13 March 2023

15 results · Clear filters · Feed

• Critical 9.1
  CVE-2023-27582

  Full authentication bypass if SASL authorization username is specified

  maddy is a composable, all-in-one mail server. Starting with version 0.2.0 and prior to version 0.6.3, maddy allows a full authentication bypass if SASL authorization username is specified when using the PLAIN authentication mechanisms. Instead of validating …

  foxcpp maddy github.com/foxcpp/maddy maddy Alpine Go
  Mar 13, 2023
• Critical 9.8
  CVE-2023-27583

  Panindex uses hard coded cyptographic key

  PanIndex is a network disk directory index. In Panindex prior to version 3.1.3, a hard-coded JWT key `PanIndex` is used. An attacker can use the hard-coded JWT key to sign JWT token and perform any actions as a user with admin privileges. Version 3.1.3 has a …

  px-org PanIndex
  Mar 13, 2023
• Critical 9.8
  CVE-2023-0345

  CVE-2023-0345

  The Akuvox E11 secure shell (SSH) server is enabled by default and can be accessed by the root user. This password cannot be changed by the user.

  Akuvox E11
  Mar 13, 2023
• Critical 9.1
  CVE-2023-0352

  CVE-2023-0352

  The Akuvox E11 password recovery webpage can be accessed without authentication, and an attacker could download the device key file. An attacker could then use this page to reset the password back to the default.

  Akuvox E11
  Mar 13, 2023
• Critical 9.1
  CVE-2023-0354

  CVE-2023-0354

  The Akuvox E11 web server can be accessed without any user authentication, and this could allow an attacker to access sensitive information, as well as create and download packet captures with known default URLs.

  Akuvox E11
  Mar 13, 2023
• Critical 9.8
  CVE-2023-0037 Scanner template

  10WebMapBuilder < 1.0.73 - Unauthenticated SQLi

  The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

  Web / CMS
  Mar 13, 2023
• Critical 9.9
  CVE-2022-38074

  WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection

  SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.

  VeronaLabs WP Statistics
  Mar 13, 2023
• Critical 9.8
  CVE-2023-28154

  Cross-realm object access in Webpack 5

  Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

  node-webpack webpack node-webpack Debian Ubuntu npm
  Mar 13, 2023
• Critical 9.8
  CVE-2023-24762

  OS Command injection vulnerability in D-Link DIR-867 DIR_867_FW1.30B07 allows attackers to execute arbitrary commands v…

  Mar 13, 2023
• Critical 9.8
  CVE-2023-27052

  E-Commerce System v1.0 ws discovered to contain a SQL injection vulnerability via the id parameter at /admin/delete_use…

  Mar 13, 2023
• Critical 9.8
  CVE-2023-27061

  Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the wifiFilterL…

  Mar 13, 2023
• Critical 9.8
  CVE-2023-27063

  Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the DNSDomainNa…

  Mar 13, 2023
• Critical 9.8
  CVE-2023-25207

  PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.

  Mar 13, 2023
• Critical 9.8
  CVE-2023-25279 EPSS 31%

  OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a c…

  Mar 13, 2023
• Critical 9.8
  CVE-2021-45423

  A Buffer Overflow vulnerabilityexists in Pev 0.81 via the pe_exports function from exports.c.. The array offsets_to_Nam…

  pev pev pev Debian Ubuntu Alpine
  Mar 13, 2023