulation of the argument Content with the input leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249502 is the identifier assigned to this vulnerability.	2024-01-02	3.5	CVE-2024-0189 cna@vuldb.com cna@vuldb.com cna@vuldb.com
nueva_ecija_engineer_online_portal — nueva_ecija_engineer_online_portal	A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file add_quiz.php of the component Quiz Handler. The manipulation of the argument Quiz Title/Quiz Description with the input leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249503.	2024-01-02	3.5	CVE-2024-0190 cna@vuldb.com cna@vuldb.com cna@vuldb.com
nueva_ecija_engineer_online_portal — nueva_ecija_engineer_online_portal	A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/admin_user.php of the component Admin Panel. The manipulation of the argument Firstname/Lastname/Username leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249433 was assigned to this vulnerability.	2024-01-01	2.4	CVE-2024-0181 cna@vuldb.com cna@vuldb.com cna@vuldb.com
nueva_ecija_engineer_online_portal — nueva_ecija_engineer_online_portal	A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/students.php of the component NIA Office. The manipulation leads to basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249441 was assigned to this vulnerability.	2024-01-01	2.4	CVE-2024-0183 cna@vuldb.com cna@vuldb.com cna@vuldb.com
nueva_ecija_engineer_online_portal — nueva_ecija_engineer_online_portal	A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/edit_teacher.php of the component Add Enginer. The manipulation of the argument Firstname/Lastname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249442 is the identifier assigned to this vulnerability.	2024-01-02	2.4	CVE-2024-0184 cna@vuldb.com cna@vuldb.com cna@vuldb.com
openharmony — openharmony	in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia audio crash through modify a released pointer.	2024-01-02	3.3	CVE-2023-49142 scy@openharmony.io
packagekit — packagekit	A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.	2024-01-03	3.3	CVE-2024-0217 secalert@redhat.com secalert@redhat.com
qnap_systems_inc. — qts/quts_hero	A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later	2024-01-05	3.8	CVE-2023-45039 security@qnapsecurity.com.tw
qnap_systems_inc. — qts/quts_hero	A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later	2024-01-05	3.8	CVE-2023-45040 security@qnapsecurity.com.tw
qnap_systems_inc. — qts/quts_hero	A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later	2024-01-05	3.8	CVE-2023-45041 security@qnapsecurity.com.tw
qnap_systems_inc. — qts/quts_hero	A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later	2024-01-05	3.8	CVE-2023-45042 security@qnapsecurity.com.tw
qnap_systems_inc. — qts/quts_hero	A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later	2024-01-05	3.8	CVE-2023-45043 security@qnapsecurity.com.tw
qnap_systems_inc. — qts/quts_hero	A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later	2024-01-05	3.8	CVE-2023-45044 security@qnapsecurity.com.tw
qnap_systems_inc. — qumagie	A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: QuMagie 2.2.1 and later	2024-01-05	3.5	CVE-2023-47219 security@qnapsecurity.com.tw
samsung_mobile — samsung_email	Implicit intent hijacking vulnerability in Samsung Email prior to version 6.1.90.16 allows attacker to get sensitive information.	2024-01-04	3.3	CVE-2024-20807 mobile.security@samsung.com
samsung_mobile — samsung_mobile_devices	Path traversal vulnerability in ZipCompressor of MyFiles prior to SMR Jan-2024 Release 1 in Android 11 and Android 12, and version 14.5.00.21 in Android 13 allows attackers to write arbitrary file.	2024-01-04	3.3	CVE-2024-20805 mobile.security@samsung.com
wordpress — wordpress	A vulnerability was found in rt-prettyphoto Plugin up to 1.2 on WordPress and classified as problematic. Affected by this issue is the function royal_prettyphoto_plugin_links of the file rt-prettyphoto.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3 is able to address this issue. The patch is identified as 0d3d38cfa487481b66869e4212df1cefc281ecb7. It is recommended to upgrade the affected component. VDB-249422 is the identifier assigned to this vulnerability.	2024-01-02	3.5	CVE-2015-10128 cna@vuldb.com cna@vuldb.com cna@vuldb.com
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection. This issue affects Solid Security – Password, Two Factor Authentication, and Brute Force Protection through 8.1.4.	2023-12-29	3.7	CVE-2023-28786 audit@patchstack.com
zimbra — zm-ajax	A vulnerability has been found in Zimbra zm-ajax up to 8.8.1 and classified as problematic. Affected by this vulnerability is the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js. The manipulation of the argument message leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 8.8.2 is able to address this issue. The identifier of the patch is 8d039d6efe80780adc40c6f670c06d21de272105. It is recommended to upgrade the affected component. The identifier VDB-249421 was assigned to this vulnerability.	2024-01-02	2.6	CVE-2017-20188 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
zte — zxcloud_irai	There is a DLL hijacking vulnerability in ZTE ZXCLOUD iRAI, an attacker could place a fake DLL file in a specific directory and successfully exploit this vulnerability to execute malicious code.	2024-01-05	3.9	CVE-2023-41782 psirt@zte.com.cn

