Archive
May 2023
Vulnerabilities first published in this month (UTC), newest first.
37 results · Clear filters · Feed
-
Medium 6.1CVE-2023-33732 Public exploit
Cross Site Scripting (XSS) in the New Policy form in Microworld Technologies eScan management console 14.0.1400.2281 al…
-
Medium 5.4CVE-2023-33962 Public exploit
JStachio XSS vulnerability: Unescaped single quotes
JStachio is a type-safe Java Mustache templating engine. Prior to version 1.0.1, JStachio fails to escape single quotes `'` in HTML, allowing an attacker to inject malicious code. This vulnerability can be exploited by an attacker to execute arbitrary JavaScr…
-
Medium 6.1
Custom 404 Pro < 3.7.3 - Reflected Cross-Site Scripting
The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
-
Medium 6.1CVE-2023-23956 Public exploit
A user can supply malicious HTML and JavaScript code that will be executed in the client browser
-
Medium 6.3
DedeCMS article_allowurl_edit.php code injection
A vulnerability was found in DedeCMS up to 5.7.106. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file uploads/dede/article_allowurl_edit.php. The manipulation of the argument allurls leads to code injecti…
-
Medium 6.1CVE-2023-32681 Public exploit
Unintended leak of Proxy-Authorization header in requests
Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header…
-
Medium 6.1CVE-2022-46907 Public exploit
Apache JSPWiki: XSS Injection points in several plugins
A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users…
-
Medium 6.1CVE-2023-25439 Public exploit
Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbit…
-
Medium 4.3CVE-2022-47447 Public exploit
WordPress WP-Advanced-Search Plugin <= 3.3.8 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <= 3.3.8 versions.
-
Medium 5.4CVE-2023-33829 Public exploit
A stored cross-site scripting (XSS) vulnerability in Cloudogu GmbH SCM Manager v1.2 to v1.60 allows attackers to execut…
-
Medium 6.1CVE-2023-31664 Public exploit
A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2…
-
Medium 5.4CVE-2023-25440 Public exploit
Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to ex…
-
Medium 5.4CVE-2023-31779 Public exploit
Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS). An attacker with user privilege on kanban board ca…
-
Medium 6.1CVE-2023-31584 Public exploit
GitHub repository cu/silicon commit a9ef36 was discovered to contain a reflected cross-site scripting (XSS) vulnerabili…
-
Medium 4.3
Ellucian Ethos Identity logout cross site scripting
A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the…
-
Medium 6.7CVE-2023-31756 Public exploit
A command injection vulnerability exists in the administrative web portal in TP-Link Archer VR1600V devices running fir…
-
Medium 5.5CVE-2023-26818 Public exploit
Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSER…
-
Medium 6.5CVE-2023-20110 Public exploit
Cisco Smart Software Manager On-Prem SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based m…
-
Medium 5.4
WordPress Core < 6.2.1 - Directory Traversal
WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafte…
-
Medium 4.8CVE-2023-31699 Public exploit
ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.
-
Medium 5.4CVE-2023-31698 Public exploit
Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's securi…
-
Medium 6.2CVE-2023-21118 Public exploit
In unflattenString8 of Sensor.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lea…
-
Medium 6.7CVE-2023-20696 Public exploit
In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
Medium 6.1CVE-2023-29808 Public exploit
Cross Site Scripting (XSS) vulnerability in vogtmh cmaps (companymaps) 8.0 allows attackers to execute arbitrary code.
-
Medium 5.4CVE-2023-29983 Public exploit
Cross Site Scripting vulnerability found in Maximilian Vogt cmaps v.8.0 allows a remote attacker to execute arbitrary c…
-
Medium 6.5CVE-2023-23169 Public exploit
Synapsoft pdfocus 1.17 is vulnerable to local file inclusion and server-side request forgery Directory Traversal.
-
Medium 6.8CVE-2022-47880 Public exploit
An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users w…
-
Medium 6.1
Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive informa…
-
Medium 6.7
Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
-
Medium 6.5CVE-2023-29324 Public exploit
Windows MSHTML Platform Security Feature Bypass Vulnerability
Windows MSHTML Platform Security Feature Bypass Vulnerability
-
Medium 5.4CVE-2023-2516 Public exploit
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
-
Medium 5.4CVE-2023-29839 Public exploit
A Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows a…
-
Medium 5.4CVE-2023-29918 Public exploit
RosarioSIS vulnerable to CSV Injection
RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.
-
Medium 5.4CVE-2023-31434 Public exploit
The parameters nutzer_titel, nutzer_vn, and nutzer_nn in the user profile, and langID and ONLINEID in direct links, in …
-
Medium 6.5
Moodle: tinymce loaders susceptible to arbitrary folder creation
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.
-
Medium 6.5
Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of da…
-
Medium 6.5CVE-2023-27035 Public exploit
An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio a…