Archive
21 March 2023
Vulnerabilities first published on this day (UTC), newest first.
80 results · Feed
-
High 7.5
Local Privilege Escalation Vulnerability in cloudflared's Installer
A vulnerability has been discovered in cloudflared's installer (<= 2023.3.0) for Windows 32-bits devices that allows a local attacker with no administrative permissions to escalate their privileges on the affected device. This vulnerability exists because the…
-
Low 3.5
Ydalb mapicoin stats.php cross site scripting
A vulnerability has been found in Ydalb mapicoin up to 1.9.0 and classified as problematic. This vulnerability affects unknown code of the file webroot/stats.php. The manipulation of the argument link/search leads to cross site scripting. The attack can be in…
-
High 8.8
IDOR in Digikent
Authorization Bypass Through User-Controlled Key vulnerability in Vadi Corporate Information Systems DigiKent allows Authentication Bypass, Authentication Abuse. This issue affects DigiKent: before 23.03.20.
-
Medium 5.4
WordPress Photo Gallery – Image Gallery by Ape Plugin <= 2.2.8 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Galleryape Gallery Images Ape plugin <= 2.2.8 versions.
-
Medium 5.4
WordPress Glossary Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Cross-Site Scripting vulnerability in TCBarrett WP Glossary plugin <= 3.1.2 versions.
-
Medium 5.4
WordPress Gallery with thumbnail slider Plugin <= 6.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin <= 6.0 versions.
-
Critical 9.1CVE-2023-28725 EPSS 21%
General Bytes Crypto Application Server (CAS) 20230120, as distributed with General Bytes BATM devices, allows remote a…
-
Medium 6.0
Business Logic Errors in answerdev/answer
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
-
High 8.3
Cross-site Scripting (XSS) - Generic in tsolucio/corebos
Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0.
-
Medium 5.3
Improper Restriction of Excessive Authentication Attempts in answerdev/answer
Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6.
-
High 8.1
Business Logic Errors in answerdev/answer
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 5.3
Authentication Bypass by Capture-replay in answerdev/answer
Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 6.8
Insufficient Session Expiration in answerdev/answer
Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6.
-
High 8.3
Cross-site Scripting (XSS) - Stored in answerdev/answer
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
-
High 7.5CVE-2023-1545 Public exploit
SQL Injection in nilsteampassnet/teampass
SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
-
Medium 5.3
Observable Timing Discrepancy in answerdev/answer
Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 5.3
Observable Response Discrepancy in answerdev/answer
Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
-
High 7.6
Cross-site Scripting (XSS) - Stored in answerdev/answer
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
-
High 7.5
An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and …
-
Critical 9.8
The eo_tags package before 1.3.0 for PrestaShop allows SQL injection via an HTTP User-Agent or Referer header.
-
Critical 9.8
The eo_tags package before 1.4.19 for PrestaShop allows SQL injection via a crafted _ga cookie.
-
High 7.5
Xuxueli xxl-job allows attacker to obtain sensitive information via the pageList parameter
Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter.
-
High 7.8
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpret…
-
High 8.8
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that coul…
-
Medium 6.5
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the …
-
Medium 6.5
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that coul…
-
High 7.8
A CWE-20: Improper Input Validation vulnerability exists in Custom Reports that could cause a macro to be executed, pot…
-
High 8.8CVE-2023-27842 Public exploit
Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execu…
-
High 8.8
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause mani…
-
High 7.8
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Custom Reports that could…
-
Medium 6.5
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause acce…
-
Medium 6.7
McAfee Total Protection prior to 16.0.50 may allow an adversary (with full administrative access) to modify a McAfee sp…
-
High 8.6CVE-2023-26497 EPSS 21%
An issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos …
-
Critical 9.8
An insecure password reset issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 service via in…
-
High 7.5
An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sens…
-
High 8.1
An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to unlock model(s) wit…
-
Unscored —
x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but …
-
Unscored —
x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains w…
-
Unscored —
x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security…
-
Unscored —
x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains w…