Severity Not Yet Assigned

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
abo.cms — abo.cms	SQL Injection vulnerability in ABO.CMS v.5.9.3, allows remote attackers to execute arbitrary code via the d parameter in the Documents module.	2024-01-06	not yet calculated	CVE-2023-46953 cve@mitre.org
aoyun_technology — pbootcms	Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via session leakage allows a user to avoid logging into the backend management platform.	2024-01-04	not yet calculated	CVE-2023-50082 cve@mitre.org cve@mitre.org
apache — inlong	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Apache InLong. This issue affects Apache InLong: from 1.5.0 through 1.9.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong’s 1.10.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/9329	2024-01-03	not yet calculated	CVE-2023-51784 security@apache.org security@apache.org
apache — inlong	Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make an arbitrary file read attack using mysql driver. Users are advised to upgrade to Apache InLong’s 1.10.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/9331	2024-01-03	not yet calculated	CVE-2023-51785 security@apache.org security@apache.org
apache — openoffice	Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution. This is a corner case of CVE-2022-47502.	2023-12-29	not yet calculated	CVE-2023-47804 security@apache.org security@apache.org security@apache.org
apiida_ag — api_gateway_manager	APIIDA API Gateway Manager for Broadcom Layer7 v2023.2 is vulnerable to Cross Site Scripting (XSS).	2024-01-03	not yet calculated	CVE-2023-50092 cve@mitre.org cve@mitre.org
apiida_ag — api_gateway_manager	APIIDA API Gateway Manager for Broadcom Layer7 v2023.2.2 is vulnerable to Host Header Injection.	2024-01-03	not yet calculated	CVE-2023-50093 cve@mitre.org cve@mitre.org
autel_robotics — evo_nano	Autel EVO NANO drone flight control firmware version 1.6.5 is vulnerable to denial of service (DoS).	2024-01-06	not yet calculated	CVE-2023-50121 cve@mitre.org
automatic_systems — soc_fl9600_fastline	Directory Traversal in Automatic-Systems SOC FL9600 FastLine lego_T04E00 allows a remote attacker to obtain sensitive information.	2024-01-03	not yet calculated	CVE-2023-37607 cve@mitre.org cve@mitre.org cve@mitre.org
automatic_systems — soc_fl9600_fastline	An issue in Automatic Systems SOC FL9600 FastLine v.lego_T04E00 allows a remote attacker to obtain sensitive information via the admin login credentials.	2024-01-03	not yet calculated	CVE-2023-37608 cve@mitre.org cve@mitre.org cve@mitre.org
ava_teaching_video_application — ava_teaching_video_application	Cross Site Scripting (XSS) vulnerability in AVA teaching video application service platform version 3.1, allows remote attackers to execute arbitrary code via a crafted script to ajax.aspx.	2024-01-06	not yet calculated	CVE-2023-50609 cve@mitre.org
brave_software,_inc. — brave_browser	Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect. This is related to browser/brave_content_browser_client.cc and browser/ui/webui/brave_web_ui_controller_factory.cc.	2023-12-30	not yet calculated	CVE-2023-52263 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
cesanta_software — mjs	An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_getretvalpos function in the msj.c file.	2024-01-02	not yet calculated	CVE-2023-49549 cve@mitre.org
cesanta_software — mjs	An Out of Bounds Write in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_stringify function in the msj.c file.	2024-01-02	not yet calculated	CVE-2023-49552 cve@mitre.org
cesanta_software — mjs	An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the msj.c file.	2024-01-02	not yet calculated	CVE-2023-49553 cve@mitre.org
cetic-6lbr — cetic-6lbr	examples/6lbr/apps/6lbr-webserver/httpd.c in CETIC-6LBR (aka 6lbr) 1.5.0 has a strcat stack-based buffer overflow via a request for a long URL over a 6LoWPAN network.	2023-12-31	not yet calculated	CVE-2021-46901 cve@mitre.org cve@mitre.org
cherry — cherry	handle_request in http.c in cherry through 4b877df has an sscanf stack-based buffer overflow via a long URI, leading to remote code execution.	2024-01-05	not yet calculated	CVE-2024-22086 cve@mitre.org
class.upload.php — class.upload.php	As a simple library, class.upload.php does not perform an in-depth check on uploaded files, allowing a stored XSS vulnerability when the default configuration is used. Developers must be aware of that fact and use extension whitelisting accompanied by forcing the server to always provide content-type based on the file extension. The README has been updated to include these guidelines.	2024-01-04	not yet calculated	CVE-2023-6551 cvd@cert.pl cvd@cert.pl
cmark-gfm — cmark-gfm	CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.	2024-01-04	not yet calculated	CVE-2024-22051 disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com
dzzoffice — dzzoffice	SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent parameters in the Network Disk backend module.	2024-01-06	not yet calculated	CVE-2023-39853 cve@mitre.org
ehttp — ehttp	ehttp 1.0.6 before 17405b9 has an epoll_socket.cpp read_func use-after-free. An attacker can make many connections over a short time to trigger this.	2023-12-31	not yet calculated	CVE-2023-52266 cve@mitre.org cve@mitre.org
ehttp — ehttp	ehttp 1.0.6 before 17405b9 has a simple_log.cpp _log out-of-bounds-read during error logging for long strings.	2023-12-31	not yet calculated	CVE-2023-52267 cve@mitre.org cve@mitre.org
encoded_id-rails — encoded_id-rails	encoded_id-rails versions before 1.0.0.beta2 are affected by an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might cause a denial-of-service condition by sending an HTTP request with an extremely long “id” parameter.	2024-01-04	not yet calculated	CVE-2024-0241 disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com
firefly-iii — firefly-iii	Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.	2024-01-05	not yet calculated	CVE-2024-22075 cve@mitre.org
fit2cloud — cloud_explorer_lite	Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter.	2024-01-06	not yet calculated	CVE-2023-50612 cve@mitre.org
floorsight_software_llc — customer_portal_q3_2023	An indirect Object Reference (IDOR) in the Order and Invoice pages in Floorsight Customer Portal Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information.	2024-01-02	not yet calculated	CVE-2023-45893 cve@mitre.org
floorsight_software_llc — insights_q3_2023	An issue discovered in the Order and Invoice pages in Floorsight Insights Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information.	2024-01-02	not yet calculated	CVE-2023-45892 cve@mitre.org
flycms — flycms	FlyCms through abbaa5a allows XSS via the permission management feature.	2024-01-01	not yet calculated	CVE-2024-21732 cve@mitre.org
fortanix — enclaveos_confidential_computing_manager	An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.32 for Intel SGX. Lack of pointer-alignment validation logic in entry functions allows a local attacker to access unauthorized information. This relates to the enclave_ecall function and system call layer.	2023-12-30	not yet calculated	CVE-2023-38021 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
fortanix — enclaveos_confidential_computing_manager	An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.29 for Intel SGX. Insufficient pointer validation allows a local attacker to access unauthorized information. This relates to strlen and sgx_is_within_user.	2023-12-30	not yet calculated	CVE-2023-38022 cve@mitre.org cve@mitre.org
gila_cms — gila_cms	SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the Area parameter under the Administration>Widget tab after the login portal.	2024-01-02	not yet calculated	CVE-2020-26623 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
gila_cms — gila_cms	A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the ID parameter after the login portal.	2024-01-02	not yet calculated	CVE-2020-26624 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
gila_cms — gila_cms	A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the ‘user_id’ parameter after the login portal.	2024-01-02	not yet calculated	CVE-2020-26625 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
gl.inet — multiple_products	An issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the add_user interface in the system module to gain root privileges. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.	2024-01-03	not yet calculated	CVE-2023-50921 cve@mitre.org
gl.inet — multiple_products	An issue was discovered on GL.iNet devices through 4.5.0. Attackers who are able to steal the AdminToken cookie can execute arbitrary code by uploading a crontab-formatted file to a specific directory and waiting for its execution. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.	2024-01-03	not yet calculated	CVE-2023-50922 cve@mitre.org
google — chrome	Use after free in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)	2024-01-04	not yet calculated	CVE-2024-0222 chrome-cve-admin@google.com chrome-cve-admin@google.com chrome-cve-admin@google.com chrome-cve-admin@google.com
google — chrome	Heap buffer overflow in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)	2024-01-04	not yet calculated	CVE-2024-0223 chrome-cve-admin@google.com chrome-cve-admin@google.com chrome-cve-admin@google.com chrome-cve-admin@google.com
google — chrome	Use after free in WebAudio in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)	2024-01-04	not yet calculated	CVE-2024-0224 chrome-cve-admin@google.com chrome-cve-admin@google.com chrome-cve-admin@google.com chrome-cve-admin@google.com
google — chrome	Use after free in WebGPU in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)	2024-01-04	not yet calculated	CVE-2024-0225 chrome-cve-admin@google.com chrome-cve-admin@google.com chrome-cve-admin@google.com chrome-cve-admin@google.com
govuk_tech_docs — govuk_tech_docs	govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user’s browser if a malicious search result is displayed on the search page.	2024-01-04	not yet calculated	CVE-2024-22048 disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com
gpac — gpac	An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:55 allows attackers to crash the application.	2024-01-03	not yet calculated	CVE-2023-46929 cve@mitre.org cve@mitre.org
httparty — httparty	httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.	2024-01-04	not yet calculated	CVE-2024-22049 disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com
idurar-erp-crm — idurar-erp-crm	IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data.	2023-12-30	not yet calculated	CVE-2023-52265 cve@mitre.org cve@mitre.org
ifair — ifair	Directory Traversal vulnerability in fuwushe.org iFair versions 23.8_ad0 and before allows an attacker to obtain sensitive information via a crafted script.	2024-01-03	not yet calculated	CVE-2023-47473 cve@mitre.org cve@mitre.org
ifranview — ifranview	IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+27ef heap-based out-of-bounds write.	2024-01-05	not yet calculated	CVE-2020-13878 cve@mitre.org
ifranview — ifranview	IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+214f heap-based out-of-bounds write.	2024-01-05	not yet calculated	CVE-2020-13879 cve@mitre.org
ifranview — ifranview	IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+1cbf heap-based out-of-bounds write.	2024-01-05	not yet calculated	CVE-2020-13880 cve@mitre.org
iodine — iodine	Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.	2024-01-04	not yet calculated	CVE-2024-22050 disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com
jeecg — jeecg	Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST request.	2024-01-03	not yet calculated	CVE-2023-49442 cve@mitre.org
jizhicms — jizhicms	Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php.	2024-01-04	not yet calculated	CVE-2023-51154 cve@mitre.org
jupyter_notebook_viewer — nbviewer_app	nbviewer-app (aka Jupyter Notebook Viewer) before 0.1.6 has the get-task-allow entitlement for release builds.	2024-01-05	not yet calculated	CVE-2023-51277 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
kantega_software_corp. — kantega_sso	The Kantega SAML SSO OIDC Kerberos Single Sign-on apps before 6.20.0 for Atlassian products allow XSS if SAML POST Binding is enabled. This affects 4.4.2 through 4.14.8 before 4.14.9, 5.0.0 through 5.11.4 before 5.11.5, and 6.0.0 through 6.19.0 before 6.20.0. The full product names are Kantega SAML SSO OIDC Kerberos Single Sign-on for Jira Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Confluence Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Bitbucket Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Bamboo Data Center & Server (Kantega SSO Enterprise), and Kantega SAML SSO OIDC Kerberos Single Sign-on for FeCru Server (Kantega SSO Enterprise). (Here, FeCru refers to the Atlassian Fisheye and Crucible products running together.)	2023-12-29	not yet calculated	CVE-2023-52240 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
layui — layui	layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.	2023-12-30	not yet calculated	CVE-2023-50550 cve@mitre.org
linux — kernel	Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable. Note that 32-bit Arm-guests are not affected, as the 32-bit Linux kernel on Arm doesn’t use queued-RW-locks, which are required to trigger the issue (on Arm32 a waiting writer doesn’t block further readers to get the lock).	2024-01-05	not yet calculated	CVE-2023-34324 security@xen.org
little-backup-box — little-backup-box	outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input.	2023-12-30	not yet calculated	CVE-2023-52262 cve@mitre.org cve@mitre.org
lotos_webserver — lotos_webserver	Lotos WebServer through 0.1.1 (commit 3eb36cc) has a use-after-free in buffer_avail() at buffer.h via a long URI, because realloc is mishandled.	2024-01-05	not yet calculated	CVE-2024-22088 cve@mitre.org
ly_corp. — line_app	An issue in Tamaki_hamanoki Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.	2024-01-03	not yet calculated	CVE-2023-45559 cve@mitre.org cve@mitre.org
ly_corp. — line_app	An issue in A-WORLD OIRASE BEER_waiting Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.	2024-01-02	not yet calculated	CVE-2023-45561 cve@mitre.org cve@mitre.org cve@mitre.org
mingsoft_mcms — mingsoft_mcms	Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.	2023-12-30	not yet calculated	CVE-2023-50578 cve@mitre.org
newtonsoft.json — newtonsoft.json	Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial-of-service condition.	2024-01-03	not yet calculated	CVE-2024-21907 disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com
npmjs — npmjs	A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This may allow an attacker to reset other users’ passwords and take over their accounts.	2024-01-03	not yet calculated	CVE-2023-39655 cve@mitre.org cve@mitre.org
o-ran_software_community — o-ran_software_community	An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via a crafted request to the E2Manager API component.	2024-01-03	not yet calculated	CVE-2023-42358 cve@mitre.org
open5gs — open5gs	An issue was discovered in open5gs v2.6.6. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of Nudm_UECM_Registration response.	2024-01-02	not yet calculated	CVE-2023-50019 cve@mitre.org cve@mitre.org
open5gs — open5gs	An issue was discovered in open5gs v2.6.6. SIGPIPE can be used to crash AMF.	2024-01-02	not yet calculated	CVE-2023-50020 cve@mitre.org cve@mitre.org
petero.cbor — petero.cbor	PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial-of-service vulnerability. An attacker may trigger the denial-of-service condition by providing crafted data to the DecodeFromBytes or other decoding mechanisms in PeterO.Cbor. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial-of-service condition.	2024-01-03	not yet calculated	CVE-2024-21909 disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com
pico — pico	route in main.c in Pico HTTP Server in C through f3b69a6 has a sprintf stack-based buffer overflow via a long URI, leading to remote code execution.	2024-01-05	not yet calculated	CVE-2024-22087 cve@mitre.org
plotly — plotly	In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.	2024-01-03	not yet calculated	CVE-2023-46308 cve@mitre.org cve@mitre.org
prestashop — prestashop	SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privileges and gain sensitive information via BaproductzoommagnifierZoomModuleFrontController::run() method.	2024-01-05	not yet calculated	CVE-2023-50027 cve@mitre.org
pycryptodome/pycryptodomex — pycryptodome/pycryptodomex	PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.	2024-01-05	not yet calculated	CVE-2023-52323 cve@mitre.org cve@mitre.org
rengine — rengine	reNgine through 2.0.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.	2024-01-01	not yet calculated	CVE-2023-50094 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
royal_tsx — royal_tsx	Royal RoyalTSX before 6.0.2.1 allows attackers to cause a denial of service (Heap Memory Corruption and application crash) or possibly have unspecified other impact via a long hostname in an RTSZ file, if the victim clicks on Test Connection. This occurs during SecureGatewayHost object processing in RAPortCheck.createNWConnection.	2023-12-31	not yet calculated	CVE-2023-52277 cve@mitre.org
s-cms — s-cms	S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability.	2024-01-04	not yet calculated	CVE-2023-29962 cve@mitre.org cve@mitre.org
scone — scone	A lack of pointer-validation logic in the __scone_dispatch component of SCONE before v5.8.0 for Intel SGX allows attackers to access sensitive information.	2023-12-30	not yet calculated	CVE-2022-46486 cve@mitre.org cve@mitre.org cve@mitre.org
scone — scone	An issue was discovered in SCONE Confidential Computing Platform before 5.8.0 for Intel SGX. Lack of pointer-alignment logic in __scone_dispatch and other entry functions allows a local attacker to access unauthorized information, aka an “AEPIC Leak.”	2023-12-30	not yet calculated	CVE-2023-38023 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
sesami — cash_point_&_transport_optimizer	An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to obtain sensitive information and bypass profile restriction via improper access control in the Reader system user’s web browser, allowing the journal to be displayed, despite the option being disabled.	2023-12-29	not yet calculated	CVE-2023-31293 cve@mitre.org
sesami — cash_point_&_transport_optimizer	CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via the Delivery Name field.	2023-12-29	not yet calculated	CVE-2023-31294 cve@mitre.org
sesami — cash_point_&_transport_optimizer	CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via the User Profile field.	2023-12-29	not yet calculated	CVE-2023-31295 cve@mitre.org
sesami — cash_point_&_transport_optimizer	Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code via the Barcode field of a container.	2023-12-29	not yet calculated	CVE-2023-31299 cve@mitre.org
sesami — cash_point_&_transport_optimizer	An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via transmission of unencrypted, cleartext credentials during Password Reset feature.	2023-12-29	not yet calculated	CVE-2023-31300 cve@mitre.org
sesami — cash_point_&_transport_optimizer	Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to execute arbitrary code via the Teller field.	2023-12-29	not yet calculated	CVE-2023-31302 cve@mitre.org
spip — spip	ecrire/public/assembler.php in SPIP before 4.1.3 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as alphanumerics.	2024-01-04	not yet calculated	CVE-2023-52322 cve@mitre.org cve@mitre.org
springblade — springblade	An issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions control framework.	2024-01-02	not yet calculated	CVE-2023-47458 cve@mitre.org cve@mitre.org cve@mitre.org
stmicroelectronics_n.v. — stsafe-a1xx	STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is caused by an StSafeA_ReceiveBytes buffer overflow in the X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications (1.2.0), and thus can affect user-written code that was derived from a published sample application.	2024-01-01	not yet calculated	CVE-2023-50096 cve@mitre.org
sympa — sympa	Sympa before 6.2.62 relies on a cookie parameter for certain security objectives but does not ensure that this parameter exists and has an unpredictable value. Specifically, the cookie parameter is both a salt for stored passwords and an XSS protection mechanism.	2023-12-31	not yet calculated	CVE-2021-46900 cve@mitre.org cve@mitre.org cve@mitre.org
tecno_mobile — tecno_camon_x_ca7	Gallery3d on Tecno Camon X CA7 devices allows attackers to view hidden images by navigating to data/com.android.gallery3d/.privatealbum/.encryptfiles and guessing the correct image file extension.	2023-12-31	not yet calculated	CVE-2023-52275 cve@mitre.org cve@mitre.org
tenda — ax3	Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution (RCE) vulnerability via the list parameter at /goform/SetNetControlList.	2024-01-04	not yet calculated	CVE-2023-51812 cve@mitre.org
tenda — i29	Buffer Overflow vulnerability in Tenda i29 versions 1.0 V1.0.0.5 and 1.0 V1.0.0.2, allows remote attackers to cause a denial of service (DoS) via the pingIp parameter in the pingSet function.	2024-01-05	not yet calculated	CVE-2023-50991 cve@mitre.org
the_genie_company — aladdin_connect	Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below) on Android Devices. This allows the attacker, with access to the android device, to potentially retrieve users’ clear text authentication credentials.	2024-01-03	not yet calculated	CVE-2023-5879 cve@rapid7.con
the_genie_company — aladdin_connect	When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers “Garage Door Control Module Setup” page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allows the attacker to inject malicious code with client side Java Script and/or HTML into the users’ web browser.	2024-01-03	not yet calculated	CVE-2023-5880 cve@rapid7.con
the_genie_company — aladdin_connect	Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect (Retrofit-Kit Model ALDCM) “Garage Door Control Module Setup” and modify the Garage door’s SSID settings.	2024-01-03	not yet calculated	CVE-2023-5881 cve@rapid7.con
tinymce — tinymce	TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user’s browser.	2024-01-03	not yet calculated	CVE-2024-21908 disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com
tinymce — tinymce	TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user’s browser.	2024-01-03	not yet calculated	CVE-2024-21910 disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com
tinymce — tinymce	TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user’s browser.	2024-01-03	not yet calculated	CVE-2024-21911 disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com disclosure@vulncheck.com
tms — tms	Cross Site Scripting (XSS) vulnerability in xiweicheng TMS v.2.28.0 allows a remote attacker to execute arbitrary code via a crafted script to the click here function.	2024-01-04	not yet calculated	CVE-2023-50630 cve@mitre.org
ureport2 — ureport2	Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary commands via crafted POST request.	2024-01-03	not yet calculated	CVE-2023-50090 cve@mitre.org
wasm-micro-runtime — wasm-micro-runtime	Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have a “double free or corruption” error for a valid WebAssembly module because push_pop_frame_ref_offset is mishandled.	2023-12-31	not yet calculated	CVE-2023-52284 cve@mitre.org cve@mitre.org cve@mitre.org
wordpress — wordpress	The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to its affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL’s, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.	2024-01-01	not yet calculated	CVE-2023-5877 contact@wpscan.com
wordpress — wordpress	The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.	2024-01-01	not yet calculated	CVE-2023-6000 contact@wpscan.com contact@wpscan.com
wordpress — wordpress	The WP TripAdvisor Review Slider WordPress plugin before 11.9 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)	2024-01-01	not yet calculated	CVE-2023-6037 contact@wpscan.com
wordpress — wordpress	The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly accessible log files containing sensitive information when transactions occur.	2024-01-01	not yet calculated	CVE-2023-6064 contact@wpscan.com
wordpress — wordpress	The WP STAGING WordPress Backup Plugin before 3.1.3 and WP STAGING Pro WordPress Backup Plugin before 5.1.3 do not prevent visitors from leaking key information about ongoing backups processes, allowing unauthenticated attackers to download said backups later.	2024-01-01	not yet calculated	CVE-2023-6113 contact@wpscan.com contact@wpscan.com
wordpress — wordpress	The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly accessible files, which may allow attackers monitoring those to leak sensitive information from the site’s backups.	2024-01-01	not yet calculated	CVE-2023-6271 contact@wpscan.com contact@wpscan.com
wordpress — wordpress	The Download Manager WordPress plugin before 3.2.83 does not protect file download’s passwords, leaking it upon receiving an invalid one.	2024-01-01	not yet calculated	CVE-2023-6421 contact@wpscan.com
wordpress — wordpress	The Html5 Video Player WordPress plugin before 2.5.19 does not sanitize and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against high privilege users like admins.	2024-01-01	not yet calculated	CVE-2023-6485 contact@wpscan.com
wordpress — wordpress	The POST SMTP WordPress plugin before 2.8.7 does not sanitize and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.	2024-01-03	not yet calculated	CVE-2023-6621 contact@wpscan.com
xen — xen	Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest. Unfortunately, the arithmetic in the helpers can overflow and would then result to skip the cache cleaning/invalidation. Therefore, there is no guarantee when all the writes will reach the memory.	2024-01-05	not yet calculated	CVE-2023-34321 security@xen.org
xen — xen	For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped when PV guests run, Xen and shadowed PV guests run directly the respective shadow page tables. For 64-bit PV guests this means running on the shadow of the guest root page table. In the course of dealing with shortage of memory in the shadow pool associated with a domain, shadows of page tables may be torn down. This tearing down may include the shadow root page table that the CPU in question is presently running on. While a precaution exists to supposedly prevent the tearing down of the underlying live page table, the time window covered by that precaution isn’t large enough.	2024-01-05	not yet calculated	CVE-2023-34322 security@xen.org
xen — xen	When a transaction is committed, C Xenstored will first check the quota is correct before attempting to commit any nodes. It would be possible that accounting is temporarily negative if a node has been removed outside of the transaction. Unfortunately, some versions of C Xenstored are assuming that the quota cannot be negative and are using assert() to confirm it. This will lead to C Xenstored crash when tools are built without -DNDEBUG (this is the default).	2024-01-05	not yet calculated	CVE-2023-34323 security@xen.org
xen — xen	[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] libfsimage contains parsing code for several filesystems, most of them based on grub-legacy code. libfsimage is used by pygrub to inspect guest disks. Pygrub runs as the same user as the toolstack (root in a priviledged domain). At least one issue has been reported to the Xen Security Team that allows an attacker to trigger a stack buffer overflow in libfsimage. After further analysis the Xen Security Team is no longer confident in the suitability of libfsimage when run against guest controlled input with super user priviledges. In order to not affect current deployments that rely on pygrub patches are provided in the resolution section of the advisory that allow running pygrub in deprivileged mode. CVE-2023-4949 refers to the original issue in the upstream grub project (“An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory corruption in grub’s XFS file system implementation.”) CVE-2023-34325 refers specifically to the vulnerabilities in Xen’s copy of libfsimage, which is descended from a very old version of grub.	2024-01-05	not yet calculated	CVE-2023-34325 security@xen.org
xen — xen	The caching invalidation guidelines from the AMD-Vi specification (48882-Rev 3.07-PUB-Oct 2022) is incorrect on some hardware, as devices will malfunction (see stale DMA mappings) if some fields of the DTE are updated but the IOMMU TLB is not flushed. Such stale DMA mappings can point to memory ranges not owned by the guest, thus allowing access to unindented memory regions.	2024-01-05	not yet calculated	CVE-2023-34326 security@xen.org
xen — xen	[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs since ~2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately, there are errors in Xen’s handling of the guest state, leading to denials of service. 1) CVE-2023-34327 – An HVM vCPU can end up operating in the context of a previous vCPUs debug mask state. 2) CVE-2023-34328 – A PV vCPU can place a breakpoint over the live GDT. This allows the PV vCPU to exploit XSA-156 / CVE-2015-8104 and lock up the CPU entirely.	2024-01-05	not yet calculated	CVE-2023-34327 security@xen.org
xen — xen	[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs since ~2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately, there are errors in Xen’s handling of the guest state, leading to denials of service. 1) CVE-2023-34327 – An HVM vCPU can end up operating in the context of a previous vCPUs debug mask state. 2) CVE-2023-34328 – A PV vCPU can place a breakpoint over the live GDT. This allows the PV vCPU to exploit XSA-156 / CVE-2015-8104 and lock up the CPU entirely.	2024-01-05	not yet calculated	CVE-2023-34328 security@xen.org
xen — xen	The current setup of the quarantine page tables assumes that the quarantine domain (dom_io) has been initialized with an address width of DEFAULT_DOMAIN_ADDRESS_WIDTH (48) and hence 4-page table levels. However, dom_io being a PV domain gets the AMD-Vi IOMMU page tables levels based on the maximum (hot pluggable) RAM address, and hence on systems with no RAM above the 512GB mark only 3 page-table levels are configured in the IOMMU. On systems without RAM above the 512GB boundary amd_iommu_quarantine_init() will setup page tables for the scratch page with 4 levels, while the IOMMU will be configured to use 3 levels only, resulting in the last page table directory (PDE) effectively becoming a page table entry (PTE), and hence a device in quarantine mode gaining write access to the page destined to be a PDE. Due to this page table level mismatch, the sink page the device gets read/write access to is no longer cleared between device assignment, possibly leading to data leaks.	2024-01-05	not yet calculated	CVE-2023-46835 security@xen.org
xen — xen	The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one unconditionally, and one conditionally on whether XPTI was active. As BTC/SRSO and Meltdown affect different CPU vendors, the mitigations are not active together by default. Therefore, there is a race condition whereby a malicious PV guest can bypass BTC/SRSO protections and launch a BTC/SRSO attack against Xen.	2024-01-05	not yet calculated	CVE-2023-46836 security@xen.org
xen — xen	Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest. Unfortunately, the arithmetic in the helpers can overflow and would then result to skip the cache cleaning/invalidation. Therefore, there is no guarantee when all the writes will reach the memory. This undefined behavior was meant to be addressed by XSA-437, but the approach was not sufficient.	2024-01-05	not yet calculated	CVE-2023-46837 security@xen.org
yasm — yasm	Use After Free vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the do_directive function in the modules/preprocs/nasm/nasm-pp.c component.	2024-01-03	not yet calculated	CVE-2023-49554 cve@mitre.org
yasm — yasm	An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_smacro function in the modules/preprocs/nasm/nasm-pp.c component.	2024-01-03	not yet calculated	CVE-2023-49555 cve@mitre.org
yasm — yasm	Buffer Overflow vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expr_delete_term function in the libyasm/expr.c component.	2024-01-03	not yet calculated	CVE-2023-49556 cve@mitre.org
yasm — yasm	An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the yasm_section_bcs_first function in the libyasm/section.c component.	2024-01-03	not yet calculated	CVE-2023-49557 cve@mitre.org
yasm — yasm	An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_mmac_params function in the modules/preprocs/nasm/nasm-pp.c component.	2024-01-03	not yet calculated	CVE-2023-49558 cve@mitre.org

