Archive
21 March 2023
Vulnerabilities first published on this day (UTC), newest first.
36 results · Clear filters · Feed
-
High 7.5
Rockwell Automation ThinManager ThinServer Path Traversal Download
In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.e…
-
High 8.8
Out of bounds read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially explo…
-
High 8.8
Use after free in PDF in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap co…
-
High 8.8
Out of bounds read in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the …
-
High 8.8
Use after free in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap …
-
High 8.8
Use after free in WebProtect in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit …
-
High 8.8
Use after free in Passwords in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the …
-
High 8.2
Missing MAC layer security in Wi-SUN Linux Border Router
Missing MAC layer security in Silicon Labs Wi-SUN Linux Border Router v1.5.2 and earlier allows malicious node to route malicious messages through network.
-
High 8.2
Missing MAC layer security in Wi-SUN SDK
Missing MAC layer security in Silicon Labs Wi-SUN SDK v1.5.0 and earlier allows malicious node to route malicious messages through network.
-
High 7.2
Authenticated Remote Code Execution in Aruba CX Switches
An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system, leading…
-
High 8.1
MGT-COMMERCE CloudPanel Shared Certificate
MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of CloudPanel. This behavior was observed in version 2.2.0. There has been no indication from the vendor th…
-
High 7.2
A command execution vulnerability exists in the hidden telnet service functionality of Netgear Orbi Router RBR750 4.6.8…
-
High 7.2
A command execution vulnerability exists in the ubus backend communications functionality of Netgear Orbi Satellite RBS…
-
High 8.8
Rapid7 InsightCloudSec resource.db() method access
An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code execution. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in vers…
-
High 8.1
Rapid7 InsightCloudSec box object access
An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.…
-
High 8.8
Rapid7 InsightCloudSec getattr() method access
An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February …
-
High 7.1
Jenkins AbsInt a³ Plugin XML External Entity Reference vulnerability
Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
High 7.5
IBM Aspera Faspex information disclosure
IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query. IBM X-Force ID: 249613.
-
High 7.5
Local Privilege Escalation Vulnerability in cloudflared's Installer
A vulnerability has been discovered in cloudflared's installer (<= 2023.3.0) for Windows 32-bits devices that allows a local attacker with no administrative permissions to escalate their privileges on the affected device. This vulnerability exists because the…
-
High 8.8
IDOR in Digikent
Authorization Bypass Through User-Controlled Key vulnerability in Vadi Corporate Information Systems DigiKent allows Authentication Bypass, Authentication Abuse. This issue affects DigiKent: before 23.03.20.
-
High 8.3
Cross-site Scripting (XSS) - Generic in tsolucio/corebos
Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0.
-
High 8.1
Business Logic Errors in answerdev/answer
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
-
High 8.3
Cross-site Scripting (XSS) - Stored in answerdev/answer
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
-
High 7.5CVE-2023-1545 Public exploit
SQL Injection in nilsteampassnet/teampass
SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
-
High 7.6
Cross-site Scripting (XSS) - Stored in answerdev/answer
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
-
High 7.5
An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and …
-
High 7.5
Xuxueli xxl-job allows attacker to obtain sensitive information via the pageList parameter
Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter.
-
High 7.8
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpret…
-
High 8.8
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that coul…
-
High 7.8
A CWE-20: Improper Input Validation vulnerability exists in Custom Reports that could cause a macro to be executed, pot…
-
High 8.8CVE-2023-27842 Public exploit
Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execu…
-
High 8.8
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause mani…
-
High 7.8
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Custom Reports that could…
-
High 8.6CVE-2023-26497 EPSS 21%
An issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos …
-
High 7.5
An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sens…
-
High 8.1
An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to unlock model(s) wit…