Archive
May 2023
Vulnerabilities first published in this month (UTC), newest first.
766 results · Clear filters · Feed
-
High 8.8CVE-2023-31874 Public exploit
Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_pr…
-
High 8.3
Cross-site Scripting (XSS) - Generic in openemr/openemr
Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1.
-
High 8.3CVE-2023-2949 Scanner template
Cross-site Scripting (XSS) - Reflected in openemr/openemr
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.
-
High 7.5
pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthentica…
-
High 8.8CVE-2023-30350 Public exploit
FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin…
-
High 7.3
Insufficient validation when decoding a Socket.IO packet
socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch…
-
High 7.8
n158 vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function
All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function. **Note:** To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have the ability t…
-
High 8.4
keep-module-latest vulnerable to Command Injection due to missing input sanitization
All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the installModule function. **Note:** To execute the code snippet and potentially exploit the …
-
High 8.4
bwm-ng vulnerable to command injection
All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwm-ng.js file. **Note:** To execute the code snippet and potentially exploit the vulnerability, the attacker needs to hav…
-
High 8.1
kiwitcms vulnerable to stored XSS via unrestricted files upload
Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potential…
-
High 7.5
Improper handling of NTS cookie length that could crash the ntpd-rs server
ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the s…
-
High 8.1
Improper Input Validation in openemr/openemr
Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.1.
-
High 8.1
Basic auth header on WebDAV requests is not brute-force protected in Nextcloud
Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the provided user name was not an email address. Users from version…
-
High 7.1
Users can add themselves to any organization in CloudExplorer Lite
CloudExplorer Lite is an open source cloud management tool. In affected versions users can add themselves to any organization in CloudExplorer Lite. This is due to a missing permission check on the user profile. It is recommended to upgrade the version to v1.…
-
High 8.6
Openfire administration console authentication bypass
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to us…
KEV Aug 24, 2023 -
High 7.1CVE-2023-32311 Public exploit
The CloudExplorer Lite missing permissions check
CloudExplorer Lite is an open source cloud management platform. In CloudExplorer Lite prior to version 1.1.0 users organization/workspace permissions are not properly checked. This allows users to add themselves to any organization. This vulnerability has bee…
-
High 7.5
heap-over-flow and integer-overflow in sofia-sip
Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. Referring to [GHSA-8599-x7rq-fr54](https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8599-x7rq-fr54), several other potential heap-over-flow and …
-
High 8.1
NextCloud Cookbook's pull-checks.yml workflow is vulnerable to OS Command Injection
NextCloud Cookbook is a recipe library app. Prior to commit a46d9855 on the `master` branch and commit 489bb744 on the `main-0.9.x` branch, the `pull-checks.yml` workflow is vulnerable to command injection attacks because of using an untrusted `github.head_re…
-
High 7.2
User session not correctly destroyed on logout
Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticatin…
-
High 7.1
WordPress CopySafe Web Protection Plugin <= 3.13 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ArtistScope CopySafe Web Protection plugin <= 3.13 versions.
-
High 7.5
The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerab…
-
High 8.8
Privilege escalation in XXL-Job
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/.
-
High 7.2
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_…
-
High 7.2CVE-2023-33439 Scanner template
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=.
-
High 7.5
Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenti…
-
High 8.1
Directory traversal vulnerability in ESS REC Agent Server Edition series allows an authenticated attacker to view or al…
-
High 7.5
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's pub…
-
High 7.5
The hwPartsDFR module has a vulnerability in API calling verification. Successful exploitation of this vulnerability ma…
-
High 7.5
The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vu…
-
High 7.5
InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 a…
-
High 7.5
Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to exec…
-
High 7.5
XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API…
-
High 7.8
Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file.
-
High 7.5
Spring Boot Welcome Page Denial of Service
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
-
High 7.5
Integer overflow vulnerability in some phones. Successful exploitation of this vulnerability may affect service confide…
-
High 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability m…
-
High 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability m…
-
High 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability m…
-
High 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability m…
-
High 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability m…