Archive
23 June 2023
Vulnerabilities first published on this day (UTC), newest first.
28 results · Clear filters · Feed
-
High 7.1
jcvi vulnerable to Configuration Injection due to unsanitized user input
jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user ma…
-
High 8.5
Nextcloud user scoped external storage can be used to gather credentials of other users
Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, …
-
High 7.6
Nextcloud system addressbooks can be modified by malicious trusted server
NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12,…
-
High 8.7
Nextcloud Server password reset endpoint is not brute force protected
NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12,…
-
High 7.2
Knowage-Server vulnerable to account validation bypass
Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.8, an attacker can register and activate their account without having to click on the link included in the email, allowing them access to t…
-
High 7.7
Remote inventory task command injection when using ssh command mode
The GLPI Agent is a generic management agent. Prior to version 1.5, if glpi-agent is running remoteinventory task against an Unix platform with ssh command, an administrator user on the remote can manage to inject a command in a specific workflow the agent wo…
-
High 8.5
XWiki Platform vulnerable to reflected cross-site scripting via delattachment action
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if …
-
High 8.8CVE-2023-35155 Scanner template
XWiki Platform vulnerable to cross-site scripting in target parameter via share page by email
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). For instance, the following URL execute an `alter` on the b…
-
High 8.0
Code Injection in fossbilling/fossbilling
Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1.
-
High 7.1
NVIDIA Jetson contains a vulnerability in CBoot, where the PCIe controller is initialized without IOMMU, which may allo…
-
High 7.8
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where unexpected untrusted data is parsed, whi…
-
High 7.5
XWiki Platform may show email addresses in clear in REST results
XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. The issue has be…
-
High 7.5
XWiki Platform may retrieve email addresses of all users
XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mail obfuscation configuration was not fully taken into account. While the mail displayed to the end user was obfuscated, …
-
High 7.5
WordPress MStore API Plugin <= 3.9.7 is vulnerable to SQL Injection
Unauth. SQL Injection (SQLi) vulnerability in InspireUI MStore API plugin <= 3.9.7 versions.
-
High 7.1
WordPress The7 Theme <= 11.6.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Dream-Theme The7 plugin <= 11.6.0 versions.
-
High 7.1
WordPress Church Admin Plugin <= 3.7.29 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moyle Church Admin plugin <= 3.7.29 versions.
-
High 7.1
WordPress Premium Addons PRO Plugin <= 2.8.24 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Premium Addons for Elementor Premium Addons PRO plugin <= 2.8.24 versions.
-
High 8.2
Dell BIOS contains an improper authentication vulnerability. A locally authenticated malicious user may potentially exp…
-
High 8.8
Apache StreamPipes: Privilege escalation through non-admin user
A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles. The issue is resolved by…
-
High 7.5
Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability
Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability
-
High 7.8
An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 1…
KEV Jun 23, 2023 -
High 8.6
The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4,…
KEV May 22, 2023 -
High 8.8
A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safa…
KEV Jun 23, 2023 -
High 8.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, ma…
KEV May 22, 2023 -
High 8.8
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.…
KEV Jun 23, 2023 -
High 8.8
LibreDWG v0.10 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit_utf8_to_TU at bits.c.
-
High 7.1
A use-after-free flaw was found in mt7921_check_offload_capability in drivers/net/wireless/mediatek/mt76/mt7921/init.c …
-
High 8.8
RaspAP raspap-webgui Command Injection vulnerability
Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.