Archive
May 2023
Vulnerabilities first published in this month (UTC), newest first.
2,434 results · Feed
-
High 7.5
The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerab…
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability in TFDi Design smartCARS 3 v0.7.0 and below allows attackers to execu…
-
High 8.8
Privilege escalation in XXL-Job
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/.
-
Medium 5.4
skycaiji v2.5.4 is vulnerable to Cross Site Scripting (XSS). Attackers can achieve backend XSS by deploying malicious J…
-
High 7.2
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_…
-
High 7.2CVE-2023-33439 Scanner template
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=.
-
Medium 6.5
mp4v2 v2.1.2 was discovered to contain a memory leak via the class MP4BytesProperty.
-
Medium 6.1
An issue was discovered in Papaya Viewer 1.0.1449. User-supplied input in form of DICOM or NIFTI images can be loaded i…
-
High 7.5
Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenti…
-
Medium 5.9
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for res…
-
High 8.1
Directory traversal vulnerability in ESS REC Agent Server Edition series allows an authenticated attacker to view or al…
-
Medium 5.3
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously …
-
Medium 5.9
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard pat…
-
High 7.5
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's pub…
-
Medium 6.5
Keycloak Untrusted Certificate Validation vulnerability
A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak. Using this method an attacker may choose the certificate whic…
-
Medium 5.5
A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the …
-
Unscored —
A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authen…
-
Low 3.3
The Gallery app has the risk of hijacking attacks. Successful exploitation of this vulnerability may cause download fai…
-
High 7.5
The hwPartsDFR module has a vulnerability in API calling verification. Successful exploitation of this vulnerability ma…
-
High 7.5
The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vu…
-
Medium 5.3
NetApp Blue XP Connector versions prior to 3.9.25 expose information via a directory listing. A new Connector architect…
-
Critical 10.0
An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a…
-
Unscored —
A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki…
-
Medium 5.3
VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted c…
-
Medium 5.4
Stored cross site scripting in Craft CMS
A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Cat…
-
Medium 5.3
Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture f…
-
Medium 5.3
BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
-
Medium 6.3
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or cr…
-
Medium 5.3
NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted captur…
-
Unscored —CVE-2023-2002 Public exploit
A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock…
-
Unscored —
There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw al…
-
Medium 5.3
BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
-
Critical 9.8
Server-Side Template Injection in Camaleon CMS
Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.
-
High 7.5
InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 a…
-
High 7.5
Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to exec…
-
High 7.5
XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API…
-
High 7.8
Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file.
-
Medium 6.1
NSX-T contains a reflected cross-site scripting vulnerability due to a lack of input validation. A remote attacker can …
-
High 7.5
Spring Boot Welcome Page Denial of Service
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
-
Medium 5.9
In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a…