Archive
January 2023
Vulnerabilities first published in this month (UTC), newest first.
2,382 results · Feed
-
Unscored —
Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments…
-
Unscored —
app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field.
-
High 7.8
Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within t…
-
High 8.8
TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflo…
-
Unscored —
TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflo…
-
Unscored —
TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflo…
-
High 8.8
TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflo…
-
High 8.8
An arbitrary file upload vulnerability in the /api/upload component of zdir v3.2.0 allows attackers to execute arbitrar…
-
Critical 9.8CVE-2023-23560 EPSS 14%
In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
High 8.3
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
-
Medium 6.5
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
-
High 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Medium 4.3
IzyBat Orange casiers before 20221102_1 allows SQL Injection via a getCasier.php?taille= URI.
-
High 7.5
Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency.
-
High 7.5CVE-2022-38725 Public exploit
An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a…
-
Medium 5.5
processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of si…
-
Medium 4.3
Path Traversal in github.com/go-sonic/sonic
An issue in the component /admin/backups/work-dir of Sonic v1.0.4 allows attackers to execute a directory traversal.
-
High 7.5
A vulnerability in the descarga_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a direct…
-
Medium 5.4
Cross-Site Scripting (XSS) vulnerability found in Rawchen blog-ssm v1.0 allows attackers to execute arbitrary code via …
-
High 8.7
Host Boot ROM Code Vulnerability in Systems Implementing UFS Boot Feature
Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. …
-
Medium 6.4
An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by …
-
High 8.8
A Cross-Site Request Forgery (CSRF) in the management portal of JetNexus/EdgeNexus ADC 4.2.8 allows attackers to escala…
-
High 8.8
The management portal component of JetNexus/EdgeNexus ADC 4.2.8 was discovered to contain a command injection vulnerabi…
-
High 8.8
TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflo…
-
Medium 5.3
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can all…
-
High 8.1
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor servi…
-
High 7.5
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the docum…
-
Medium 6.1
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the docum…
-
High 7.5
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be …
-
Critical 9.8
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the…
-
Medium 5.4
Improper Input Validation in pyload/pyload
Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
-
Medium 4.0
Excessive Attack Surface in pyload/pyload
Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.
-
High 7.3CVE-2023-24059 Public exploit
Grand Theft Auto V for PC allows attackers to achieve partial remote code execution or modify files on a PC, as exploit…
-
Medium 6.1CVE-2023-24044 Public exploit
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to…
-
Unscored —CVE-2023-24055 Public exploit
KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file…
-
Medium 4.3
Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userI…
-
Medium 5.5
In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgco…
-
Critical 9.8
Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Ai…
-
Unscored —
`kuchiki` is unmaintained
The `kuchiki` repo was marked as archived in [this](https://github.com/kuchiki-rs/kuchiki/commit/f92e4c047fdc30619555da282ac7ccce1d313aa6) commit. ## Possible Alternatives Possible alternatives may include: - [kuchikiki](https://crates.io/crates/kuchikiki) - …