alerts

Vulnerability Summary for the Week of December 25, 2023

Post author By admin
Post date January 2, 2024

High Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
awslabs — sandbox-accounts-for-events	“Sandbox Accounts for Events” provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.	2023-12-22	7.1	CVE-2023-50928 security-advisories@github.com security-advisories@github.com
awslabs — sandbox-accounts-for-events	Sandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially read data from the events table by sending request payloads to the events API, collecting information on planned events, timeframes, budgets and owner email addresses. This data access may allow users to get insights into upcoming events and join events which they have not been invited to. This issue has been patched in version 1.10.0.	2023-12-22	7.8	CVE-2023-51386 security-advisories@github.com security-advisories@github.com
c-blosc2 — c-blosc2	C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_prec_decompress at zfp/blosc2-zfp.c.	2023-12-25	7.5	CVE-2023-37185 cve@mitre.org cve@mitre.org cve@mitre.org
c-blosc2 — c-blosc2	C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference in ndlz/ndlz8x8.c via a NULL pointer to memset.	2023-12-25	7.5	CVE-2023-37186 cve@mitre.org cve@mitre.org cve@mitre.org
c-blosc2 — c-blosc2	C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_decompress. function.	2023-12-25	7.5	CVE-2023-37187 cve@mitre.org cve@mitre.org cve@mitre.org
c-blosc2 — c-blosc2	C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompress at zfp/blosc2-zfp.c.	2023-12-25	7.5	CVE-2023-37188 cve@mitre.org cve@mitre.org cve@mitre.org
cacti — cacti	Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability – arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.	2023-12-22	8.8	CVE-2023-49085 security-advisories@github.com security-advisories@github.com
cacti — cacti	Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `’managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `’/cacti/managers.php’` with an SQLi payload in the `’selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.	2023-12-22	8.8	CVE-2023-51448 security-advisories@github.com security-advisories@github.com
campcodes — online_college_library_system	A vulnerability has been found in Campcodes Online College Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file index.php of the component Search. The manipulation of the argument category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249178 is the identifier assigned to this vulnerability.	2023-12-29	7.3	CVE-2023-7156 cna@vuldb.com cna@vuldb.com cna@vuldb.com
clickhouse — clickhouse	ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication. This issue has been addressed in ClickHouse Cloud version 23.9.2.47551 and ClickHouse versions 23.10.5.20, 23.3.18.15, 23.8.8.20, and 23.9.6.20.	2023-12-22	7	CVE-2023-48704 security-advisories@github.com security-advisories@github.com
cloudflare — miniflare	Sending specially crafted HTTP requests to Miniflare’s server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.	2023-12-29	7.5	CVE-2023-7078 cna@cloudflare.com cna@cloudflare.com
cloudflare — wrangler	The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector server listening on all network interfaces. This would allow an attacker on the local network to connect to the inspector and run arbitrary code. Additionally, the inspector server did not validate Origin/Host headers, granting an attacker that can trick any user on the local network into opening a malicious website the ability to run code. If wrangler dev –remote was being used, an attacker could access production resources if they were bound to the worker. This issue was fixed in wrangler@3.19.0 and wrangler@2.20.2. Whilst wrangler dev’s inspector server listens on local interfaces by default as of wrangler@3.16.0, an SSRF vulnerability in miniflare https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7 (CVE-2023-7078) allowed access from the local network until wrangler@3.18.0. wrangler@3.19.0 and wrangler@2.20.2 introduced validation for the Origin/Host headers.	2023-12-29	8.5	CVE-2023-7080 cna@cloudflare.com cna@cloudflare.com cna@cloudflare.com cna@cloudflare.com cna@cloudflare.com
code-projects — faculty_management_system	A vulnerability was found in code-projects Faculty Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/php/crud.php. The manipulation of the argument fieldname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248948.	2023-12-25	9.8	CVE-2023-7096 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — library_management_system	A vulnerability, which was classified as critical, was found in code-projects Library Management System 2.0. Affected is an unknown function of the file index.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249006 is the identifier assigned to this vulnerability.	2023-12-26	9.8	CVE-2023-7111 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — water_billing_system	A vulnerability classified as critical has been found in code-projects Water Billing System 1.0. This affects an unknown part of the file /addbill.php. The manipulation of the argument owners_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248949 was assigned to this vulnerability.	2023-12-25	9.8	CVE-2023-7097 cna@vuldb.com cna@vuldb.com cna@vuldb.com
coolkit_technology — ewelink_-_smart_home	Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass. This issue affects eWeLink before 5.2.0.	2023-12-30	7.7	CVE-2023-6998 cvd@cert.pl cvd@cert.pl cvd@cert.pl
d-link — d-view_8	A security issue exists in D-Link D-View 8 v2.0.2.89 and prior that could allow an attacker to manipulate the probe inventory of the D-View service. This could result in the disclosure of information from other probes, denial of service conditions due to the probe inventory becoming full, or the execution of tasks on other probes.	2023-12-28	10	CVE-2023-7163 vulnreport@tenable.com
deepin_linux — deepin_linux	Deepin Linux’s default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remote code execution (RCE) can be achieved by overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered when the user opens the terminal. Version 6.0.7 contains a patch for the issue.	2023-12-22	9.3	CVE-2023-50254 security-advisories@github.com security-advisories@github.com security-advisories@github.com
deepin_linux — deepin_linux	Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there’s a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.	2023-12-27	9.3	CVE-2023-50255 security-advisories@github.com security-advisories@github.com
dell — client_bios	Dell Client BIOS contains a pre-boot direct memory access (DMA) vulnerability. An authenticated attacker with physical access to the system may potentially exploit this vulnerability in order to execute arbitrary code on the device.	2023-12-22	7.2	CVE-2023-43088 security_alert@emc.com
dell — supportassist_client_consumer	Dell SupportAssist for Home PCs version 3.14.1 and prior versions contain a privilege escalation vulnerability in the installer. A local low privileged authenticated attacker may potentially exploit this vulnerability, leading to the execution of arbitrary executable on the operating system with elevated privileges.	2023-12-22	7.3	CVE-2023-48670 security_alert@emc.com
dromara_hertzbeat — dromara_hertzbeat	Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1.20 and prior have a permission bypass vulnerability. System authentication can be bypassed and invoke interfaces without authorization. Version 1.2.1 contains a patch for this issue.	2023-12-22	7.5	CVE-2022-39337 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
dromara_hertzbeat — dromara_hertzbeat	Hertzbeat is an open source, real-time monitoring system. Hertzbeat uses aviatorscript to evaluate alert expressions. The alert expressions are supposed to be some simple expressions. However, due to improper sanitization for alert expressions in version prior to 1.4.1, a malicious user can use a crafted alert expression to execute any command on hertzbeat server. A malicious user who has access to alert define function can execute any command in hertzbeat instance. This issue is fixed in version 1.4.1.	2023-12-22	7.2	CVE-2023-51387 security-advisories@github.com security-advisories@github.com security-advisories@github.com
dromara_hertzbeat — dromara_hertzbeat	Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue.	2023-12-22	7.5	CVE-2023-51650 security-advisories@github.com security-advisories@github.com
engelsystem — engelsystem	Englesystem is a shift planning system for chaos events. Engelsystem prior to v3.4.1 performed insufficient validation of user supplied data for the DECT number, mobile number, and work-log comment fields. The values of those fields would be displayed in corresponding log overviews, allowing the injection and execution of Javascript code in another user’s context. This vulnerability enables an authenticated user to inject Javascript into other user’s sessions. The injected JS will be executed during normal usage of the system when viewing, e.g., overview pages. This issue has been fixed in version 3.4.1.	2023-12-22	7.3	CVE-2023-50924 security-advisories@github.com security-advisories@github.com
gm_information_technologies — mdo	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in GM Information Technologies MDO allows SQL Injection. This issue affects MDO: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-29	9.8	CVE-2023-4675 iletisim@usom.gov.tr
grackle — grackle	Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form cycles, either directly or indirectly. Prior to Grackle version 0.18.0, that requirement wasn’t checked, and queries with cyclic fragments would have been accepted for type checking and compilation. The attempted compilation of such fragments would result in a JVM `StackOverflowError` being thrown. Some knowledge of an applications GraphQL schema would be required to construct such a query, however no knowledge of any application-specific performance or other behavioural characteristics would be needed. Grackle uses the cats-parse library for parsing GraphQL queries. Prior to version 0.18.0, Grackle made use of the cats-parse `recursive` operator. However, `recursive` is not currently stack safe. `recursive` was used in three places in the parser: nested selection sets, nested input values (lists and objects), and nested list type declarations. Consequently, queries with deeply nested selection sets, input values or list types could be constructed which exploited this, causing a JVM `StackOverflowException` to be thrown during parsing. Because this happens very early in query processing, no specific knowledge of an applications GraphQL schema would be required to construct such a query. The possibility of small queries resulting in stack overflow is a potential denial of service vulnerability. This potentially affects all applications using Grackle which have untrusted users. Both stack overflow issues have been resolved in the v0.18.0 release of Grackle. As a workaround, users could interpose a sanitizing layer in between untrusted input and Grackle query processing.	2023-12-22	7.5	CVE-2023-50730 security-advisories@github.com security-advisories@github.com security-advisories@github.com
honor — com.hihonor.phoneservice	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.	2023-12-29	7	CVE-2023-51431 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file	2023-12-29	7.3	CVE-2023-23436 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_ui	Some Honor products are affected by buffer overflow vulnerability, successful exploitation could cause code execution.	2023-12-29	9.3	CVE-2023-51434 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_ui	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.	2023-12-29	7.1	CVE-2023-51435 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — nth-an00	Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.	2023-12-29	7.3	CVE-2023-23431 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — nth-an00	Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.	2023-12-29	7.3	CVE-2023-23432 3836d913-7555-4dd0-a509-f5667fdf5fe4
ibm — aspera_console	IBM Aspera Console 3.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 210322.	2023-12-25	7.2	CVE-2021-38927 psirt@us.ibm.com psirt@us.ibm.com
ibm — financial_transaction_manager_for_swift_services	In the Message Entry and Repair (MER) facility of IBM Financial Transaction Manager for SWIFT Services 3.2.4 the sending address and the message type of FIN messages are assumed to be immutable. However, an attacker might modify these elements of a business transaction. IBM X-Force ID: 273183.	2023-12-25	7.5	CVE-2023-49880 psirt@us.ibm.com psirt@us.ibm.com
ibm — i	Facsimile Support for IBM i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause arbitrary code to run with the privilege of the user invoking the facsimile support. IBM X-Force ID: 267689.	2023-12-25	7	CVE-2023-43064 psirt@us.ibm.com psirt@us.ibm.com
ibm — planning_analytics	IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to upload a malicious script, which could allow the attacker to execute arbitrary code on the vulnerable system. IBM X-Force ID: 265567.	2023-12-22	9.8	CVE-2023-42017 psirt@us.ibm.com psirt@us.ibm.com
iteachyou — dreamer_cms	A vulnerability was found in Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /upload/uploadFile. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-248938 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-24	8.8	CVE-2023-7091 cna@vuldb.com cna@vuldb.com cna@vuldb.com
kashipara — job_portal	Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘txtUser’ parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-12-22	9.8	CVE-2023-49688 help@fluidattacks.com help@fluidattacks.com
kashipara — job_portal	Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘JobId’ parameter of the Employer/DeleteJob.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-12-22	9.8	CVE-2023-49689 help@fluidattacks.com help@fluidattacks.com
libaom — libaom	Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc().	2023-12-27	9	CVE-2023-6879 cve-coordination@google.com cve-coordination@google.com
lychee — lychee	Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings of Lychee are safe. The patch is provided on version 5.0.2. To work around this issue, disable SQL EXPLAIN logging.	2023-12-28	8.8	CVE-2023-52082 security-advisories@github.com security-advisories@github.com
mattermost — mattermost	Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server.	2023-12-29	7.1	CVE-2023-7114 responsibledisclosure@mattermost.com
micropython — micropython	A vulnerability was found in MicroPython up to 1.21.0. It has been classified as critical. Affected is the function slice_indices of the file objslice.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.22.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249180.	2023-12-29	7.3	CVE-2023-7158 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
microsoft — visual_studio	Visual Studio Code Python Extension Remote Code Execution Vulnerability	2023-12-29	7.8	CVE-2020-17163 secure@microsoft.com
mindsdb — mindsdb	MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which leads to path injection. Later in the method, the temporary directory is deleted on line 151, but since we can write outside of the directory using the path injection vulnerability, the potentially dangerous file is not deleted. Arbitrary file contents can be written due to `f.write(chunk)` on line 125. Mindsdb does check later on line 149 in the `save_file` method in `file-controller.py` which calls the `_handle_source` method in `file_handler.py` if a file is of one of the types `csv`, `json`, `parquet`, `xls`, or `xlsx`. However, since the check happens after the file has already been written, the files will still exist (and will not be removed due to the path injection described earlier), just the `_handle_source` method will return an error. The same user-controlled source source is used also in another path injection sink on line 138. This leads to another path injection, which allows an attacker to delete any `zip` or `tar.gz` files on the server.	2023-12-22	9.1	CVE-2023-50731 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
misskey — misskey	Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L805) without the user’s permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version [2023.12.1](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64).	2023-12-29	9	CVE-2023-52139 security-advisories@github.com security-advisories@github.com
misskey — misskey	Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.	2023-12-27	8.9	CVE-2023-52077 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
moxa — iologik_e1210_firmware	A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.	2023-12-23	8.8	CVE-2023-5961 psirt@moxa.com
mp3gain — mp3gain	A stack buffer overflow vulnerability in MP3Gain v1.6.2 allows an attacker to cause a denial of service via the WriteMP3GainAPETag function at apetag.c:592.	2023-12-22	7.5	CVE-2023-49356 cve@mitre.org
netentsec — ns-asg_application_security_gateway	A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1. This affects an unknown part of the file index.php?para=index of the component Login. The manipulation of the argument check_VirtualSiteId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249183.	2023-12-29	7.3	CVE-2023-7161 cna@vuldb.com cna@vuldb.com cna@vuldb.com
open_design_alliance — oda_drawings_sdk	An issue was discovered in Open Design Alliance Drawings SDK before 2024.12. A corrupted value of number of sectors used by the Fat structure in a crafted DGN file leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in the context of the current process.	2023-12-26	7.8	CVE-2023-5180 8a9629cb-c5e7-4d2a-a894-111e8039b7ea
pandora_fms — pandora_fms	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Malicious code could be executed in the File Manager section. This issue affects Pandora FMS: from 700 through 774.	2023-12-29	7.5	CVE-2023-41815 security@pandorafms.com
pexip — pexip_infinity	Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort.	2023-12-25	7.5	CVE-2023-31289 cve@mitre.org
pexip — pexip_infinity	Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort.	2023-12-25	7.5	CVE-2023-31455 cve@mitre.org
phpgurukul — hospital_management_system	A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the component Admin Dashboard. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249356.	2023-12-30	7.3	CVE-2023-7172 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
phpgurukul — nipah_virus_testing_management_system	A vulnerability, which was classified as critical, has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This issue affects some unknown processing of the file bwdates-report-result.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248951.	2023-12-25	9.8	CVE-2023-7099 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
phpgurukul — online_notes_sharing_system	A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /user/signup.php. The manipulation leads to weak password requirements. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248740.	2023-12-22	8.8	CVE-2023-7053 cna@vuldb.com cna@vuldb.com cna@vuldb.com
phpgurukul — restaurant_table_booking_system	A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/bwdates-report-details.php. The manipulation of the argument fdate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248952.	2023-12-25	9.8	CVE-2023-7100 cna@vuldb.com cna@vuldb.com cna@vuldb.com
poly — multiple_products	A vulnerability, which was classified as critical, has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This issue affects some unknown processing of the component Diagnostic Telnet Mode. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-249257 was assigned to this vulnerability.	2023-12-29	7.2	CVE-2023-4464 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
red_hat — jboss_enterprise_application_platform	A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.	2023-12-27	7.5	CVE-2023-3171 secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com
revanced — revanced	ReVanced API proxies requests needed to feed the ReVanced Manager and website with data. Up to and including commit 71f81f7f20cd26fd707335bca9838fa3e7df20d2, ReVanced API lacks error caching causing rate limit to be triggered thus increasing server load. This causes a denial of service for all users using the API. It is recommended to implement proper error caching.	2023-12-27	7.5	CVE-2023-52075 security-advisories@github.com
signalwire — freeswitch	FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.11, when handling DTLS-SRTP for media setup, FreeSWITCH is susceptible to Denial of Service due to a race condition in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack. If an attacker manages to send a ClientHello DTLS message with an invalid CipherSuite (such as `TLS_NULL_WITH_NULL_NULL`) to the port on the FreeSWITCH server that is expecting packets from the caller, a DTLS error is generated. This results in the media session being torn down, which is followed by teardown at signaling (SIP) level too. Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable FreeSWITCH servers for calls that rely on DTLS-SRTP. To address this vulnerability, upgrade FreeSWITCH to 1.10.11 which includes the security fix. The solution implemented is to drop all packets from addresses that have not been validated by an ICE check.	2023-12-27	7.5	CVE-2023-51443 security-advisories@github.com security-advisories@github.com
sourcecodester — simple_student_attendance_system	A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument page leads to path traversal: ‘../filedir’. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248749 was assigned to this vulnerability.	2023-12-22	9.8	CVE-2023-7058 cna@vuldb.com cna@vuldb.com cna@vuldb.com
talent_software — ecop	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Talent Software ECOP allows Command Line Execution through SQL Injection. This issue affects ECOP: before 32255.	2023-12-28	7.5	CVE-2023-4671 iletisim@usom.gov.tr
tenda — m3_firmware	Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formGetWeiXinConfig.	2023-12-26	9.8	CVE-2023-51090 cve@mitre.org
tenda — m3_firmware	Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function R7WebsSecurityHandler.	2023-12-26	9.8	CVE-2023-51091 cve@mitre.org
tenda — m3_firmware	Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade.	2023-12-26	9.8	CVE-2023-51092 cve@mitre.org
tenda — m3_firmware	Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function fromSetLocalVlanInfo.	2023-12-26	9.8	CVE-2023-51093 cve@mitre.org
tenda — m3_firmware	Tenda M3 V1.0.0.12(4856) was discovered to contain a Command Execution vulnerability via the function TendaTelnet.	2023-12-26	9.8	CVE-2023-51094 cve@mitre.org
tenda — m3_firmware	Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formDelWlRfPolicy.	2023-12-26	9.8	CVE-2023-51095 cve@mitre.org
tenda — w9_firmware	Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetAutoPing.	2023-12-26	9.8	CVE-2023-51097 cve@mitre.org
tenda — w9_firmware	Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formSetDiagnoseInfo .	2023-12-26	9.8	CVE-2023-51098 cve@mitre.org
tenda — w9_firmware	Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formexeCommand .	2023-12-26	9.8	CVE-2023-51099 cve@mitre.org
tenda — w9_firmware	Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formGetDiagnoseInfo .	2023-12-26	9.8	CVE-2023-51100 cve@mitre.org
tenda — w9_firmware	Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetUplinkInfo.	2023-12-26	9.8	CVE-2023-51101 cve@mitre.org
tenda — w9_firmware	Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formWifiMacFilterSet.	2023-12-26	9.8	CVE-2023-51102 cve@mitre.org
tj-actions — tj-actions	tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrary command execution in the GitHub Runner. This vulnerability has been addressed in version 41.0.0. Users are advised to upgrade.	2023-12-27	7.3	CVE-2023-51664 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
tj-actions — tj-actions	The [`tj-actions/verify-changed-files`](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. The [`verify-changed-files`](https://github.com/tj-actions/verify-changed-files) workflow returns the list of files changed within a workflow execution. This could potentially allow filenames that contain special characters such as `;` which can be used by an attacker to take over the [GitHub Runner](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners) if the output value is used in a raw fashion (thus being directly replaced before execution) inside a `run` block. By running custom commands, an attacker may be able to steal secrets such as `GITHUB_TOKEN` if triggered on other events than `pull_request`. This has been patched in versions [17](https://github.com/tj-actions/verify-changed-files/releases/tag/v17) and [17.0.0](https://github.com/tj-actions/verify-changed-files/releases/tag/v17.0.0) by enabling `safe_output` by default and returning filename paths escaping special characters for bash environments.	2023-12-29	7.7	CVE-2023-52137 security-advisories@github.com security-advisories@github.com security-advisories@github.com
totolink — a3700r_firmware	There is an arbitrary command execution vulnerability in the setDiagnosisCfg function of the cstecgi .cgi of the TOTOlink A3700R router device in its firmware version V9.1.2u.5822_B20200513.	2023-12-22	9.8	CVE-2023-50147 cve@mitre.org
totolink — a7100ru	A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248942 is the identifier assigned to this vulnerability.	2023-12-25	9.8	CVE-2023-7095 cna@vuldb.com cna@vuldb.com cna@vuldb.com
totolink — ex1200l_firmware	TOTOlink EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution via the cstecgi.cgi setOpModeCfg interface.	2023-12-22	9.8	CVE-2023-51033 cve@mitre.org
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanPriDns parameter’ of the setLanConfig interface of the cstecgi .cgi	2023-12-22	9.8	CVE-2023-51011 cve@mitre.org
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanGateway parameter’ of the setLanConfig interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51012 cve@mitre.org
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanNetmask parameter’ of the setLanConfig interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51013 cve@mitre.org
totolink — ex1800t_firmware	TOTOLINK EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanSecDns parameter’ of the setLanConfig interface of the cstecgi .cgi	2023-12-22	9.8	CVE-2023-51014 cve@mitre.org
totolink — ex1800t_firmware	TOTOLINX EX1800T v9.1.0cu.2112_B20220316 is vulnerable to arbitrary command execution in the ‘enable parameter’ of the setDmzCfg interface of the cstecgi .cgi	2023-12-22	9.8	CVE-2023-51015 cve@mitre.org
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the setRebootScheCfg interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51016 cve@mitre.org
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanIp parameter’ of the setLanConfig interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51017 cve@mitre.org
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘opmode’ parameter of the setWiFiApConfig interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51018 cve@mitre.org
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘key5g’ parameter of the setWiFiExtenderConfig interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51019 cve@mitre.org
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘langType’ parameter of the setLanguageCfg interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51020 cve@mitre.org
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘merge’ parameter of the setRptWizardCfg interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51021 cve@mitre.org
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘langFlag’ parameter of the setLanguageCfg interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51022 cve@mitre.org
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to arbitrary command execution in the ‘host_time’ parameter of the NTPSyncWithHost interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51023 cve@mitre.org
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘tz’ parameter of the setNtpCfg interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51024 cve@mitre.org
totolink — ex1800t_firmware	TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to an unauthorized arbitrary command execution in the ‘admuser’ parameter of the setPasswordCfg interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51025 cve@mitre.org
totolink — ex1800t_firmware	TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘hour’ parameter of the setRebootScheCfg interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51026 cve@mitre.org
totolink — ex1800t_firmware	TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘apcliAuthMode’ parameter of the setWiFiExtenderConfig interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51027 cve@mitre.org
totolink — ex1800t_firmware	TOTOLINK EX1800T 9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the apcliChannel parameter of the setWiFiExtenderConfig interface of the cstecgi.cgi.	2023-12-22	9.8	CVE-2023-51028 cve@mitre.org
wasmer — wasmer	Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the filesystem outside of the sandbox. Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem. This vulnerability has been patched in version 4.2.4.	2023-12-22	8.4	CVE-2023-51661 security-advisories@github.com security-advisories@github.com security-advisories@github.com
ween_software — admin_panel	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Ween Software Admin Panel allows SQL Injection. This issue affects Admin Panel: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-29	9.8	CVE-2023-4541 iletisim@usom.gov.tr
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in David F. Carr RSVPMaker. This issue affects RSVPMaker: from n/a through 10.6.6.	2023-12-29	10	CVE-2023-25054 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps. This issue affects Frontend Admin by DynamiApps: from n/a through 3.18.3.	2023-12-29	10	CVE-2023-51411 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your AI co-pilot for WordPress and Chrome. This issue affects BERTHA AI. Your AI co-pilot for WordPress and Chrome: from n/a through 1.11.10.7.	2023-12-29	10	CVE-2023-51419 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Jacques Malgrange Rencontre – Dating Site. This issue affects Rencontre – Dating Site: from n/a through 3.10.1.	2023-12-29	10	CVE-2023-51468 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Pixelemu TerraClassifieds – Simple Classifieds Plugin. This issue affects TerraClassifieds – Simple Classifieds Plugin: from n/a through 2.0.3.	2023-12-29	10	CVE-2023-51473 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in IOSS WP MLM SOFTWARE PLUGIN. This issue affects WP MLM SOFTWARE PLUGIN: from n/a through 4.0.	2023-12-29	10	CVE-2023-51475 audit@patchstack.com
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store. This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: from n/a through 1.0.6.	2023-12-29	10	CVE-2023-51505 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Milan Dini? Rename Media Files. This issue affects Rename Media Files: from n/a through 1.0.1.	2023-12-29	9.9	CVE-2023-32095 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Kanban for WordPress Kanban Boards for WordPress. This issue affects Kanban Boards for WordPress: from n/a through 2.5.21.	2023-12-29	9.1	CVE-2023-40606 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in POSIMYTH Nexter Extension. This issue affects Nexter Extension: from n/a through 2.0.3.	2023-12-29	9.1	CVE-2023-45751 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in TienCOP WP EXtra. This issue affects WP EXtra: from n/a through 6.2.	2023-12-29	9.9	CVE-2023-46623 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Qode Interactive Qode Essential Addons. This issue affects Qode Essential Addons: from n/a through 1.5.2.	2023-12-29	9.9	CVE-2023-47840 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Brainstorm Force Astra Pro. This issue affects Astra Pro: from n/a through 4.3.1.	2023-12-29	9.9	CVE-2023-49830 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin. This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.1.	2023-12-28	9.3	CVE-2023-50839 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in WPVibes WP Mail Log. This issue affects WP Mail Log: from n/a through 1.1.2.	2023-12-29	9.9	CVE-2023-51410 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Piotnet Piotnet Forms. This issue affects Piotnet Forms: from n/a through 1.0.25.	2023-12-29	9	CVE-2023-51412 audit@patchstack.com
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters. This issue affects EnvíaloSimple: Email Marketing y Newsletters: from n/a through 2.1.	2023-12-29	9.6	CVE-2023-51414 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons. This issue affects JVM Gutenberg Rich Text Icons: from n/a through 1.2.3.	2023-12-29	9.9	CVE-2023-51417 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce. This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.	2023-12-29	9.1	CVE-2023-51420 audit@patchstack.com
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce. This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.	2023-12-29	9.9	CVE-2023-51421 audit@patchstack.com
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings \| WebinarIgnition. This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings \| WebinarIgnition: from n/a through 3.05.0.	2023-12-29	9.9	CVE-2023-51422 audit@patchstack.com
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in Jacques Malgrange Rencontre – Dating Site. This issue affects Rencontre – Dating Site: from n/a through 3.11.1.	2023-12-29	9.9	CVE-2023-51470 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments. This issue affects Job Manager & Career – Manage job board listings, and recruitments: from n/a through 1.4.4.	2023-12-29	9.6	CVE-2023-51545 audit@patchstack.com
wordpress — wordpress	The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the ‘content-dir’ HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server’s php.ini is configured with ‘allow_url_include’ set to ‘on’. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP.	2023-12-23	9.8	CVE-2023-6971 security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the ‘content-backups’ and ‘content-name’, ‘content-manifest’, or ‘content-bmitmp’ and ‘content-identy’ HTTP headers. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.	2023-12-23	9.8	CVE-2023-6972 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange’s Google Authenticator – WordPress Two Factor Authentication – 2FA, Two Factor, OTP SMS and Email \| Passwordless login. This issue affects miniOrange’s Google Authenticator – WordPress Two Factor Authentication – 2FA, Two Factor, OTP SMS and Email \| Passwordless login: from n/a through 5.6.1.	2023-12-29	8.1	CVE-2022-44589 audit@patchstack.com
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in BinaryStash WP Booklet. This issue affects WP Booklet: from n/a through 2.1.8.	2023-12-29	8.5	CVE-2023-22677 audit@patchstack.com
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons. This issue affects Product Add-Ons: from n/a through 6.1.3.	2023-12-28	8.2	CVE-2023-32795 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in wpdevelop, oplugins Booking Manager. This issue affects Booking Manager: from n/a through 2.1.5.	2023-12-28	8.5	CVE-2023-50840 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin. This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.72.	2023-12-28	8.5	CVE-2023-50841 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Matthew Fries MF Gig Calendar. This issue affects MF Gig Calendar: from n/a through 1.2.1.	2023-12-28	8.5	CVE-2023-50842 audit@patchstack.com
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform. This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3.	2023-12-28	7.5	CVE-2023-32513 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in WebFactory Ltd Login Lockdown – Protect Login Form. This issue affects Login Lockdown – Protect Login Form: from n/a through 2.06.	2023-12-29	7.6	CVE-2023-50837 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more. This issue affects NEX-Forms – Ultimate Form Builder – Contact forms and much more: from n/a through 8.5.5.	2023-12-28	7.6	CVE-2023-50838 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Clockwork Clockwork SMS Notifications. This issue affects Clockwork SMS Notifications: from n/a through 3.0.4.	2023-12-28	7.6	CVE-2023-50843 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in James Ward Mail logging – WP Mail Catcher. This issue affects Mail logging – WP Mail Catcher: from n/a through 2.1.3.	2023-12-28	7.6	CVE-2023-50844 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in AyeCode – WordPress Business Directory Plugins GeoDirectory – WordPress Business Directory Plugin, or Classified Directory. This issue affects GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: from n/a through 2.3.28.	2023-12-28	7.6	CVE-2023-50845 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login. This issue affects RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: from n/a through 5.2.4.5.	2023-12-28	7.6	CVE-2023-50846 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Collne Inc. Welcart e-Commerce. This issue affects Welcart e-Commerce: from n/a through 2.9.3.	2023-12-28	7.6	CVE-2023-50847 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Aaron J 404 Solution. This issue affects 404 Solution: from n/a through 2.34.0.	2023-12-28	7.6	CVE-2023-50848 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress. This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.23.	2023-12-28	7.6	CVE-2023-50849 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in N Squared Appointment Booking Calendar – Simply Schedule Appointments Booking Plugin. This issue affects Appointment Booking Calendar – Simply Schedule Appointments Booking Plugin: from n/a before 1.6.6.1.	2023-12-28	7.6	CVE-2023-50851 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in StylemixThemes Booking Calendar \| Appointment Booking \| BookIt. This issue affects Booking Calendar \| Appointment Booking \| BookIt: from n/a through 2.4.3.	2023-12-28	7.6	CVE-2023-50852 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Nasirahmed Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms. This issue affects Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms: from n/a through 1.75.0.	2023-12-28	7.6	CVE-2023-50853 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Squirrly Squirrly SEO – Advanced Pack. This issue affects Squirrly SEO – Advanced Pack: from n/a through 2.3.8.	2023-12-28	7.6	CVE-2023-50854 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Sam Perrow Pre* Party Resource Hints. This issue affects Pre* Party Resource Hints: from n/a through 1.8.18.	2023-12-28	7.6	CVE-2023-50855 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in FunnelKit Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits. This issue affects Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits: from n/a through 2.14.3.	2023-12-28	7.6	CVE-2023-50856 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit. This issue affects Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: from n/a through 2.6.1.	2023-12-28	7.6	CVE-2023-50857 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in CodexThemes TheGem – Creative Multi-Purpose & WooCommerce WordPress Theme allows Reflected XSS. This issue affects TheGem – Creative Multi-Purpose & WooCommerce WordPress Theme: from n/a through 5.9.1.	2023-12-29	7.1	CVE-2023-50892 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in UpSolution Impreza – WordPress Website and WooCommerce Builder allows Reflected XSS. This issue affects Impreza – WordPress Website and WooCommerce Builder: from n/a through 8.17.4.	2023-12-29	7.1	CVE-2023-50893 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in HasThemes HT Mega – Absolute Addons For Elementor allows Reflected XSS. This issue affects HT Mega – Absolute Addons For Elementor: from n/a through 2.3.8.	2023-12-29	7.1	CVE-2023-50901 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Ian Kennerley Google Photos Gallery with Shortcodes allows Reflected XSS. This issue affects Google Photos Gallery with Shortcodes: from n/a through 4.0.2.	2023-12-29	7.1	CVE-2023-51373 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Undsgn Uncode – Creative & WooCommerce WordPress Theme allows Reflected XSS. This issue affects Uncode – Creative & WooCommerce WordPress Theme: from n/a through 2.8.6.	2023-12-28	7.1	CVE-2023-51501 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in WS Form WS Form LITE – Drag & Drop Contact Form Builder for WordPress. This issue affects WS Form LITE – Drag & Drop Contact Form Builder for WordPress: from n/a through 1.9.170.	2023-12-29	7.6	CVE-2023-52135 audit@patchstack.com
wordpress — wordpress	The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the ‘url’ parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system.	2023-12-23	7.2	CVE-2023-7002 security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com security@wordfence.com
yaztek_software_technologies_and_computer_systems — e-commerce_software	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Yaztek Software Technologies and Computer Systems E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-29	9.8	CVE-2023-4674 iletisim@usom.gov.tr

