Archive
April 2023
Vulnerabilities first published in this month (UTC), newest first.
23 results · Clear filters · Feed
-
Critical 9.8CVE-2023-28769 Public exploit
The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware …
-
Critical 10.0CVE-2023-30839 Public exploit
PrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using "SQL Manager"
PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 cont…
-
Critical 9.8
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware ver…
KEV May 31, 2023 -
Critical 9.1CVE-2023-29528 Public exploit
Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml
XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary H…
-
Critical 9.8
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bu…
KEV Apr 21, 2023 -
Critical 10.0
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the serve…
-
Critical 9.8
Sandbox Escape in vm2
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()…
-
Critical 9.8CVE-2022-34128 Public exploit
The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data…
-
Critical 9.8
Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: Th…
-
Critical 9.1CVE-2023-29201 Public exploit
org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability
XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1, only escaped `<script>` and `<style>`-tags but neither attributes that can be us…
-
Critical 9.8CVE-2020-29007 Public exploit
The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of…
-
Critical 9.8CVE-2023-27746 Public exploit
BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily crack…
-
Critical 9.8CVE-2023-26918 Public exploit
Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan…
-
Critical 9.8
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
-
Critical 9.8
Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).
-
Critical 9.8CVE-2023-29478 Public exploit
BiblioCraft before 2.4.6 does not sanitize path-traversal characters in filenames, allowing restricted write access to …
-
Critical 10.0
vm2 Sandbox Escape vulnerability
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the s…
-
Critical 9.8CVE-2023-24538 Public exploit
Backticks not treated as string delimiters in html/template
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, th…
-
Critical 9.8CVE-2022-4939 Public exploit
WCFM Membership <= 2.10.0 - Unauthenticated Privilege Escalation
THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on the wp_ajax_nopriv_wcfm_ajax_controller AJAX action that controls membership settings. This makes it p…
-
Critical 9.8CVE-2022-31890 Public exploit
SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13de…
-
Critical 9.8
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.1…
KEV Nov 16, 2023 -
Critical 9.8CVE-2023-26866 Public exploit
GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3_V1.1 and MH-46360-2.0.3-R5-GP resp…
-
Critical 9.8CVE-2021-28235 Public exploit
Etcd-io Improper Authentication vulnerability
Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.