10 March 2023

69 results · Feed

• Medium 5.4
  CVE-2023-1318 Scanner template

  Cross-site Scripting (XSS) - Generic in osticket/osticket

  Cross-site Scripting (XSS) - Generic in GitHub repository osticket/osticket prior to v1.16.6.

  osTicket osticket/osticket
  Mar 10, 2023
• Medium 5.4
  CVE-2023-1315 Scanner template

  Cross-site Scripting (XSS) - Reflected in osticket/osticket

  Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.

  osTicket osticket/osticket
  Mar 10, 2023
• Critical 9.8
  CVE-2023-1307

  Authentication Bypass by Primary Weakness in froxlor/froxlor

  Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.

  froxlor froxlor/froxlor froxlor/froxlor Packagist
  Mar 10, 2023
• High 8.8
  CVE-2023-1205

  NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 is vulnerable to cross-site request forgery attacks on all endpoints…

  Mar 10, 2023
• High 7.2
  CVE-2023-1313

  Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit

  Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1.

  cockpit-hq cockpit-hq/cockpit cockpit-hq/cockpit Packagist
  Mar 10, 2023
• Medium 4.5
  CVE-2023-1316

  Cross-site Scripting (XSS) - Stored in osticket/osticket

  Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.

  osTicket osticket/osticket
  Mar 10, 2023
• Medium 5.2
  CVE-2023-1312

  Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

  Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.

  pimcore pimcore/pimcore pimcore/pimcore Packagist
  Mar 10, 2023
• Critical 9.8
  CVE-2023-24774

  Funadmin vulnerable to SQL injection

  Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php.

  funadmin/funadmin Packagist
  Mar 10, 2023
• Critical 9.8
  CVE-2023-27853 EPSS 20%

  NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a format string vulnerability in a SOAP service that could …

  Mar 10, 2023
• Unscored —
  CVE-2023-27116

  WebAssembly v1.0.29 discovered to contain an abort in CWriter::MangleType.

  wabt wabt Debian Ubuntu
  Mar 10, 2023
• High 7.5
  CVE-2023-27532 Exploited · Ransomware Public exploit EPSS 81%

  Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database…

  Mar 10, 2023

  KEV Aug 22, 2023
• High 7.5
  CVE-2023-27530

  Rack has possible DoS Vulnerability in Multipart MIME parsing

  A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.

  rack ruby-rack ruby-rack Debian Ubuntu RubyGems
  Mar 10, 2023
• High 8.8
  CVE-2023-27851

  NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that unintentionally allows users …

  Mar 10, 2023
• Medium 5.5
  CVE-2023-27115

  WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.

  wabt wabt wabt Debian Ubuntu PyPI
  Mar 10, 2023
• Unscored —
  CVE-2023-27850

  NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that allows users with access to t…

  Mar 10, 2023
• Medium 5.5
  CVE-2023-27114

  radare2 v5.8.3 was discovered to contain a segmentation fault via the component wasm_dis at p/wasm/wasm.c.

  radare2 Ubuntu
  Mar 10, 2023
• Unscored —
  CVE-2023-27164

  An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .m…

  Mar 10, 2023
• Medium 5.5
  CVE-2023-27119

  WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild.

  wabt wabt wabt Debian Ubuntu PyPI
  Mar 10, 2023
• Critical 9.8
  CVE-2023-27852

  NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a buffer overflow vulnerability in various CGI mechanisms t…

  Mar 10, 2023
• High 7.5
  CVE-2023-27161

  Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /Repositories. …

  Mar 10, 2023
• High 7.8
  CVE-2023-27117

  WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator.

  wabt wabt wabt Debian Ubuntu PyPI
  Mar 10, 2023
• High 8.8
  CVE-2023-23328

  A File Upload vulnerability exists in AvantFAX 3.3.7. An authenticated user can bypass PHP file type validation in File…

  Mar 10, 2023
• Unscored —
  CVE-2023-23911

  An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of…

  Mar 10, 2023
• Medium 4.9
  CVE-2023-23327

  An Information Disclosure vulnerability exists in AvantFAX 3.3.7. Backups of the AvantFAX sent/received faxes, and data…

  Mar 10, 2023
• Medium 5.4
  CVE-2023-23326

  A Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inj…

  Mar 10, 2023
• High 7.6
  CVE-2023-26075

  An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, E…

  Mar 10, 2023
• Medium 6.1
  CVE-2022-48111

  A cross-site scripting (XSS) vulnerability in the check_login function of SIPE s.r.l WI400 between version 8 and 11 inc…

  Mar 10, 2023
• Unscored —
  CVE-2022-44574 EPSS 64%

  An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to…

  Mar 10, 2023
• Critical 9.8
  CVE-2021-33360

  stoqey/gnuplot is vulnerable to command injection

  An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child_process, and/or filePath parameter(s).

  @stoqey/gnuplot npm
  Mar 10, 2023