Archive
May 2023
Vulnerabilities first published in this month (UTC), newest first.
2,434 results · Feed
-
High 7.5
The Call Blocker application 6.6.3 for Android incorrectly opens a key component that an attacker can use to inject lar…
-
Critical 9.8
The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete dat…
-
Critical 9.8
An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause escalation of pr…
-
High 7.8
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a code execution attack by manipula…
-
Unscored —
The Lock Master app 2.2.4 for Android allows unauthorized apps to modify the values in its SharedPreference files. Thes…
-
High 7.5CVE-2023-31185 EPSS 13%
ROZCOM server framework
ROZCOM server framework - Misconfiguration may allow information disclosure via an unspecified request.
-
Medium 5.3
Avaya IX Workforce Engagement - User Enumeration - CWE-204: Observable Response Discrepancy
Avaya IX Workforce Engagement v15.2.7.1195 - User Enumeration - Observable Response Discrepancy
-
Medium 6.5
Avaya IX Workforce Engagement - CWE-522: Insufficiently Protected Credentials
Avaya IX Workforce Engagement v15.2.7.1195 - CWE-522: Insufficiently Protected Credentials
-
Medium 6.2
-
High 7.2
The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0…
-
Medium 5.3
XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injecti…
-
Medium 6.3
Path Traversal: '\..\filename' in pimcore/pimcore
Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
-
Medium 6.5
Privilege Defined With Unsafe Actions in pimcore/pimcore
Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.
-
High 7.5
A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() functio…
-
Medium 5.4
Prototype Pollution in antfu/utils
Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.
-
High 7.5
Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download…
-
Medium 5.5
Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive …
-
Medium 6.1CVE-2023-23956 Public exploit
A user can supply malicious HTML and JavaScript code that will be executed in the client browser
-
Low 3.3
There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the…
-
High 7.1
There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the…
-
High 7.1
There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the…
-
Medium 5.4
Multiple Stored Cross-Site Scripting Vulnerabilities on Shop Beat Services
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripting (XSS) vulnerabilities via Shop Beat Control Panel found at www.shopbeat.co.za controlpanel.shopbeat.co.za.
-
Critical 9.8
Shop Beat Services Vulnerable To Insecure Permissions
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions.
-
Medium 5.3
Directory Traversal on Shop Beat Services
Shop Beat Solutions (pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Directory Traversal via server.shopbeat.co.za. Information Exposure Through Directory Listing vulnerability in "studio" software of Shop Beat. This issue affects: Shop B…
-
Critical 9.1
Shop Beat Services Vulnerable To IDOR
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to IDOR via controlpanel.shopbeat.co.za.
-
High 8.8
Cross Site Request Forgery on Shop Beat Services
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Cross Site Request Forgery (CSRF).
-
Medium 5.4
Shop Beat Services Vulnerable To Bypass 2FA via APIs
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code.…
-
Critical 9.8
Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a path traversal vulnerability with resultant arbitrary writing…
-
High 7.8
An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent str…
-
High 7.5
Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Divide-by-Zero vulnerability in the packet parser. A remote a…
-
Medium 5.5
An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary d…
-
Medium 4.3
Bestwebsoft Relevant Plugin Thumbnail information disclosure
A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by this vulnerability is an unknown functionality of the component Thumbnail Handler. The manipulation leads to information disclosure. The a…
-
High 7.7
Insufficiently Protected ChatBot Credentials in tgstation-server
tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched i…
-
Medium 4.8
Tuleap vulnerable toXSS via the triggered job URL of a Jenkins job
Tuleap is an open source tool for end to end traceability of application and system developments. Tuleap Community Edition prior to version 14.8.99.60 and Tuleap Enterprise edition prior to 14.8-3 and 14.7-7, the logs of the triggered Jenkins job URLs are not…
-
High 7.1
WordPress Forms Ada Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MonitorClick Forms Ada – Form Builder plugin <= 1.0 versions.
-
Medium 6.5
WordPress Progress Bar Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Chris Reynolds Progress Bar plugin <= 2.2.1 versions.
-
Medium 4.7
SourceCodester Faculty Evaluation System sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Faculty Evaluation System 1.0. Affected by this issue is some unknown functionality of the file index.php?page=edit_user. The manipulation of the argument id leads to sql inje…
-
Medium 4.3
Lack of URL normalization allows rendering previews for disallowed domains
Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link preview on a disallowed domain using a specially crafted link.
-
Medium 6.3
SourceCodester Students Online Internship Timesheet System GET Parameter rendered_report.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Students Online Internship Timesheet System 1.0. Affected is an unknown function of the file rendered_report.php of the component GET Parameter Handler. The manipulation of the arg…
-
Medium 4.3
WordPress Product Gallery Slider for WooCommerce Plugin <= 2.2.8 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Codeixer Product Gallery Slider for WooCommerce plugin <= 2.2.8 versions.