Archive
February 2023
Vulnerabilities first published in this month (UTC), newest first.
2,189 results · Feed
-
Medium 5.9
IBM Db2 for Linux, UNIX and Windows information disclosure
IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due to improper privilege management when a specially crafted table access is used. IBM X-Force ID: 241671.
-
High 8.8
Improper Authorization
The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality.
-
Medium 6.2
IBM InfoSphere Information Server information disclosure
IBM InfoSphere Information Server 11.7 could allow a local user to obtain sensitive information from a log files. IBM X-Force ID: 246463.
-
Medium 6.5
IBM Security Verify Access HOST header injection
IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable s…
-
Medium 5.4
IBM Aspera Faspex cross-site scripting
IBM Aspera Faspex 4.4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IB…
-
Critical 9.8
IBM Aspera Faspex code execution
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to e…
KEV Feb 21, 2023 -
Medium 5.4
WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions (create, duplicate, edit, delete).
-
Medium 4.3
WordPress Extensions For CF7 Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Extensions For CF7 plugin <= 2.0.8 versions leads to arbitrary plugin activation.
-
Medium 5.5
Use after free in io_uring in the Linux Kernel
Due to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the user process. timens_install calls current_is_single_threaded to determine if the current process is single-threaded, but this call does not consider io_…
-
High 7.0
phjounin TFTPD64-SE tftpd64_svc.exe unquoted search path
A vulnerability was found in phjounin TFTPD64-SE 4.64 and classified as critical. This issue affects some unknown processing of the file tftpd64_svc.exe. The manipulation leads to unquoted search path. An attack has to be approached locally. The complexity of…
-
Medium 6.3
SourceCodester Online Pizza Ordering System index.php sql injection
A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file /php-opos/index.php. The manipulation of the argument ID leads to sql injection. The attack can b…
-
High 8.8
Authorization Bypass Through User-Controlled Key on Single Connect
Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Kron Tech Single Connect on Windows allows Privilege Abuse. This issue affects Single Connect: 2.16.
-
Medium 5.9
Dell Secure Connect Gateway (SCG) version 5.14.00.12 contains a broken cryptographic algorithm vulnerability. A remote …
-
Critical 9.8
SQL Injection vulnerability in Projectworlds Online Doctor Appointment Booking System, allows attackers to gain sensiti…
-
High 7.0
An issue in MPV v.0.29.1 fixed in v0.30 allows attackers to execute arbitrary code and crash program via the ao_c param…
-
Medium 6.3
Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver
Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.12.
-
Medium 6.1
Cross-site Scripting (XSS) - Generic in nuxt/framework
Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to 3.2.1.
-
High 8.3
Misinterpretation of Input in thorsten/phpmyfaq
Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
-
Critical 9.1
Code Injection in froxlor/froxlor
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.
-
Medium 5.5CVE-2023-0482 Public exploit
Insecure Temporary File in RESTEasy
In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.
-
Critical 9.8
LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/DeptM…
-
Critical 9.8
LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/UserM…
-
High 8.8
Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the …
-
Critical 9.8
LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/RoleM…
-
Medium 6.1
A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML vi…
-
Medium 5.4
Stored cross site scripting in changedetection.io
Changedetection.io before v0.40.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the main page. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL paramete…
-
Medium 5.5
An issue in Giorgio Tani peazip v.9.0.0 allows attackers to cause a denial of service via the End of Archive tag functi…
-
High 7.5
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by suppl…
-
Medium 6.1
Moodle: reflected xss risk in some returnurl parameters
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's…
-
High 7.2
An issue was discovered in ESPCMS P8.21120101 after logging in to the background, there is a SQL injection vulnerabilit…
-
Critical 9.8
TOTOLINK A720R V4.1.5cu.532_ B20210610 is vulnerable to Incorrect Access Control.
-
Critical 9.8CVE-2023-23279 Public exploit
Canteen Management System 1.0 is vulnerable to SQL Injection via /php_action/getOrderReport.php.
-
High 8.2
Moodle: possible to set the preferred "start page" of other users
The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise res…
-
Medium 6.1
Moodle: reflected xss risk in blog search
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in blog search. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in co…
-
High 7.8
Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a vi…
-
Medium 5.5
Adobe Bridge Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploi…
-
High 7.8
Adobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
FrameMaker 2020 Update 4 (and earlier), 2022 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a vi…
-
High 7.8
Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a vi…
-
High 7.8
Adobe FrameMaker Improper Input Validation Remote Code Execution Vulnerability
FrameMaker 2020 Update 4 (and earlier), 2022 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in tha…
-
Medium 5.5
Adobe Photoshop Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of…