Medium Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
advplyr — audiobookshelf	Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF) vulnerability in Auth.js. This vulnerability has been addressed in version 2.7.0. There are no known workarounds for this vulnerability.	2023-12-27	4.3	CVE-2023-51665 security-advisories@github.com security-advisories@github.com
advplyr — audiobookshelf	Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF) vulnerability in `podcastUtils.js`. This vulnerability has been addressed in version 2.7.0. There are no known workarounds for this vulnerability.	2023-12-27	4.3	CVE-2023-51697 security-advisories@github.com security-advisories@github.com
aws — aws-sdk-php	AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the `buildEndpoint` method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The `buildEndpoint` method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.	2023-12-22	6	CVE-2023-51651 security-advisories@github.com security-advisories@github.com security-advisories@github.com
cacti — cacti	Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in `templates_import.php.` When uploading an xml template file, if the XML file does not pass the check, the server will give a JavaScript pop-up prompt, which contains unfiltered xml template file name, resulting in XSS. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. As of time of publication, no patched versions are available.	2023-12-22	6.1	CVE-2023-50250 security-advisories@github.com security-advisories@github.com
cacti — cacti	Reflected Cross Site Scripting (XSS) vulnerability in Cacti v1.2.25, allows remote attackers to escalate privileges when uploading an xml template file via templates_import.php.	2023-12-22	6.1	CVE-2023-50569 cve@mitre.org cve@mitre.org
cacti — cacti	Cacti is a robust performance and fault management framework and a frontend to RRDTool – a Time Series Database (TSDB). Bypassing an earlier fix (CVE-2023-39360) that leads to a DOM XSS attack. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `graphs_new.php`. Impact of the vulnerability – execution of arbitrary javascript code in the attacked user’s browser. This issue has been patched in version 1.2.26.	2023-12-22	5.4	CVE-2023-49086 security-advisories@github.com
cacti — cacti	Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration>Sites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://<HOST>/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.	2023-12-22	4.8	CVE-2023-49088 security-advisories@github.com security-advisories@github.com security-advisories@github.com
campcodes — chic_beauty_salon	A vulnerability classified as critical was found in Campcodes Chic Beauty Salon 20230703. Affected by this vulnerability is an unknown functionality of the file product-list.php of the component Product Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249157 was assigned to this vulnerability.	2023-12-29	4.7	CVE-2023-7150 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
campcodes — online_college_library_system	A vulnerability was found in Campcodes Online College Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/borrow_add.php of the component HTTP POST Request Handler. The manipulation of the argument student leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249362 is the identifier assigned to this vulnerability.	2023-12-30	4.7	CVE-2023-7175 cna@vuldb.com cna@vuldb.com cna@vuldb.com
campcodes — online_college_library_system	A vulnerability classified as critical has been found in Campcodes Online College Library System 1.0. This affects an unknown part of the file /admin/return_add.php of the component HTTP POST Request Handler. The manipulation of the argument student leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249363.	2023-12-30	4.7	CVE-2023-7176 cna@vuldb.com cna@vuldb.com cna@vuldb.com
campcodes — online_college_library_system	A vulnerability classified as critical was found in Campcodes Online College Library System 1.0. This vulnerability affects unknown code of the file /admin/book_add.php of the component HTTP POST Request Handler. The manipulation of the argument category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249364.	2023-12-30	4.7	CVE-2023-7177 cna@vuldb.com cna@vuldb.com cna@vuldb.com
campcodes — online_college_library_system	A vulnerability, which was classified as critical, has been found in Campcodes Online College Library System 1.0. This issue affects some unknown processing of the file /admin/book_row.php of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249365 was assigned to this vulnerability.	2023-12-30	4.7	CVE-2023-7178 cna@vuldb.com cna@vuldb.com cna@vuldb.com
campcodes — online_college_library_system	A vulnerability, which was classified as critical, was found in Campcodes Online College Library System 1.0. Affected is an unknown function of the file /admin/category_row.php of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249366 is the identifier assigned to this vulnerability.	2023-12-30	4.7	CVE-2023-7179 cna@vuldb.com cna@vuldb.com cna@vuldb.com
campcodes — online_college_library_system	A vulnerability was found in Muyun DedeBIZ up to 6.2.12 and classified as critical. Affected by this issue is some unknown functionality of the component Add Attachment Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249368. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-30	4.7	CVE-2023-7181 cna@vuldb.com cna@vuldb.com cna@vuldb.com
cloudflare — wrangler	Sending specially crafted HTTP requests and inspector messages to Wrangler’s dev server could result in any file on the user’s computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.	2023-12-29	6.4	CVE-2023-7079 cna@cloudflare.com cna@cloudflare.com cna@cloudflare.com
code-projects — automated_voting_system	A vulnerability classified as critical has been found in code-projects Automated Voting System 1.0. This affects an unknown part of the file /admin/ of the component Admin Login. The manipulation of the argument username leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249129 was assigned to this vulnerability.	2023-12-28	6.3	CVE-2023-7126 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — automated_voting_system	A vulnerability classified as critical was found in code-projects Automated Voting System 1.0. This vulnerability affects unknown code of the component Login. The manipulation of the argument idno leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-249130 is the identifier assigned to this vulnerability.	2023-12-28	6.3	CVE-2023-7127 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — automated_voting_system	A vulnerability, which was classified as critical, has been found in code-projects Voting System 1.0. This issue affects some unknown processing of the file /admin/ of the component Admin Login. The manipulation of the argument username leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249131.	2023-12-28	6.3	CVE-2023-7128 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — client_details_system	A vulnerability, which was classified as critical, has been found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the component HTTP POST Request Handler. The manipulation of the argument uemail leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249140.	2023-12-28	6.3	CVE-2023-7137 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — client_details_system	A vulnerability, which was classified as critical, was found in code-projects Client Details System 1.0. This affects an unknown part of the file /admin of the component HTTP POST Request Handler. The manipulation of the argument username leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249141 was assigned to this vulnerability.	2023-12-28	6.3	CVE-2023-7138 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — client_details_system	A vulnerability has been found in code-projects Client Details System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/regester.php of the component HTTP POST Request Handler. The manipulation of the argument fname/lname/email/contact leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-249142 is the identifier assigned to this vulnerability.	2023-12-28	4.3	CVE-2023-7139 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — client_details_system	A vulnerability was found in code-projects Client Details System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/manage-users.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249143.	2023-12-28	4.3	CVE-2023-7140 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — client_details_system	A vulnerability was found in code-projects Client Details System 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/update-clients.php. The manipulation of the argument uid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249144.	2023-12-29	4.3	CVE-2023-7141 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — client_details_system	A vulnerability was found in code-projects Client Details System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/clientview.php. The manipulation of the argument ID leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249145 was assigned to this vulnerability.	2023-12-29	4.3	CVE-2023-7142 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — e-commerce_site	A vulnerability, which was classified as problematic, was found in code-projects E-Commerce Site 1.0. Affected is an unknown function of the file search.php. The manipulation of the argument keyword with the input <video/src=x onerror=alert(document.cookie)> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249096.	2023-12-28	4.3	CVE-2023-7124 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — faculty_management_system	A vulnerability, which was classified as problematic, has been found in code-projects Faculty Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/pages/yearlevel.php. The manipulation of the argument Year Level/Section leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248744.	2023-12-22	6.1	CVE-2023-7057 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — faculty_management_system	A vulnerability classified as problematic was found in code-projects Faculty Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/pages/subjects.php. The manipulation of the argument Description/Units leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248743.	2023-12-22	5.4	CVE-2023-7056 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — intern_membership_management_system	A vulnerability was found in code-projects Intern Membership Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /user_registration/ of the component User Registration. The manipulation of the argument userName leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-249134 is the identifier assigned to this vulnerability.	2023-12-28	6.3	CVE-2023-7131 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — point_of_sales_and_inventory_management_system	A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /main/checkout.php. The manipulation of the argument pt leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248846 is the identifier assigned to this vulnerability.	2023-12-22	6.1	CVE-2023-7075 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — voting_system	A vulnerability, which was classified as critical, was found in code-projects Voting System 1.0. Affected is an unknown function of the component Voters Login. The manipulation of the argument voter leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249132.	2023-12-28	5.5	CVE-2023-7129 cna@vuldb.com cna@vuldb.com cna@vuldb.com
concrete_cms — concrete_cms	Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit. An attacker can force an admin user to delete server report logs on a web application to which they are currently authenticated.	2023-12-25	4.3	CVE-2023-48652 cve@mitre.org cve@mitre.org
dell — cpg_bios	Dell BIOS contains an Improper Input Validation vulnerability. A local malicious user with high privileges could potentially exploit this vulnerability in order to corrupt memory on the system.	2023-12-22	6.7	CVE-2023-39251 security_alert@emc.com
dfir-iris — iris-web	Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.3.7. The vulnerability may allow an attacker to inject malicious scripts into the application, which could then be executed when a user visits the affected locations. This could lead to unauthorized access, data theft, or other related malicious activities. An attacker need to be authenticated on the application to exploit this vulnerability. The issue is fixed in version v2.3.7 of iris-web. No known workarounds are available.	2023-12-22	4.6	CVE-2023-50712 security-advisories@github.com security-advisories@github.com
ffcss — ffcss	ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function `lookupPreprocess()` is meant to apply some transformations to a string by disabling characters in the regex `[-_ .]`. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex `[-_ .]`. The `lookupPreprocess()` can be easily bypassed with equivalent Unicode characters like U+FE4D (?), which would result in the omitted U+005F (_), for instance. The `lookupPreprocess()` function is only ever used to search for themes loosely (case insensitively, while ignoring dashes, underscores and dots), so the actual security impact is classified as low. This vulnerability is fixed in 0.2.0. There are no known workarounds.	2023-12-28	5.3	CVE-2023-52081 security-advisories@github.com security-advisories@github.com
gopeak — masterlab	A vulnerability classified as critical has been found in gopeak MasterLab up to 3.3.10. This affects the function sqlInject of the file app/ctrl/framework/Feature.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249147.	2023-12-29	6.3	CVE-2023-7144 cna@vuldb.com cna@vuldb.com cna@vuldb.com
gopeak — masterlab	A vulnerability classified as critical was found in gopeak MasterLab up to 3.3.10. This vulnerability affects the function sqlInject of the file app/ctrl/Framework.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249148.	2023-12-29	6.3	CVE-2023-7145 cna@vuldb.com cna@vuldb.com cna@vuldb.com
gopeak — masterlab	A vulnerability, which was classified as critical, has been found in gopeak MasterLab up to 3.3.10. This issue affects the function sqlInjectDelete of the file app/ctrl/framework/Feature.php of the component HTTP POST Request Handler. The manipulation of the argument phone leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249149 was assigned to this vulnerability.	2023-12-29	6.3	CVE-2023-7146 cna@vuldb.com cna@vuldb.com cna@vuldb.com
gopeak — masterlab	A vulnerability, which was classified as critical, was found in gopeak MasterLab up to 3.3.10. Affected is the function base64ImageContent of the file app/ctrl/User.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. VDB-249150 is the identifier assigned to this vulnerability.	2023-12-29	6.3	CVE-2023-7147 cna@vuldb.com cna@vuldb.com cna@vuldb.com
gopeak — masterlab	A vulnerability was found in gopeak MasterLab up to 3.3.10. It has been declared as critical. Affected by this vulnerability is the function add/update of the file app/ctrl/admin/User.php. The manipulation of the argument avatar leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249181 was assigned to this vulnerability.	2023-12-29	4.7	CVE-2023-7159 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
gradio — gradio	Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.	2023-12-22	5.6	CVE-2023-51449 security-advisories@github.com security-advisories@github.com security-advisories@github.com
hail — hail	Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect (OIDC) email addresses from ID tokens to verify the validity of a user’s domain, but because users have the ability to change their email address, they could create accounts and use resources in clusters that they should not have access to. For example, a user could create a Microsoft or Google account and then change their email to `test@example.org`. This account can then be used to create a Hail Batch account in Hail Batch clusters whose organization domain is `example.org`. The attacker is not able to access private data or impersonate another user, but they would have the ability to run jobs if Hail Batch billing projects are enabled and create Azure Tenants if they have Azure Active Directory Administrator access.	2023-12-29	5.3	CVE-2023-51663 security-advisories@github.com
hcl_software — hcl_launch	An HCL UrbanCode Deploy Agent installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts.	2023-12-28	6.2	CVE-2023-45702 psirt@hcl.com
hcl_software — hcl_launch	HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.	2023-12-28	4.3	CVE-2023-45701 psirt@hcl.com
honor — fri-an00	Some Honor products are affected by file writing vulnerability, successful exploitation could cause information disclosure.	2023-12-29	6.6	CVE-2023-23426 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — honorboardapp	Some Honor products are affected by information leak vulnerability; successful exploitation could cause the information leak.	2023-12-29	4	CVE-2023-23434 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — lge-an00	Some Honor products are affected by incorrect privilege assignment vulnerability; successful exploitation could cause device service exceptions.	2023-12-29	4	CVE-2023-23438 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — lge-an00	Some Honor products are affected by information leak vulnerability; successful exploitation could cause the information leak.	2023-12-29	4	CVE-2023-23439 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.	2023-12-29	6	CVE-2023-51429 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.	2023-12-29	4	CVE-2023-23427 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.	2023-12-29	4	CVE-2023-23429 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by type confusion vulnerability; successful exploitation could cause information leak.	2023-12-29	4.6	CVE-2023-23442 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by type confusion vulnerability; successful exploitation could cause information leak.	2023-12-29	4.6	CVE-2023-23443 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.	2023-12-29	4.6	CVE-2023-51426 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.	2023-12-29	4.6	CVE-2023-51427 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.	2023-12-29	4.6	CVE-2023-51428 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file to overwrite the correct system file.	2023-12-29	4	CVE-2023-23435 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_ui	Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.	2023-12-29	6	CVE-2023-23441 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_ui	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.	2023-12-29	4.4	CVE-2023-51430 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_ui	Some Honor products are affected by type confusion vulnerability, successful exploitation could cause denial of service.	2023-12-29	4	CVE-2023-6939 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — nth-an00	Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution	2023-12-29	6.5	CVE-2023-23424 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — nth-an00	Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file to overwrite the correct system file.	2023-12-29	4	CVE-2023-23433 3836d913-7555-4dd0-a509-f5667fdf5fe4
ibm — aix	IBM AIX 7.2 and 7.3 could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denial of service. IBM X-Force ID: 267963.	2023-12-22	5.5	CVE-2023-45165 psirt@us.ibm.com psirt@us.ibm.com
instipod — duouniversalkeycloakauthenticator	An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user login to Keycloak using DuoUniversalKeycloakAuthenticator plugin triggers this vulnerability.	2023-12-23	4.5	CVE-2023-49594 talos-cna@cisco.com talos-cna@cisco.com
kylinsoft — kylin-system-updater	A vulnerability classified as critical has been found in KylinSoft kylin-system-updater up to 2.0.5.16-0k2.33. Affected is an unknown function of the file /usr/share/kylin-system-updater/SystemUpdater/UpgradeStrategiesDbus.py of the component com.kylin.systemupgrade Service. The manipulation of the argument SetDownloadspeedMax leads to os command injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248940. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-25	5.3	CVE-2023-7093 cna@vuldb.com cna@vuldb.com cna@vuldb.com
mediawiki — mediawiki	An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group-*-member messages can result in XSS on Special:log/rights.	2023-12-22	6.1	CVE-2023-51704 cve@mitre.org
metersphere — metersphere	MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don’t belong to him if the resource ID is known. This issue if fixed in 2.10.10-lts. There are no known workarounds.	2023-12-28	4.3	CVE-2023-50267 security-advisories@github.com
micropython — micropython	A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.	2023-12-29	5.5	CVE-2023-7152 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
moxa — iologik_e1200	A weak cryptographic algorithm vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. This vulnerability can help an attacker compromise the confidentiality of sensitive data. This vulnerability may lead an attacker to get unexpected authorization.	2023-12-23	6.5	CVE-2023-5962 psirt@moxa.com
msgpackr — msgpackr	msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.	2023-12-28	6.8	CVE-2023-52079 security-advisories@github.com security-advisories@github.com
netentsec — ns-asg_application_security_gateway	A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected by this vulnerability is an unknown functionality of the file /protocol/nsasg6.0.tgz. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248941 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-25	5.3	CVE-2023-7094 cna@vuldb.com cna@vuldb.com cna@vuldb.com
nextcloud — nextcloud	The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be used without providing the 4-digit PIN code. Nextcloud iOS Files app should be upgraded to 4.9.2 to receive the patch. No known workarounds are available.	2023-12-22	4.3	CVE-2023-49790 security-advisories@github.com security-advisories@github.com security-advisories@github.com
nextcloud — server/enterprise_server	Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an active session of another user via another way, they could delete and modify workflows by sending calls directly to the API bypassing the password confirmation shown in the UI. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.	2023-12-22	5.4	CVE-2023-49791 security-advisories@github.com security-advisories@github.com security-advisories@github.com
nextcloud — server/enterprise_server	Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a (reverse) proxy is configured as trusted proxy the server could be tricked into reading a wrong remote address for an attacker, allowing them executing authentication attempts than intended. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.	2023-12-22	5.3	CVE-2023-49792 security-advisories@github.com security-advisories@github.com security-advisories@github.com
