Archive
9 May 2023
Vulnerabilities first published on this day (UTC), newest first.
252 results · Feed
-
Medium 6.5CVE-2023-29324 Public exploit
Windows MSHTML Platform Security Feature Bypass Vulnerability
Windows MSHTML Platform Security Feature Bypass Vulnerability
-
Medium 6.5
Microsoft SharePoint Server Information Disclosure Vulnerability
Microsoft SharePoint Server Information Disclosure Vulnerability
-
High 7.2
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
KEV Mar 26, 2024 -
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Microsoft Excel Remote Code Execution Vulnerability
-
Medium 6.5CVE-2023-24950 EPSS 67%
Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
-
High 7.4
Windows Bluetooth Driver Elevation of Privilege Vulnerability
Windows Bluetooth Driver Elevation of Privilege Vulnerability
-
High 7.8CVE-2023-24949 EPSS 25%
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
High 8.8
Windows Bluetooth Driver Remote Code Execution Vulnerability
Windows Bluetooth Driver Remote Code Execution Vulnerability
-
High 7.8
Windows Backup Service Elevation of Privilege Vulnerability
Windows Backup Service Elevation of Privilege Vulnerability
-
Medium 6.5
Windows Bluetooth Driver Information Disclosure Vulnerability
Windows Bluetooth Driver Information Disclosure Vulnerability
-
Medium 5.5
Windows iSCSI Target Service Information Disclosure Vulnerability
Windows iSCSI Target Service Information Disclosure Vulnerability
-
High 7.8
Remote Desktop Client Remote Code Execution Vulnerability
Remote Desktop Client Remote Code Execution Vulnerability
-
High 8.1
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
-
Critical 9.8
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
-
High 7.8
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
-
High 7.5
Remote Procedure Call Runtime Denial of Service Vulnerability
Remote Procedure Call Runtime Denial of Service Vulnerability
-
High 7.5
Windows NFS Portmapper Information Disclosure Vulnerability
Windows NFS Portmapper Information Disclosure Vulnerability
-
Critical 9.8CVE-2023-24941 EPSS 95%
Windows Network File System Remote Code Execution Vulnerability
Windows Network File System Remote Code Execution Vulnerability
-
High 7.5
Windows Pragmatic General Multicast (PGM) Denial of Service Vulnerability
Windows Pragmatic General Multicast (PGM) Denial of Service Vulnerability
-
Medium 5.9
Windows NTLM Security Support Provider Information Disclosure Vulnerability
Windows NTLM Security Support Provider Information Disclosure Vulnerability
-
High 7.5
Server for NFS Denial of Service Vulnerability
Server for NFS Denial of Service Vulnerability
-
High 7.0
Windows Graphics Component Elevation of Privilege Vulnerability
Windows Graphics Component Elevation of Privilege Vulnerability
-
High 7.5
Windows SMB Denial of Service Vulnerability
Windows SMB Denial of Service Vulnerability
-
High 8.1
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
-
Medium 6.1
BUG-000154662 Reflected XSS vulnerability in Portal for ArcGIS
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and before which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s brows…
-
Medium 6.1
BUG-000155001 - Unvalidated redirect in Portal for ArcGIS.
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.
-
Critical 9.1CVE-2023-32071 EPSS 70%
XWiki Platform vulnerable to RXSS via editor parameter - importinline template
XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page w…
-
Critical 10.0
XWiki Platform privilege escalation (PR)/RCE from account through class sheet
XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible for a user to execute anything with the right of the author of the XWiki.ClassSheet document. This has been patched in XW…
-
Medium 5.4
Time Tracker has Stored XSS vulnerability in Week View plugin
Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements …
-
Medium 6.1
Craft CMS vulnerable to cross site scripting in RSS feed widget
Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.
-
Medium 5.9
Mage terminal user authentication not working properly
mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users …
-
Medium 6.5
DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to…
-
Medium 4.3
DHIS2 Core unrestricted session cookies with Personal Access Tokens
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens (PATs) generate unrestricted session cookies. This …
-
High 7.1
DHIS2 Core vulnerable to Improper Access Control with PATCH requests
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authentica…
-
High 7.5
MaraDNS Integer Underflow Vulnerability in DNS Packet Decompression
MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by tri…
-
Low 3.7
PostgresNIO processes unencrypted bytes from man-in-the-middle
PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of …
-
High 7.8
Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow in the he…
-
High 7.8
Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow in the he…
-
High 7.8
Rockwell Automation Arena Simulation Software Remote Code Execution Vulnerability
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow potential…
-
Medium 4.4
A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbit…