20 June 2023

26 results · Clear filters · Feed

• Medium 6.3
  CVE-2023-33869 Public exploit

  Enphase Envoy OS Command Injection

  Enphase Envoy versions D7.0.88 is vulnerable to a command injection exploit that may allow an attacker to execute root commands.

  Enphase Envoy
  Jun 20, 2023
• Medium 6.3
  CVE-2023-3340

  SourceCodester Online School Fees System GET Parameter ajx.php sql injection

  A vulnerability was found in SourceCodester Online School Fees System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file ajx.php of the component GET Parameter Handler. The manipulation of the argument name_starts…

  SourceCodester Online School Fees System
  Jun 20, 2023
• Medium 5.9
  CVE-2023-35095

  WordPress Flo Forms Plugin <= 1.0.40 is vulnerable to Cross Site Scripting (XSS)

  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Flothemes Flo Forms – Easy Drag & Drop Form Builder plugin <= 1.0.40 versions.

  Flothemes Flo Forms – Easy Drag & Drop Form Builder
  Jun 20, 2023
• Medium 5.3
  CVE-2023-1999 Public exploit

  Use after free in libwebp

  There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encode…

  Chromium libwebp thunderbird mozjs38 Debian Ubuntu Azure Linux Alpine
  Jun 20, 2023
• Medium 5.9
  CVE-2023-35878

  WordPress Extra User Details Plugin <= 0.5 is vulnerable to Cross Site Scripting (XSS)

  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Vadym K. Extra User Details plugin <= 0.5 versions.

  Vadym K. Extra User Details
  Jun 20, 2023
• Medium 6.5
  CVE-2023-35882

  WordPress Super Socializer Plugin <= 7.13.52 is vulnerable to Cross Site Scripting (XSS)

  Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor Super Socializer plugin <= 7.13.52 versions.

  Team Heateor Super Socializer
  Jun 20, 2023
• Medium 5.0
  CVE-2023-26435

  It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT do…

  OX Software OX App Suite
  Jun 20, 2023
• Medium 4.3
  CVE-2023-26434

  When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. A…

  OX Software OX App Suite
  Jun 20, 2023
• Medium 4.3
  CVE-2023-26433

  When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. A…

  OX Software OX App Suite
  Jun 20, 2023
• Medium 4.3
  CVE-2023-26432

  When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. A…

  OX Software OX App Suite
  Jun 20, 2023
• Medium 5.0
  CVE-2023-26431

  IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers wi…

  OX Software OX App Suite
  Jun 20, 2023
• Medium 6.5
  CVE-2023-26428

  Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same co…

  OX Software OX App Suite
  Jun 20, 2023
• Medium 6.1
  CVE-2023-3320 Public exploit

  The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,…

  musilda WP Sticky Social Web / CMS
  Jun 20, 2023
• Medium 6.1
  CVE-2020-21052

  Cross Site Scripting vulnerability in zrlog zrlog v.2.1.3 allows a remote attacker to execute arbitrary code via the ni…

  Jun 20, 2023
• Medium 6.1
  CVE-2020-21058

  Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermai…

  Jun 20, 2023
• Medium 6.1
  CVE-2020-21485

  Alluxio Cross Site Scripting vulnerability

  Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the browse board component.

  org.alluxio:alluxio-parent Maven
  Jun 20, 2023
• Medium 6.1
  CVE-2020-21268

  Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via t…

  Jun 20, 2023
• Medium 5.4
  CVE-2020-21246

  YiiCMS Cross Site Scripting vulnerability

  Cross Site Scripting vulnerability in YiiCMS v.1.0 allows a remote attacker to execute arbitrary code via the news function.

  sheng/yiicms Packagist
  Jun 20, 2023
• Medium 6.1
  CVE-2020-20070

  Cross Site Scripting vulnerability found in wkeyuan DWSurvey 1.0 allows a remote attacker to execute arbitrary code via…

  Jun 20, 2023
• Medium 6.1
  CVE-2020-20725

  Cross Site Scripting vulnerability in taogogo taoCMS v.2.5 beta5.1 allows remote attacker to execute arbitrary code via…

  Jun 20, 2023
• Medium 4.8
  CVE-2020-20697

  NodCMS Cross Site Scripting vulnerability

  Cross Site Scripting vulnerability in khodakhah NodCMS v.3.0 allows a remote attacker to execute arbitrary code and gain access to senstivie information via a crafted script to the address parameter.

  khodakhah/nodcms Packagist
  Jun 20, 2023
• Medium 6.5
  CVE-2020-20502

  Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check …

  Jun 20, 2023
• Medium 6.5
  CVE-2023-34597

  A vulnerability in Fibaro Motion Sensor firmware v3.4 allows attackers to cause a Denial of Service (DoS) via a crafted…

  Jun 20, 2023
• Medium 6.5
  CVE-2023-34596

  A vulnerability in Aeotec WallMote Switch firmware v2.3 allows attackers to cause a Denial of Service (DoS) via a craft…

  Jun 20, 2023
• Medium 6.1
  CVE-2023-33495

  Craft CMS vulnerable to HTML injection

  Craft CMS through 4.4.9 is vulnerable to HTML Injection.

  craftcms/cms Packagist
  Jun 20, 2023
• Medium 5.5
  CVE-2023-3220

  An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Jun 20, 2023