own_health_record — own_health_record	A vulnerability was found in MdAlAmin-aol Own Health Record 0.1-alpha/0.2-alpha/0.3-alpha/0.3.1-alpha. It has been rated as problematic. This issue affects some unknown processing of the file includes/logout.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 0.4-alpha is able to address this issue. The patch is named 58b413aa40820b49070782c786c526850ab7748f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249191.	2023-12-30	4.3	CVE-2018-25096 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
pandora_fms — pandora_fms	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). It was possible to execute malicious JS code on Visual Consoles. This issue affects Pandora FMS: from 700 through 774.	2023-12-29	6.1	CVE-2023-44089 security@pandorafms.com
pandora_fms — pandora_fms	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects Pandora FMS: from 700 through 774.	2023-12-29	5.9	CVE-2023-44088 security@pandorafms.com
pexip — pexip_infinity	Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links.	2023-12-25	6.1	CVE-2023-37225 cve@mitre.org
pexip — virtual_meeting_rooms	In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers’ installations, which allows authentication bypass.	2023-12-25	5.3	CVE-2023-40236 cve@mitre.org
phpgurukul — hospital_management_system	A vulnerability, which was classified as problematic, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file registration.php. The manipulation of the argument First Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249357 was assigned to this vulnerability.	2023-12-30	4.3	CVE-2023-7173 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
phpgurukul — online_notes_sharing_system	A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /user/add-notes.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248741 was assigned to this vulnerability.	2023-12-22	5.4	CVE-2023-7054 cna@vuldb.com cna@vuldb.com cna@vuldb.com
phpgurukul — online_notes_sharing_system	A vulnerability classified as problematic has been found in PHPGurukul Online Notes Sharing System 1.0. Affected is an unknown function of the file /user/profile.php of the component Contact Information Handler. The manipulation of the argument mobilenumber leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-248742 is the identifier assigned to this vulnerability.	2023-12-22	5.4	CVE-2023-7055 cna@vuldb.com cna@vuldb.com cna@vuldb.com
phpgurukul — online_notes_sharing_system	A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been classified as problematic. This affects an unknown part of the file /user/profile.php. The manipulation of the argument name leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248739.	2023-12-22	4.3	CVE-2023-7052 cna@vuldb.com cna@vuldb.com cna@vuldb.com
poly — multiple_products	A vulnerability classified as problematic was found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument Cookie leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249256.	2023-12-29	5.3	CVE-2023-4463 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
poly — trio_8800	A vulnerability was found in Poly Trio 8800 7.2.6.0019 and classified as critical. Affected by this issue is some unknown functionality of the component Test Automation Mode. The manipulation leads to backdoor. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249260.	2023-12-29	6.2	CVE-2023-4467 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
poly — trio_8800/trio_c60	A vulnerability was found in Poly Trio 8800 and Trio C60. It has been classified as problematic. This affects an unknown part of the component Poly Lens Management Cloud Registration. The manipulation leads to missing authorization. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier VDB-249261 was assigned to this vulnerability.	2023-12-29	4.3	CVE-2023-4468 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
pymedusa — medusa	Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF). The `testDiscord` request handler in `medusa/server/web/home/handler.py` does not validate the user-controlled `discord_webhook` variable and passes it to the `notifiers.discord_notifier.test_notify` method, then `_notify_discord` and finally `_send_discord_msg` method, which sends a POST request to the user-controlled URL on line 64 in `/medusa/notifiers/discord.py`, which leads to a blind server-side request forgery. This issue allows for crafting POST requests on behalf of the Medusa server. Version 1.0.19 contains a fix for the issue.	2023-12-22	5.3	CVE-2023-50258 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
pymedusa — medusa	Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF). The `testslack` request handler in `medusa/server/web/home/handler.py` does not validate the user-controlled `slack_webhook` variable and passes it to the `notifiers.slack_notifier.test_notify` method, then `_notify_slack` and finally `_send_slack` method, which sends a POST request to the user-controlled URL on line 103 in `/medusa/notifiers/slack.py`, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting POST requests on behalf of the Medusa server. Version 1.0.19 contains a fix for the issue.	2023-12-22	5.3	CVE-2023-50259 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
red_hat — multiple_products	A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.	2023-12-27	4.7	CVE-2023-4641 secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com
red_hat — multiple_products	A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.	2023-12-23	5.9	CVE-2023-7008 secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com
resque — resque	Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: “/failed/?class=<script>alert(document.cookie)</script>” and “/queues/><img src=a onerror=alert(document.cookie)>”. This issue has been patched in version 2.2.1.	2023-12-22	6.3	CVE-2023-50725 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
resque — resque	Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /”><svg%20onload=alert(domain)>. This issue has been patched in version 2.6.0.	2023-12-22	6.3	CVE-2023-50727 security-advisories@github.com security-advisories@github.com security-advisories@github.com
sentry — symbolicator	Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via Symbolicator’s API. In affected Sentry instances, the data could be exposed through the Sentry API and user interface if the attacker has a registered account. The issue has been fixed in Symbolicator release 23.12.1, Sentry self-hosted release 23.12.1, and has already been mitigated on sentry.io on December 18, 2023. If updating is not possible, some other mitigations are available. One may disable JS processing by toggling the option `Allow JavaScript Source Fetching` in `Organization Settings > Security & Privacy` and/or disable all untrusted public repositories under `Project Settings > Debug Files`. Alternatively, if JavaScript and native symbolication are not required, disable Symbolicator completely in `config.yml`.	2023-12-22	4.3	CVE-2023-51451 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
shifuml — shifu	A vulnerability has been found in ShifuML shifu 0.12.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file src/main/java/ml/shifu/shifu/core/DataPurifier.java of the component Java Expression Language Handler. The manipulation of the argument FilterExpression leads to code injection. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249151.	2023-12-29	5	CVE-2023-7148 cna@vuldb.com cna@vuldb.com cna@vuldb.com
snowflakedb — snowflake-connector-net	The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List (CRL) were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between 2.0.25 and 2.1.4 (inclusive). Snowflake fixed the issue in version 2.1.5.	2023-12-22	6	CVE-2023-51662 security-advisories@github.com security-advisories@github.com
sourcecodester — free_and_open_source_inventory_management_system	A vulnerability, which was classified as critical, was found in SourceCodester Free and Open Source Inventory Management System 1.0. This affects an unknown part of the file /ample/app/action/edit_product.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249177 was assigned to this vulnerability.	2023-12-29	6.3	CVE-2023-7155 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sourcecodester — free_and_open_source_inventory_management_system	A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /app/ajax/sell_return_data.php. The manipulation of the argument columns[0][data] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249179.	2023-12-29	6.3	CVE-2023-7157 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sourcecodester — medicine_tracking_system	A vulnerability, which was classified as critical, has been found in SourceCodester Medicine Tracking System 1.0. This issue affects some unknown processing of the file /classes/Master.php? f=save_medicine. The manipulation of the argument id/name/description leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249095.	2023-12-28	6.3	CVE-2023-7123 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sourcecodester — medicine_tracking_system	A vulnerability was found in SourceCodester Medicine Tracking System 1.0. It has been rated as critical. This issue affects some unknown processing. The manipulation of the argument page leads to path traversal: ‘../filedir’. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249137 was assigned to this vulnerability.	2023-12-28	6.3	CVE-2023-7134 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sourcecodester — school_visitor_log_e-book	A vulnerability was found in SourceCodester School Visitor Log e-Book 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file log-book.php. The manipulation of the argument Full Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248750 is the identifier assigned to this vulnerability.	2023-12-22	5.4	CVE-2023-7059 cna@vuldb.com cna@vuldb.com cna@vuldb.com
sqlite — sqlite3	A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.	2023-12-29	5.5	CVE-2023-7104 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
sudo — sudo	A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.	2023-12-23	6.6	CVE-2023-7090 secalert@redhat.com secalert@redhat.com secalert@redhat.com
talent_software — ecop	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Talent Software ECOP allows Reflected XSS. This issue affects ECOP: before 32255.	2023-12-28	6.1	CVE-2023-4672 iletisim@usom.gov.tr
tongda — office_anywhere	A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file general/project/proj/delete.php. The manipulation of the argument PROJ_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249367. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-30	5.5	CVE-2023-7180 cna@vuldb.com cna@vuldb.com cna@vuldb.com
uniway — uw-302vp	A vulnerability was found in Uniway UW-302VP 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /boaform/wlan_basic_set.cgi of the component Admin Web Interface. The manipulation of the argument wlanssid/password leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248939. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-24	4.3	CVE-2023-7092 cna@vuldb.com cna@vuldb.com cna@vuldb.com
weiye-jing — datax-web	A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the file /api/log/killJob of the component HTTP POST Request Handler. The manipulation of the argument processId leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249086 is the identifier assigned to this vulnerability.	2023-12-27	6.3	CVE-2023-7116 cna@vuldb.com cna@vuldb.com cna@vuldb.com
wordpress — wordpress	The Widget Settings Importer/Exporter Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp_ajax_import_widget_dataparameter AJAX action in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with subscriber-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-12-23	5.4	CVE-2020-36769 security@wordfence.com security@wordfence.com
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in Gesundheit Bewegt GmbH Zippy. This issue affects Zippy: from n/a through 1.6.5.	2023-12-28	6.6	CVE-2023-36381 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Themeum WP Crowdfunding allows Stored XSS. This issue affects WP Crowdfunding: from n/a through 2.1.6.	2023-12-28	6.5	CVE-2023-50859 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in TMS Booking for Appointments and Events Calendar – Amelia allows Stored XSS. This issue affects Booking for Appointments and Events Calendar – Amelia: from n/a through 1.0.85.	2023-12-28	6.5	CVE-2023-50860 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Darren Cooney WordPress Infinite Scroll – Ajax Load More allows Stored XSS. This issue affects WordPress Infinite Scroll – Ajax Load More: from n/a through 6.1.0.1.	2023-12-28	6.5	CVE-2023-50874 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Automattic WordPress.Com Editing Toolkit allows Stored XSS. This issue affects WordPress.Com Editing Toolkit: from n/a through 3.78784.	2023-12-29	6.5	CVE-2023-50879 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in The BuddyPress Community BuddyPress allows Stored XSS. This issue affects BuddyPress: from n/a through 11.3.1.	2023-12-29	6.5	CVE-2023-50880 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS. This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.15.	2023-12-29	6.5	CVE-2023-50881 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in The Beaver Builder Team Beaver Builder – WordPress Page Builder allows Stored XSS. This issue affects Beaver Builder – WordPress Page Builder: from n/a through 2.7.2.	2023-12-29	6.5	CVE-2023-50889 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Zoho Forms Form plugin for WordPress – Zoho Forms allows Stored XSS. This issue affects Form plugin for WordPress – Zoho Forms: from n/a through 3.0.1.	2023-12-29	6.5	CVE-2023-50891 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Brizy.Io Brizy – Page Builder allows Stored XSS. This issue affects Brizy – Page Builder: from n/a through 2.4.29.	2023-12-29	6.5	CVE-2023-51396 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Brainstorm Force WP Remote Site Search allows Stored XSS. This issue affects WP Remote Site Search: from n/a through 1.0.4.	2023-12-29	6.5	CVE-2023-51397 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in WPFactory Back Button Widget allows Stored XSS. This issue affects Back Button Widget: from n/a through 1.6.3.	2023-12-29	6.5	CVE-2023-51399 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Aleksandar Uroševi? Stock Ticker allows Stored XSS. This issue affects Stock Ticker: from n/a through 3.23.4.	2023-12-29	6.5	CVE-2023-51541 audit@patchstack.com
wordpress — wordpress	Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile-BankID-Integration is affected by a vulnerability classified as a Deserialization of Untrusted Data vulnerability, specifically impacting scenarios where an attacker can manipulate the database. If unauthorized actors gain access to the database, they could exploit this vulnerability to execute object injection attacks. This could lead to unauthorized code execution, data manipulation, or data exfiltration within the WordPress environment. Users of the plugin should upgrade to version 1.0.1 (or later), where the serialization and deserialization of OrderResponse objects have been switched out to an array stored as JSON. A possible workaround for users unable to upgrade immediately is to enforce stricter access controls on the database, ensuring that only trusted and authorized entities can modify data. Additionally, implementing monitoring tools to detect unusual database activities could help identify and mitigate potential exploitation attempts.	2023-12-27	6.4	CVE-2023-51700 security-advisories@github.com security-advisories@github.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked – Appointment Booking for WordPress \| Calendars. This issue affects Booked – Appointment Booking for WordPress \| Calendars: from n/a before 2.4.4.	2023-12-28	5.3	CVE-2022-36399 audit@patchstack.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc. This issue affects WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: from n/a through 6.0.4.	2023-12-28	5.3	CVE-2023-27447 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in ibericode HTML Forms allows Stored XSS. This issue affects HTML Forms: from n/a through 1.3.28.	2023-12-28	5.9	CVE-2023-50836 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan. This issue affects Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: from n/a through 4.34.	2023-12-28	5.4	CVE-2023-50858 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in InspireUI MStore API. This issue affects MStore API: from n/a through 4.10.1.	2023-12-29	5.4	CVE-2023-50878 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in weForms weForms – Easy Drag & Drop Contact Form Builder For WordPress allows Stored XSS. This issue affects weForms – Easy Drag & Drop Contact Form Builder For WordPress: from n/a through 1.6.17.	2023-12-29	5.9	CVE-2023-50896 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Bright Plugins Block IPs for Gravity Forms. This issue affects Block IPs for Gravity Forms: from n/a through 1.0.1.	2023-12-29	5.4	CVE-2023-51358 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Ginger Plugins Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button allows Stored XSS. This issue affects Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button: from n/a through 1.1.8.	2023-12-29	5.9	CVE-2023-51361 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Bit Assist Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget allows Stored XSS. This issue affects Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget: from n/a through 1.1.9.	2023-12-29	5.9	CVE-2023-51371 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in HasThemes HashBar – WordPress Notification Bar allows Stored XSS. This issue affects HashBar – WordPress Notification Bar: from n/a through 1.4.1.	2023-12-29	5.9	CVE-2023-51372 audit@patchstack.com
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in ZeroBounce ZeroBounce Email Verification & Validation allows Stored XSS. This issue affects ZeroBounce Email Verification & Validation: from n/a through 1.0.11.	2023-12-29	5.9	CVE-2023-51374 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Rise Themes Rise Blocks – A Complete Gutenberg Page Builder. This issue affects Rise Blocks – A Complete Gutenberg Page Builder: from n/a through 3.1.	2023-12-29	5.4	CVE-2023-51378 audit@patchstack.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4. This issue affects AI Power: Complete AI Pack – Powered by GPT-4: from n/a through 1.8.2.	2023-12-29	5.3	CVE-2023-51527 audit@patchstack.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode Product Catalog Simple. This issue affects Product Catalog Simple: from n/a through 1.7.6.	2023-12-29	5.3	CVE-2023-51687 audit@patchstack.com
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress. This issue affects eCommerce Product Catalog Plugin for WordPress: from n/a through 3.3.26.	2023-12-29	5.3	CVE-2023-51688 audit@patchstack.com
wordpress — wordpress	The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘et_pb_text’ shortcode in all versions up to, and including, 4.23.1 due to insufficient input sanitization and output escaping on user supplied custom field data. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-12-23	5.4	CVE-2023-6744 security@wordfence.com security@wordfence.com
wordpress — wordpress	A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.04 on WordPress. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 2.06 is able to address this issue. The patch is named 68af950330c3202a706f0ae9bbb52ceaa17dda9d. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248955.	2023-12-26	4.3	CVE-2012-10017 cna@vuldb.com cna@vuldb.com cna@vuldb.com
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms. This issue affects Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.2.8.	2023-12-29	4.7	CVE-2023-31095 audit@patchstack.com
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in WP Directory Kit. This issue affects WP Directory Kit: from n/a through 1.1.9.	2023-12-29	4.7	CVE-2023-31229 audit@patchstack.com
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in Dylan James Zephyr Project Manager. This issue affects Zephyr Project Manager: from n/a through 3.3.9.	2023-12-29	4.7	CVE-2023-31237 audit@patchstack.com
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in Pexle Chris Library Viewer. This issue affects Library Viewer: from n/a through 2.0.6.	2023-12-29	4.7	CVE-2023-32101 audit@patchstack.com
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in PluginOps MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder. This issue affects MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder: from n/a through 4.0.9.3.	2023-12-29	4.7	CVE-2023-32517 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Add Any Extension to Pages. This issue affects Add Any Extension to Pages: from n/a through 1.4.	2023-12-28	4.3	CVE-2023-50873 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve. This issue affects New User Approve: from n/a through 2.5.1.	2023-12-29	4.3	CVE-2023-50902 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in WebbaPlugins Appointment & Event Booking Calendar Plugin – Webba Booking. This issue affects Appointment & Event Booking Calendar Plugin – Webba Booking: from n/a through 4.5.33.	2023-12-29	4.3	CVE-2023-51354 audit@patchstack.com
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Brain Storm Force Ultimate Addons for WPBakery Page Builder. This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through 3.19.17.	2023-12-29	4.3	CVE-2023-51402 audit@patchstack.com
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in CodePeople Calculated Fields Form. This issue affects Calculated Fields Form: from n/a through 1.2.28.	2023-12-29	4.1	CVE-2023-51517 audit@patchstack.com
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More. This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.	2023-12-29	4.7	CVE-2023-51675 audit@patchstack.com
wordpress — wordpress	Server-Side Request Forgery (SSRF) vulnerability in Leevio Happy Addons for Elementor. This issue affects Happy Addons for Elementor: from n/a through 3.9.1.1.	2023-12-29	4.9	CVE-2023-51676 audit@patchstack.com
y_project — ruoyi	A vulnerability was found in y_project RuoYi 4.7.8. It has been declared as problematic. This vulnerability affects unknown code of the file /login of the component HTTP POST Request Handler. The manipulation of the argument rememberMe with the input falsen3f0m<script>alert(1)</script>p86o0 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249136.	2023-12-28	4.3	CVE-2023-7133 cna@vuldb.com cna@vuldb.com cna@vuldb.com
yiisoft — yii2-authclient	yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.	2023-12-22	6.1	CVE-2023-50708 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
yiisoft — yii2-authclient	yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be removed after usage (similar to `authState`). Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.	2023-12-22	6.8	CVE-2023-50714 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
ìzmir_katip_çelebi_university — university_information_management_system	Improper Input Validation vulnerability in İzmir Katip Çelebi University University Information Management System allows Absolute Path Traversal. This issue affects University Information Management System: before 30.11.2023.	2023-12-27	6.5	CVE-2023-6190 iletisim@usom.gov.tr

Low Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
bestwebsoft — portfolio_plugin	A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.27. It has been declared as problematic. This vulnerability affects the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 2.28 is able to address this issue. The name of the patch is d2ede580474665af56ff262a05783fbabe4529b8. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248956.	2023-12-26	3.5	CVE-2014-125109 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — client_details_system	A vulnerability was found in code-projects Client Details System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/regester.php. The manipulation of the argument fname/lname/email/contact leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249146 is the identifier assigned to this vulnerability.	2023-12-29	2.4	CVE-2023-7143 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — intern_membership_management_system	A vulnerability was found in code-projects Intern Membership Management System 2.0. It has been classified as problematic. This affects an unknown part of the file /user_registration/ of the component User Registration. The manipulation of the argument userName/firstName/lastName/userEmail with the input “><ScRiPt>confirm(document.domain)</ScRiPt>h0la leads to cross site scripting. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249135.	2023-12-28	3.5	CVE-2023-7132 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — qr_code_generator	A vulnerability was found in code-projects QR Code Generator 1.0. It has been classified as problematic. This affects an unknown part of the file /download.php?file=author.png. The manipulation of the argument file with the input “><iMg src=N onerror=alert(document.domain)> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249153 was assigned to this vulnerability.	2023-12-29	3.5	CVE-2023-7149 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — record_management_system	A vulnerability classified as problematic has been found in code-projects Record Management System 1.0. Affected is an unknown function of the file /main/offices.php of the component Offices Handler. The manipulation of the argument officename with the input “><script src=”https://js.rip/b23tmbxf49”></script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249138 is the identifier assigned to this vulnerability.	2023-12-28	2.4	CVE-2023-7135 cna@vuldb.com cna@vuldb.com cna@vuldb.com
code-projects — record_management_system	A vulnerability classified as problematic was found in code-projects Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /main/doctype.php of the component Document Type Handler. The manipulation of the argument docname with the input “><script src=”https://js.rip/b23tmbxf49”></script> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249139.	2023-12-28	2.4	CVE-2023-7136 cna@vuldb.com cna@vuldb.com cna@vuldb.com
honor — com.hihonor.magichome	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.	2023-12-29	3.3	CVE-2023-23430 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — com.hihonor.vmall	Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak	2023-12-29	3.3	CVE-2023-23437 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — lge-an00	Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.	2023-12-29	3.3	CVE-2023-23440 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.	2023-12-29	3.3	CVE-2023-23428 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_ui	Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.	2023-12-29	3.2	CVE-2023-51432 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_ui	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.	2023-12-29	2.9	CVE-2023-51433 3836d913-7555-4dd0-a509-f5667fdf5fe4
mattermost — mattermost	Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.	2023-12-29	3.7	CVE-2023-7113 responsibledisclosure@mattermost.com
myaac — myaac	A vulnerability was found in slawkens MyAAC up to 0.8.13. It has been declared as problematic. This vulnerability affects unknown code of the file system/pages/bugtracker.php. The manipulation of the argument bug[2][‘subject’]/bug[2][‘text’]/report[‘subject’] leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.8.14 is able to address this issue. The name of the patch is 83a91ec540072d319dd338abff45f8d5ebf48190. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248848.	2023-12-22	3.5	CVE-2023-7076 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
nautobot — nautobot	Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0	2023-12-22	3.5	CVE-2023-51649 security-advisories@github.com security-advisories@github.com security-advisories@github.com security-advisories@github.com
nextcloud — nextcloud/cloud	Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar app is upgraded to 4.5.3	2023-12-22	3.5	CVE-2023-48308 security-advisories@github.com security-advisories@github.com
novel-plus — novel-plus	A vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0. This affects an unknown part of the file /user/updateUserInfo of the component HTTP POST Request Handler. The manipulation of the argument nickName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c62da9bb3a9b3603014d0edb436146512631100d. It is recommended to apply a patch to fix this issue. The identifier VDB-249201 was assigned to this vulnerability.	2023-12-29	3.5	CVE-2023-7166 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
novel-plus — novel-plus	A vulnerability was found in Novel-Plus up to 4.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file novel-admin/src/main/java/com/java2nb/novel/controller/FriendLinkController.java of the component Friendly Link Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named d6093d8182362422370d7eaf6c53afde9ee45215. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-249307.	2023-12-29	2.4	CVE-2023-7171 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
pandora_fms — pandora_fms	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Allows you to edit the Web Console user notification options. This issue affects Pandora FMS: from 700 through 774.	2023-12-29	3	CVE-2023-41813 security@pandorafms.com
pandora_fms — pandora_fms	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Through an HTML payload (iframe tag) it is possible to carry out XSS attacks when the user receiving the messages opens their notifications. This issue affects Pandora FMS: from 700 through 774.	2023-12-29	3.7	CVE-2023-41814 security@pandorafms.com
poly — multiple_products	A vulnerability classified as problematic has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This affects an unknown part of the component Web Configuration Application. The manipulation leads to insufficiently random values. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249255.	2023-12-29	3.7	CVE-2023-4462 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
poly — multiple_products	A vulnerability, which was classified as problematic, was found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. Affected is an unknown function of the component Configuration File Import. The manipulation of the argument device.auth.localAdminPassword leads to unverified password change. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249258 is the identifier assigned to this vulnerability.	2023-12-29	2.7	CVE-2023-4465 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
poly — multiple_products	A vulnerability has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation leads to protection mechanism failure. The attack can be launched remotely. The vendor explains that they do not regard this as a vulnerability as this is a feature that they offer to their customers who have a variety of environmental needs that are met through different firmware builds. To avoid potential roll-back attacks, they remove vulnerable builds from the public servers as a remediation effort. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249259.	2023-12-29	2.7	CVE-2023-4466 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com
sourcecodester — engineers_online_portal	A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Add Engineer Handler. The manipulation of the argument first name/last name with the input <script>alert(0)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249182 is the identifier assigned to this vulnerability.	2023-12-29	2.4	CVE-2023-7160 cna@vuldb.com cna@vuldb.com
w3c — online-spellchecker-py	A vulnerability was found in w3c online-spellchecker-py up to 20140130. It has been rated as problematic. This issue affects some unknown processing of the file spellchecker. The manipulation leads to cross site scripting. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The identifier of the patch is d6c21fd8187c5db2a50425ff80694149e75d722e. It is recommended to apply a patch to fix this issue. The identifier VDB-248849 was assigned to this vulnerability.	2023-12-23	3.1	CVE-2014-125108 cna@vuldb.com cna@vuldb.com cna@vuldb.com
winter_cms — winter_cms	Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.	2023-12-29	3.3	CVE-2023-52085 security-advisories@github.com security-advisories@github.com
winter_cms — winter_cms	Winter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not on renaming, which could have allowed a stored XSS attack. This issue has been patched in v1.2.4.	2023-12-28	2	CVE-2023-52083 security-advisories@github.com security-advisories@github.com
winter_cms — winter_cms	Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. This issue has been patched in v1.2.4.	2023-12-28	2	CVE-2023-52084 security-advisories@github.com security-advisories@github.com
wordpress — wordpress	A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.14 is able to address this issue. The patch is identified as 1274afc635170daafd38306487b6bb8a01f78ecd. It is recommended to upgrade the affected component. VDB-248954 is the identifier assigned to this vulnerability.	2023-12-26	3.5	CVE-2015-10127 cna@vuldb.com cna@vuldb.com cna@vuldb.com
wordpress — wordpress	Missing Authorization vulnerability in Anders Thorborg. This issue affects Anders Thorborg: from n/a through 1.4.12.	2023-12-29	3.1	CVE-2023-22676 audit@patchstack.com
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection. This issue affects Solid Security – Password, Two Factor Authentication, and Brute Force Protection: from n/a through 8.1.4.	2023-12-29	3.7	CVE-2023-28786 audit@patchstack.com

