Archive
May 2023
Vulnerabilities first published in this month (UTC), newest first.
766 results · Clear filters · Feed
-
High 7.8
A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:v…
-
High 8.8
Minecraft through 1.19 and 1.20 pre-releases before 7 (Java) allow arbitrary file overwrite, and possibly code executio…
-
High 7.5
Incorrect access control in luowice v3.5.18 allows attackers to access cloud source code information via modification f…
-
High 7.5
Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device.
-
High 7.4
An issue was discovered in Faronics Insight 10.0.19045 on Windows. By abusing the Insight UDP broadcast discovery syste…
-
High 7.3
An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for a remote attacker to communicate …
-
High 7.1
An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application allows unaut…
-
High 8.8
An issue was discovered in Faronics Insight 10.0.19045 on Windows. An unauthenticated attacker is able to upload any ty…
-
High 7.4
An issue was discovered in Faronics Insight 10.0.19045 on Windows. A suitably positioned attacker could perform a man-i…
-
High 8.8
An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted p…
-
High 7.5
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service atta…
-
High 7.1
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service atta…
-
High 7.8
An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause code execution and…
-
High 7.5
An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause a denial of serv…
-
High 7.5
SoLive 1.6.14 thru 1.6.20 for Android has an exposed component that provides a method to modify the SharedPreference fi…
-
High 7.5
The Call Blocker application 6.6.3 for Android incorrectly opens a key component that an attacker can use to inject lar…
-
High 7.8
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a code execution attack by manipula…
-
High 7.5CVE-2023-31185 EPSS 13%
ROZCOM server framework
ROZCOM server framework - Misconfiguration may allow information disclosure via an unspecified request.
-
High 7.2
The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0…
-
High 7.5
A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() functio…
-
High 7.5
Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download…
-
High 7.1
There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the…
-
High 7.1
There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the…
-
High 8.8
Cross Site Request Forgery on Shop Beat Services
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Cross Site Request Forgery (CSRF).
-
High 7.8
An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent str…
-
High 7.5
Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Divide-by-Zero vulnerability in the packet parser. A remote a…
-
High 7.7
Insufficiently Protected ChatBot Credentials in tgstation-server
tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched i…
-
High 7.1
WordPress Forms Ada Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MonitorClick Forms Ada – Form Builder plugin <= 1.0 versions.
-
High 8.8
Dolibarr vulnerable to remote code execution via uppercase manipulation
Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.
-
High 7.2
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection…
-
High 7.5CVE-2021-27825 Public exploit
A directory traversal vulnerability on Mercury MAC1200R devices allows attackers to read arbitrary files via a web-stat…
-
High 7.1
WordPress Easy Google Maps Plugin <= 1.11.7 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps plugin <= 1.11.7 versions.
-
High 7.1
WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Product Vendors plugin <= 2.1.76 versions.
-
High 7.1
WordPress Rank Math SEO PRO Plugin <= 3.0.35 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in One Rank Math SEO PRO plugin <= 3.0.35 versions.
-
High 7.1
WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.
-
High 7.1
WordPress EventPrime Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected (XSS) Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 2.8.6 versions.
-
High 7.1
WordPress Duplicator Pro Plugin <= 4.5.11 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Awesome Motive Duplicator Pro plugin <= 4.5.11 versions.
-
High 7.4
In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP …
-
High 7.5
Warpinator before 1.6.0 allows remote file deletion via directory traversal in top_dir_basenames.
-
High 7.8CVE-2023-31873 Public exploit
Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child_process').