Severity Not Yet Assigned

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
3cx — 3cx	The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address.	2023-12-25	not yet calculated	CVE-2023-49954 cve@mitre.org
alfasado_inc. — powercms	PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user’s web browser. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.	2023-12-26	not yet calculated	CVE-2023-49117 vultures@jpcert.or.jp vultures@jpcert.or.jp
alfasado_inc. — powercms	Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.	2023-12-26	not yet calculated	CVE-2023-50297 vultures@jpcert.or.jp vultures@jpcert.or.jp
apache — dolphinscheduler	Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue.	2023-12-30	not yet calculated	CVE-2023-49299 security@apache.org security@apache.org
apache — ofbiz	Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.	2023-12-26	not yet calculated	CVE-2023-50968 security@apache.org security@apache.org security@apache.org security@apache.org security@apache.org security@apache.org
apache — ofbiz	The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)	2023-12-26	not yet calculated	CVE-2023-51467 security@apache.org security@apache.org security@apache.org security@apache.org security@apache.org security@apache.org security@apache.org
apache — openoffice	Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution. This is a corner case of CVE-2022-47502.	2023-12-29	not yet calculated	CVE-2023-47804 security@apache.org security@apache.org
array — arrayos_ag	MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets. AG and vxAG 9.3.0.259.x are unaffected.	2023-12-22	not yet calculated	CVE-2023-51707 cve@mitre.org
arris_solutions,_inc. — dg860a/dg1670a	Arris DG860A and DG1670A devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. (They use the first 6 characters of the SSID and the last 6 characters of the BSSID, decrementing the last digit.)	2023-12-27	not yet calculated	CVE-2023-40038 cve@mitre.org cve@mitre.org
artistscope — artisbrowser	An issue in ArtistScope ArtisBrowser v.34.1.5 and before allows an attacker to bypass intended access restrictions via interaction with the com.artis.browser.IntentReceiverActivity component.	2023-12-27	not yet calculated	CVE-2023-49000 cve@mitre.org cve@mitre.org
asp.net_zero — asp.net_zero	An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims to any URL via the ‘<meta http-equiv=”refresh”‘ in the WebSocket messages.	2023-12-26	not yet calculated	CVE-2023-48003 cve@mitre.org cve@mitre.org
barracuda_networks_inc. — barracuda_esg_appliance	Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection. This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.	2023-12-24	not yet calculated	CVE-2023-7102 mandiant-cve@google.com mandiant-cve@google.com mandiant-cve@google.com mandiant-cve@google.com mandiant-cve@google.com mandiant-cve@google.com
bees_blog — bees_blog	The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing_url is mishandled.	2023-12-30	not yet calculated	CVE-2023-52264 cve@mitre.org cve@mitre.org cve@mitre.org
bentley_systems — assetwise_integrity_information_server	Bentley eB System Management Console applications within Assetwise Integrity Information Server allow an unauthenticated user to view configuration options via a crafted request, leading to information disclosure. This affects eB System management Console before 23.00.02.03 and Assetwise ALIM For Transportation before 23.00.01.25.	2023-12-22	not yet calculated	CVE-2023-51708 cve@mitre.org
beyondtrust_corporation — privilege_management_for_windows	The Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local administrators to bypass this feature by decrypting the shared key, or by locating the decrypted shared key in process memory. The threat is mitigated by the Agent Protection feature.	2023-12-25	not yet calculated	CVE-2023-49944 cve@mitre.org cve@mitre.org
brave_browser — brave_browser	Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect. This is related to browser/brave_content_browser_client.cc and browser/ui/webui/brave_web_ui_controller_factory.cc.	2023-12-30	not yet calculated	CVE-2023-52263 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
brother_industries,_ltd. — iprint&scan_desktop_for_windows	Improper link resolution before file access (‘Link Following’) issue exists in iPrint&Scan Desktop for Windows versions 11.0.0 and earlier. A symlink attack by a malicious user may cause a Denial-of-service (DoS) condition on the PC.	2023-12-26	not yet calculated	CVE-2023-51654 vultures@jpcert.or.jp
buffalo_inc. — vr-s1000	VR-S1000 firmware Ver. 2.37 and earlier allows an attacker with access to the product’s web management page to execute arbitrary OS commands.	2023-12-26	not yet calculated	CVE-2023-45741 vultures@jpcert.or.jp vultures@jpcert.or.jp
buffalo_inc. — vr-s1000	Improper neutralization of argument delimiters in a command (‘Argument Injection’) vulnerability in VR-S1000 firmware Ver. 2.37 and earlier allows an authenticated attacker who can access to the product’s command line interface to execute an arbitrary command.	2023-12-26	not yet calculated	CVE-2023-46681 vultures@jpcert.or.jp vultures@jpcert.or.jp
buffalo_inc. — vr-s1000	VR-S1000 firmware Ver. 2.37 and earlier uses a hard-coded cryptographic key which may allow an attacker to analyze the password of a specific product user.	2023-12-26	not yet calculated	CVE-2023-46711 vultures@jpcert.or.jp vultures@jpcert.or.jp
buffalo_inc. — vr-s1000	VR-S1000 firmware Ver. 2.37 and earlier allows a network-adjacent unauthenticated attacker who can access the product’s web management page to obtain sensitive information.	2023-12-26	not yet calculated	CVE-2023-51363 vultures@jpcert.or.jp vultures@jpcert.or.jp
buildkite — elastic_ci_for_aws	A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.	2023-12-22	not yet calculated	CVE-2023-43116 cve@mitre.org
buildkite — elastic_ci_for_aws	A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.	2023-12-22	not yet calculated	CVE-2023-43741 cve@mitre.org
com.sdjictec.qdmetro — com.sdjictec.qdmetro	An issue in the export component AdSdkH5Activity of com.sdjictec.qdmetro v4.2.2 allows attackers to open a crafted URL without any filtering or checking.	2023-12-28	not yet calculated	CVE-2023-51010 cve@mitre.org
documize_inc. — documize	SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint.	2023-12-29	not yet calculated	CVE-2023-23634 cve@mitre.org
easy-rules-mvel — easy-rules-mvel	easy-rules-mvel v4.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component MVELRule.	2023-12-29	not yet calculated	CVE-2023-50571 cve@mitre.org
exim — exim	Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not.	2023-12-24	not yet calculated	CVE-2023-51766 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
filerun — filerun	FileRun 20220519 allows SQL Injection via the “dir” parameter in a /?module=users&section=cpanel&page=list request.	2023-12-22	not yet calculated	CVE-2022-47532 cve@mitre.org
flask-security-too — flask-security-too	An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.	2023-12-26	not yet calculated	CVE-2023-49438 cve@mitre.org cve@mitre.org
follet_learning_solutions — destiny_suite	A Cross Site Scripting (XSS) vulnerability exists in Follet Learning Solutions Destiny through 20.0_1U. via the handlewpesearchform.do. searchString.	2023-12-25	not yet calculated	CVE-2023-38826 cve@mitre.org cve@mitre.org
fortanix — enclaveos_confidential_computing_manager	An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.32 for Intel SGX. Lack of pointer-alignment validation logic in entry functions allows a local attacker to access unauthorized information. This relates to the enclave_ecall function and system call layer.	2023-12-30	not yet calculated	CVE-2023-38021 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
fortanix — enclaveos_confidential_computing_manager	An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.29 for Intel SGX. Insufficient pointer validation allows a local attacker to access unauthorized information. This relates to strlen and sgx_is_within_user.	2023-12-30	not yet calculated	CVE-2023-38022 cve@mitre.org cve@mitre.org
free5gc — free5gc	An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AMF component via crafted NGAP message.	2023-12-22	not yet calculated	CVE-2023-49391 cve@mitre.org
gl.inet — multiple_products	Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the get_system_log and get_crash_log functions of the logread module, as well as the upgrade_online function of the upgrade module.	2023-12-28	not yet calculated	CVE-2023-50445 cve@mitre.org
grupo_embras — geosiap_erp	Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page.	2023-12-30	not yet calculated	CVE-2023-50589 cve@mitre.org cve@mitre.org cve@mitre.org
hutool-core — hutool-core	hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. This vulnerability allows attackers to cause a Denial of Service (DoS) via manipulation of the first two parameters.	2023-12-27	not yet calculated	CVE-2023-51075 cve@mitre.org
hutool-core — hutool-core	The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow.	2023-12-27	not yet calculated	CVE-2023-51080 cve@mitre.org
hyavijava — hyavijava	hyavijava v6.0.07.1 was discovered to contain a stack overflow via the ResultConverter.convert2Xml method.	2023-12-27	not yet calculated	CVE-2023-51084 cve@mitre.org
idurar-erp-crm — idurar-erp-crm	IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data.	2023-12-30	not yet calculated	CVE-2023-52265 cve@mitre.org cve@mitre.org
ilias_e-learning — ilias_e-learning	The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user via a malicious BPMN2 workflow definition file.	2023-12-25	not yet calculated	CVE-2023-36485 cve@mitre.org cve@mitre.org cve@mitre.org
ilias_e-learning — ilias_e-learning	The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user by uploading a workflow definition file with a malicious filename.	2023-12-25	not yet calculated	CVE-2023-36486 cve@mitre.org cve@mitre.org cve@mitre.org
indi_browser/kvbrowser — indi_browser/kvbrowser	An issue in Indi Browser (aka kvbrowser) v.12.11.23 allows an attacker to bypass intended access restrictions via interaction with the com.example.gurry.kvbrowswer.webview component.	2023-12-27	not yet calculated	CVE-2023-49001 cve@mitre.org cve@mitre.org
ipaddressbitsdivision — ipaddressbitsdivision	An issue in the component IPAddressBitsDivision of IPAddress v5.1.0 leads to an infinite loop.	2023-12-29	not yet calculated	CVE-2023-50570 cve@mitre.org
jamf_pro_server — jamf_pro_server	There is broken access control during authentication in Jamf Pro Server before 10.46.1.	2023-12-25	not yet calculated	CVE-2023-31224 cve@mitre.org
jeecgboot — jeecgboot	SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.	2023-12-30	not yet calculated	CVE-2023-41542 cve@mitre.org
jeecgboot — jeecgboot	SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicate/check.	2023-12-30	not yet calculated	CVE-2023-41543 cve@mitre.org cve@mitre.org
jeecgboot — jeecgboot	SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.	2023-12-30	not yet calculated	CVE-2023-41544 cve@mitre.org
jizhicms — jizhicms	File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parameter in the app/admin/exts/ directory.	2023-12-28	not yet calculated	CVE-2023-50692 cve@mitre.org
jline-groovy — jline-groovy	An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM (OutofMemory) error.	2023-12-29	not yet calculated	CVE-2023-50572 cve@mitre.org
json-path — json-path	json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.	2023-12-27	not yet calculated	CVE-2023-51074 cve@mitre.org
kami_vision — yi_iot	The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to execute arbitrary JavaScript code via an implicit intent to the com.ants360.yicamera.activity.WebViewActivity component.	2023-12-27	not yet calculated	CVE-2023-47882 cve@mitre.org cve@mitre.org
kantega_sso — kantega_saml	The Kantega SAML SSO OIDC Kerberos Single Sign-on apps before 6.20.0 for Atlassian products allow XSS if SAML POST Binding is enabled. This affects 4.4.2 through 4.14.8 before 4.14.9, 5.0.0 through 5.11.4 before 5.11.5, and 6.0.0 through 6.19.0 before 6.20.0. The full product names are Kantega SAML SSO OIDC Kerberos Single Sign-on for Jira Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Confluence Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Bitbucket Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Bamboo Data Center & Server (Kantega SSO Enterprise), and Kantega SAML SSO OIDC Kerberos Single Sign-on for FeCru Server (Kantega SSO Enterprise). (Here, FeCru refers to the Atlassian Fisheye and Crucible products running together.)	2023-12-29	not yet calculated	CVE-2023-52240 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
layui — layui	layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.	2023-12-30	not yet calculated	CVE-2023-50550 cve@mitre.org
little_backup_box — little_backup_box	outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input.	2023-12-30	not yet calculated	CVE-2023-52262 cve@mitre.org cve@mitre.org
logobee — logobee	LogoBee 0.2 allows updates.php?id= XSS.	2023-12-30	not yet calculated	CVE-2023-52257 cve@mitre.org
microhttpserver — microhttpserver	In MicroHttpServer (aka Micro HTTP Server) through a8ab029, _ParseHeader in lib/server.c allows a one-byte recv buffer overflow via a long URI.	2023-12-25	not yet calculated	CVE-2023-51771 cve@mitre.org cve@mitre.org
mingsoft — mcms	Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.	2023-12-30	not yet calculated	CVE-2023-50578 cve@mitre.org
multiple_vendors — multiple_products	Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3 server. An attacked device calculates an SHA-2 hash over at least 65 KB (in RAM). With a large number of crafted TLS messages, the CPU becomes heavily loaded. This occurs in tls13VerifyBinder and tls13TranscriptHashUpdate.	2023-12-22	not yet calculated	CVE-2023-24609 cve@mitre.org cve@mitre.org
mupdf — mupdf	A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in functon fz_new_pixmap_from_float_data() of pixmap.c.	2023-12-26	not yet calculated	CVE-2023-51103 cve@mitre.org
mupdf — mupdf	A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in functon pnm_binary_read_image() of load-pnm.c line 527.	2023-12-26	not yet calculated	CVE-2023-51104 cve@mitre.org
mupdf — mupdf	A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in function bmp_decompress_rle4() of load-bmp.c.	2023-12-26	not yet calculated	CVE-2023-51105 cve@mitre.org
mupdf — mupdf	A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in functon pnm_binary_read_image() of load-pnm.c.	2023-12-26	not yet calculated	CVE-2023-51106 cve@mitre.org
mupdf — mupdf	A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in functon compute_color() of jquant2.c.	2023-12-26	not yet calculated	CVE-2023-51107 cve@mitre.org
mupnp_for_c — mupnp_for_c	mupnp/net/uri.c in mUPnP for C through 3.0.2 has an out-of-bounds read and application crash because it lacks a certain host length recalculation.	2023-12-28	not yet calculated	CVE-2023-52152 cve@mitre.org
mvel2 — mvel2	A TimeOut error exists in the ParseTools.subCompileExpression method in mvel2 v2.5.0 Final.	2023-12-27	not yet calculated	CVE-2023-51079 cve@mitre.org
ncp_engineering_inc. — secure_enterprise_client	Support Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL files with SYSTEM privileges by creating a symbolic link from a %LOCALAPPDATA%TempNcpSupport* location.	2023-12-25	not yet calculated	CVE-2023-28872 cve@mitre.org
nokia — nfm-t_r19.9	In NOKIA NFM-T R19.9, an OS Command Injection vulnerability occurs in /cgi-bin/R19.9/log.pl of the VM Manager WebUI via the cmd HTTP GET parameter. This allows authenticated users to execute commands, with root privileges, on the operating system.	2023-12-25	not yet calculated	CVE-2022-39818 cve@mitre.org
nokia — nfm-t_r19.9	In Network Element Manager in NOKIA NFM-T R19.9, an Unprotected Storage of Credentials vulnerability occurs under /root/RestUploadManager.xml.DRC and /DEPOT/KECustom_199/OTNE_DRC/RestUploadManager.xml. A remote user, authenticated to the operating system, with access privileges to the directory /root or /DEPOT, is able to read cleartext credentials to access the web portal NFM-T and control all the PPS Network elements.	2023-12-25	not yet calculated	CVE-2022-39820 cve@mitre.org
nokia — nfm-t_r19.9	In NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in /cgi-bin/R19.9/easy1350.pl of the VM Manager WebUI via the id or host HTTP GET parameter. An authenticated attacker is required for exploitation.	2023-12-25	not yet calculated	CVE-2022-39822 cve@mitre.org
nokia — nfm-t_r19.9	An issue was discovered in NOKIA NFM-T R19.9. Relative Path Traversal can occur under /oms1350/data/cpb/log of the Network Element Manager via the filename parameter, allowing a remote authenticated attacker to read arbitrary files.	2023-12-25	not yet calculated	CVE-2022-41760 cve@mitre.org
nokia — nfm-t_r19.9	An issue was discovered in NOKIA NFM-T R19.9. An Absolute Path Traversal vulnerability exists under /cgi-bin/R19.9/viewlog.pl of the VM Manager WebUI via the logfile parameter, allowing a remote authenticated attacker to read arbitrary files.	2023-12-25	not yet calculated	CVE-2022-41761 cve@mitre.org
nokia — nfm-t_r19.9	An issue was discovered in NOKIA NFM-T R19.9. Multiple Reflected XSS vulnerabilities exist in the Network Element Manager via any parameter to log.pl, the bench or pid parameter to top.pl, or the id parameter to easy1350.pl.	2023-12-25	not yet calculated	CVE-2022-41762 cve@mitre.org
nokia — nfm-t_r19.9	An issue was discovered in NOKIA NFM-T R19.9. Reflected XSS in the Network Element Manager exists via /oms1350/pages/otn/cpbLogDisplay via the filename parameter, under /oms1350/pages/otn/connection/E2ERoutingDisplayWithOverLay via the id parameter, and under /oms1350/pages/otn/mainOtn via all parameters.	2023-12-25	not yet calculated	CVE-2022-43675 cve@mitre.org
ocpp-jaxb — ocpp-jaxb	SteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (such as when an application receives a StartTransaction Open Charge Point Protocol message with a timestamp parameter of 1000000). This may lead to a SQL exception in applications and may undermine the integrity of transaction records.	2023-12-26	not yet calculated	CVE-2023-52096 cve@mitre.org cve@mitre.org cve@mitre.org
one_identity — password_manager	One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: go to the Google ReCAPTCHA section, click on the Privacy link, observe that there is a new browser window, navigate to any website that offers file upload, navigate to cmd.exe from the file explorer window, and launch cmd.exe as NT AUTHORITYSYSTEM.	2023-12-25	not yet calculated	CVE-2023-48654 cve@mitre.org cve@mitre.org
one_identity — password_manager	One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: wait for a session timeout, click on the Help icon, observe that there is a browser window for the One Identity website, navigate to any website that offers file upload, navigate to cmd.exe from the file explorer window, and launch cmd.exe as NT AUTHORITYSYSTEM.	2023-12-25	not yet calculated	CVE-2023-51772 cve@mitre.org cve@mitre.org
opencrx — opencrx	openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.	2023-12-26	not yet calculated	CVE-2023-27150 cve@mitre.org cve@mitre.org
opennds — opennds	OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference, daemon crash, and Captive Portal outage) via a GET request to /opennds_auth/ that lacks a custom query string parameter and client-token.	2023-12-25	not yet calculated	CVE-2023-38321 cve@mitre.org cve@mitre.org cve@mitre.org
openssh — openssh	OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges.	2023-12-24	not yet calculated	CVE-2023-51767 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
passwork — passwork	Passwork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes.	2023-12-26	not yet calculated	CVE-2023-49949 cve@mitre.org cve@mitre.org
peplink — balance_two	An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root.	2023-12-25	not yet calculated	CVE-2023-49226 cve@mitre.org cve@mitre.org
peplink — balance_two	An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical access and sufficient knowledge to execute arbitrary commands as root.	2023-12-28	not yet calculated	CVE-2023-49228 cve@mitre.org cve@mitre.org
peplink — balance_two	An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only unprivileged users to obtain sensitive information about the device configuration.	2023-12-28	not yet calculated	CVE-2023-49229 cve@mitre.org cve@mitre.org
peplink — balance_two	An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals’ configurations without prior authentication.	2023-12-28	not yet calculated	CVE-2023-49230 cve@mitre.org cve@mitre.org
perl_spreadsheet::parseexcel — perl_spreadsheet::parseexcel	Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.	2023-12-24	not yet calculated	CVE-2023-7101 mandiant-cve@google.com mandiant-cve@google.com mandiant-cve@google.com mandiant-cve@google.com mandiant-cve@google.com mandiant-cve@google.com mandiant-cve@google.com
phpgurukul — small_crm	PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection on the Users login panel because of “password” parameter is directly used in the SQL query without any sanitization and the SQL Injection payload being executed.	2023-12-29	not yet calculated	CVE-2023-50035 cve@mitre.org
postfix — postfix	Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required: the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.	2023-12-24	not yet calculated	CVE-2023-51764 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
prestashop — prestashop	SQL Injection vulnerability in the Innovadeluxe Quick Order module for PrestaShop before v.1.4.0, allows local attackers to execute arbitrary code via the getProducts() function in the productlist.php file.	2023-12-28	not yet calculated	CVE-2023-46989 cve@mitre.org
proftpd — proftpd	make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backslash semantics.	2023-12-22	not yet calculated	CVE-2023-51713 cve@mitre.org cve@mitre.org cve@mitre.org
qt — qt	An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.	2023-12-24	not yet calculated	CVE-2023-51714 cve@mitre.org cve@mitre.org
resumable_js — resumable_js	resumable.php (aka PHP backend for resumable.js) 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data content to upload.php. (File overwrite hasn’t been possible with the code available in GitHub in recent years, however.)	2023-12-26	not yet calculated	CVE-2023-52086 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
ruby_on_rails — ruby_on_rails	In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belongs to another user) by making CSV export requests at certain specific times.	2023-12-28	not yet calculated	CVE-2023-50448 cve@mitre.org cve@mitre.org
ruby_on_rails — ruby_on_rails	csv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.	2023-12-24	not yet calculated	CVE-2023-51763 cve@mitre.org cve@mitre.org cve@mitre.org
rws — worldserver	An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint.	2023-12-25	not yet calculated	CVE-2022-34267 cve@mitre.org cve@mitre.org
rws — worldserver	An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the host.	2023-12-25	not yet calculated	CVE-2022-34268 cve@mitre.org cve@mitre.org
scone — scone	A lack of pointer-validation logic in the __scone_dispatch component of SCONE before v5.8.0 for Intel SGX allows attackers to access sensitive information.	2023-12-30	not yet calculated	CVE-2022-46486 cve@mitre.org cve@mitre.org cve@mitre.org
scone — scone	Improper initialization of x87 and SSE floating-point configuration registers in the __scone_entry component of SCONE before 5.8.0 for Intel SGX allows a local attacker to compromise the execution integrity of floating-point operations in an enclave or access sensitive information via side-channel analysis.	2023-12-30	not yet calculated	CVE-2022-46487 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
scone — scone	An issue was discovered in SCONE Confidential Computing Platform before 5.8.0 for Intel SGX. Lack of pointer-alignment logic in __scone_dispatch and other entry functions allows a local attacker to access unauthorized information, aka an “AEPIC Leak.”	2023-12-30	not yet calculated	CVE-2023-38023 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
seacms — seacms	SeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the component /augap/adminip.php.	2023-12-28	not yet calculated	CVE-2023-46987 cve@mitre.org cve@mitre.org cve@mitre.org
seacms — seacms	A cross-site scripting (XSS) vulnerability in the component admin_ Video.php of SeaCMS v12.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.	2023-12-28	not yet calculated	CVE-2023-50470 cve@mitre.org cve@mitre.org cve@mitre.org
sendmail — sendmail	sendmail through at least 8.14.7 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports <LF>.<CR><LF> but some other popular e-mail servers do not.	2023-12-24	not yet calculated	CVE-2023-51765 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
sesami_io — sesami_io	An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows local attackers to obtain sensitive information and bypass authentication via “Back Button Refresh” attack.	2023-12-29	not yet calculated	CVE-2023-31292 cve@mitre.org
sesami_io — sesami_io	An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to obtain sensitive information and bypass profile restriction via improper access control in the Reader system user’s web browser, allowing the journal to be displayed, despite the option being disabled.	2023-12-29	not yet calculated	CVE-2023-31293 cve@mitre.org
sesami_io — sesami_io	CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via the Delivery Name field.	2023-12-29	not yet calculated	CVE-2023-31294 cve@mitre.org
sesami_io — sesami_io	CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via the User Profile field.	2023-12-29	not yet calculated	CVE-2023-31295 cve@mitre.org
sesami_io — sesami_io	CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows attackers to obtain sensitive information via the User Name field.	2023-12-29	not yet calculated	CVE-2023-31296 cve@mitre.org
sesami_io — sesami_io	An issue was discovered in SESAMI planfocus CPTO (Cash Point & Transport Optimizer) 6.3.8.6 718. There is XSS via the Name field when modifying a client.	2023-12-25	not yet calculated	CVE-2023-31297 cve@mitre.org cve@mitre.org
sesami_io — sesami_io	Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code and obtain sensitive information via the User ID field when creating a new system user.	2023-12-29	not yet calculated	CVE-2023-31298 cve@mitre.org
sesami_io — sesami_io	Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code via the Barcode field of a container.	2023-12-29	not yet calculated	CVE-2023-31299 cve@mitre.org
sesami_io — sesami_io	An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via transmission of unencrypted, cleartext credentials during Password Reset feature.	2023-12-29	not yet calculated	CVE-2023-31300 cve@mitre.org
sesami_io — sesami_io	Stored Cross Site Scripting (XSS) Vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code and obtain sensitive information via the Username field of the login form and application log.	2023-12-29	not yet calculated	CVE-2023-31301 cve@mitre.org
sesami_io — sesami_io	Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to execute arbitrary code via the Teller field.	2023-12-29	not yet calculated	CVE-2023-31302 cve@mitre.org
shaarli — shaarli	Reflected Cross Site Scripting (XSS) vulnerability in Shaarli v0.12.2, allows remote attackers to execute arbitrary code via search tag function.	2023-12-28	not yet calculated	CVE-2023-49469 cve@mitre.org cve@mitre.org
shenzhen_tcl_new_technology_co.,_limited — tv_web_browser	An issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022_dab24cc6_231221_gp allows a remote attacker to execute arbitrary JavaScript code via the com.tcl.browser.portal.browse.activity.BrowsePageActivity component.	2023-12-27	not yet calculated	CVE-2023-43481 cve@mitre.org
simple_http_server/simple_http_server_plus — simple_http_server/simple_http_server_plus	Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a hardcoded aKySWb2jjrr4dzkYXczKRt7K encryption key. The threat is from a man-in-the-middle attacker who can intercept and potentially modify data during transmission.	2023-12-27	not yet calculated	CVE-2023-46919 cve@mitre.org
simple_http_server_plus — simple_http_server_plus	Phlox com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus has an Android manifest file that contains an entry with the android:allowBackup attribute set to true. This could be leveraged by an attacker with physical access to the device.	2023-12-27	not yet calculated	CVE-2023-46918 cve@mitre.org
simplemobiletools — simple_dialer	An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simplemobiletools.dialer.activities.DialerActivity.	2023-12-27	not yet calculated	CVE-2023-49003 cve@mitre.org cve@mitre.org
sourcecodester — customer_support_system	Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_ticket via department_id, customer_id, and subject.	2023-12-29	not yet calculated	CVE-2023-50070 cve@mitre.org cve@mitre.org
sourcecodester — customer_support_system	Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_department via id or name.	2023-12-29	not yet calculated	CVE-2023-50071 cve@mitre.org cve@mitre.org
stormshield_network_security — stormshield_network_security	An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such passwords in cleartext, and potentially sends these logs to the Syslog component.	2023-12-26	not yet calculated	CVE-2023-28616 cve@mitre.org
stormshield_network_security — stormshield_network_security	An issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 through 4.7.1 before 4.7.2. An attacker can overflow the cookie threshold, making an IPsec connection impossible.	2023-12-25	not yet calculated	CVE-2023-47091 cve@mitre.org cve@mitre.org
sudo — sudo	Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.	2023-12-22	not yet calculated	CVE-2023-42465 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
sysaid_on-premise — sysaid_on-premise	In SysAid On-Premise before 23.3.34, there is an edge case in which an end user is able to delete a Knowledge Base article, aka bug 15102.	2023-12-25	not yet calculated	CVE-2023-47247 cve@mitre.org
testlink — testlink	TestLink through 1.9.20 allows type juggling for authentication bypass because === is not used.	2023-12-30	not yet calculated	CVE-2023-50110 cve@mitre.org
textpattern_cms — textpattern_cms	There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions.	2023-12-28	not yet calculated	CVE-2023-50038 cve@mitre.org cve@mitre.org
thirty_bees — thirty_bees	A stored cross-site scripting (XSS) vulnerability in the component admin/AdminRequestSqlController.php of thirty bees before 1.5.0 allows attackers to execute arbitrary web script or HTML via $e->getMessage() error mishandling.	2023-12-22	not yet calculated	CVE-2023-45957 cve@mitre.org cve@mitre.org cve@mitre.org
totolink — ex1200l	TOTOlink EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution via the cstecgi.cgi UploadFirmwareFile interface.	2023-12-22	not yet calculated	CVE-2023-51034 cve@mitre.org
totolink — ex1200l	TOTOLINK EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution on the cstecgi.cgi NTPSyncWithHost interface.	2023-12-22	not yet calculated	CVE-2023-51035 cve@mitre.org
totolink — x2000r_gh	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRoute.	2023-12-30	not yet calculated	CVE-2023-51133 cve@mitre.org cve@mitre.org
totolink — x2000r_gh	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPasswordSetup.	2023-12-30	not yet calculated	CVE-2023-51135 cve@mitre.org cve@mitre.org
totolink — x2000r_gh	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRebootSchedule.	2023-12-30	not yet calculated	CVE-2023-51136 cve@mitre.org cve@mitre.org
totolink — x6000r	TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi.	2023-12-30	not yet calculated	CVE-2023-50651 cve@mitre.org cve@mitre.org
tp-link — tapo	Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext.	2023-12-28	not yet calculated	CVE-2023-34829 cve@mitre.org
tv_bro_application — tv_bro_application	The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary code, create arbitrary files. and perform arbitrary downloads via JavaScript that uses takeBlobDownloadData.	2023-12-27	not yet calculated	CVE-2023-43955 cve@mitre.org cve@mitre.org cve@mitre.org cve@mitre.org
tv_browser_application_for_android — tv_browser_application_for_android	The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an explicit intent due to an exposed MainActivity.	2023-12-27	not yet calculated	CVE-2023-47883 cve@mitre.org cve@mitre.org cve@mitre.org
typo3 — typo3	In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].	2023-12-25	not yet calculated	CVE-2023-30451 cve@mitre.org
unified_remote — unified_remote	Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint.	2023-12-30	not yet calculated	CVE-2023-52252 cve@mitre.org cve@mitre.org
weseek,_inc. — growi	Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-42436 vultures@jpcert.or.jp vultures@jpcert.or.jp
weseek,_inc. — growi	Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior to v3.5.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-45737 vultures@jpcert.or.jp vultures@jpcert.or.jp
weseek,_inc. — growi	Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-45740 vultures@jpcert.or.jp vultures@jpcert.or.jp
weseek,_inc. — growi	Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user’s intention.	2023-12-26	not yet calculated	CVE-2023-46699 vultures@jpcert.or.jp vultures@jpcert.or.jp
weseek,_inc. — growi	Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-47215 vultures@jpcert.or.jp vultures@jpcert.or.jp
weseek,_inc. — growi	Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-49119 vultures@jpcert.or.jp vultures@jpcert.or.jp
weseek,_inc. — growi	Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-49598 vultures@jpcert.or.jp vultures@jpcert.or.jp
weseek,_inc. — growi	Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-49779 vultures@jpcert.or.jp vultures@jpcert.or.jp
weseek,_inc. — growi	Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-49807 vultures@jpcert.or.jp vultures@jpcert.or.jp
weseek,_inc. — growi	Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/customize) page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-50175 vultures@jpcert.or.jp vultures@jpcert.or.jp
weseek,_inc. — growi	The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page.	2023-12-26	not yet calculated	CVE-2023-50294 vultures@jpcert.or.jp vultures@jpcert.or.jp
weseek,_inc. — growi	Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a user may delete or suspend its own account without the user’s intention.	2023-12-26	not yet calculated	CVE-2023-50332 vultures@jpcert.or.jp vultures@jpcert.or.jp
weseek,_inc. — growi	Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-50339 vultures@jpcert.or.jp vultures@jpcert.or.jp
wiremock — wiremock	WireMock with GUI versions 3.2.0.0 through 3.0.4.0 are vulnerable to stored cross-site scripting (SXSS) through the recording feature. An attacker can host a malicious payload and perform a test mapping pointing to the attacker’s file, and the result will render on the Matched page in the Body area, resulting in the execution of the payload. This occurs because the response body is not validated or sanitized.	2023-12-29	not yet calculated	CVE-2023-50069 cve@mitre.org
wolters_kluwer — b.point	On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve remote code execution via Argument Injection in the server-to-server module.	2023-12-25	not yet calculated	CVE-2023-49328 cve@mitre.org
wordpress — wordpress	The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.	2023-12-26	not yet calculated	CVE-2023-5203 contact@wpscan.com
wordpress — wordpress	The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.	2023-12-26	not yet calculated	CVE-2023-5644 contact@wpscan.com
wordpress — wordpress	The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.	2023-12-26	not yet calculated	CVE-2023-5645 contact@wpscan.com
wordpress — wordpress	The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files.	2023-12-26	not yet calculated	CVE-2023-5672 contact@wpscan.com
wordpress — wordpress	The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution.	2023-12-26	not yet calculated	CVE-2023-5673 contact@wpscan.com
wordpress — wordpress	The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.	2023-12-26	not yet calculated	CVE-2023-5674 contact@wpscan.com
wordpress — wordpress	The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow attackers with a low-privilege account (e.g. subscribers) to upload arbitrary files such as PHP on the server.	2023-12-26	not yet calculated	CVE-2023-5931 contact@wpscan.com
wordpress — wordpress	The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, leading to remote code execution by privileged users.	2023-12-26	not yet calculated	CVE-2023-5939 contact@wpscan.com
wordpress — wordpress	The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	2023-12-26	not yet calculated	CVE-2023-5980 contact@wpscan.com
wordpress — wordpress	The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorization checks, allowing unauthenticated users to download and delete arbitrary files on the server.	2023-12-26	not yet calculated	CVE-2023-5991 contact@wpscan.com
wordpress — wordpress	The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.	2023-12-26	not yet calculated	CVE-2023-6114 contact@wpscan.com contact@wpscan.com
wordpress — wordpress	The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacker to perform a search for users of the system, ultimately leaking user email addresses.	2023-12-26	not yet calculated	CVE-2023-6155 contact@wpscan.com
wordpress — wordpress	The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting	2023-12-26	not yet calculated	CVE-2023-6166 contact@wpscan.com
wordpress — wordpress	The BestWebSoft’s Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag	2023-12-26	not yet calculated	CVE-2023-6250 contact@wpscan.com
wordpress — wordpress	The JSON Content Importer WordPress plugin before 1.5.4 does not sanitize and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin	2023-12-26	not yet calculated	CVE-2023-6268 contact@wpscan.com
xenom_technologies — phone_dialer-voice_call_dialer	An issue in Xenom Technologies (sinous) Phone Dialer-voice Call Dialer v.1.2.5 allows an attacker to bypass intended access restrictions via interaction with com.funprime.calldialer.ui.activities.OutgoingActivity.	2023-12-27	not yet calculated	CVE-2023-49002 cve@mitre.org cve@mitre.org
xiangshan — xiangshan	An issue was discovered in XiangShan v2.1, allows local attackers to obtain sensitive information via the L1D cache.	2023-12-30	not yet calculated	CVE-2023-50559 cve@mitre.org cve@mitre.org
xnview — classic_for_windows	XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3ADBD0.	2023-12-29	not yet calculated	CVE-2023-52173 cve@mitre.org cve@mitre.org
xnview — classic_for_windows	XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3125D6.	2023-12-29	not yet calculated	CVE-2023-52174 cve@mitre.org cve@mitre.org
youloft_holding_group_co. — perpetual_calendar	An issue in the openFile method of Chinese Perpetual Calendar v9.0.0 allows attackers to read any file via unspecified vectors.	2023-12-28	not yet calculated	CVE-2023-51006 cve@mitre.org
zzcms — zzcms	ZZCMS 2023 has a file upload vulnerability in 3/E_bak5.1/upload/index.php, allowing attackers to exploit this loophole to gain server privileges and execute arbitrary code.	2023-12-29	not yet calculated	CVE-2023-50104 cve@mitre.org

Managed Security Services

Cyber Threat Intelligence

iDNA

SiON

About Us

Leadership

Advisors

Cyber Security Assessment

SOC Cost Calculator

Request a Dark Web Report

Cyber Security Threat Alerts

What is Incident Response?

SOC 2 Compliance

Cyber Security Definitions and Terminology

Cyber Security Jobs

Blog

Podcast

Instagram

LinkedIn

Twitter

High Vulnerabilities

Medium Vulnerabilities

Low Vulnerabilities

Severity Not Yet Assigned

Medium Vulnerabilities

Low Vulnerabilities

Severity Not Yet Assigned

Medium Vulnerabilities

Low Vulnerabilities

Severity Not Yet Assigned

Company

Our services

Resources

Partners

Cyber news

Weekly Newsletter

Subscribe to our weekly newsletter on cyber news and best practices!