Archive
28 June 2023
Vulnerabilities first published on this day (UTC), newest first.
24 results · Clear filters · Feed
-
Medium 4.7
Ruijie RG-BCR860 Network Diagnostic Page os command injection
A vulnerability was found in Ruijie RG-BCR860 2.5.13 and classified as critical. This issue affects some unknown processing of the component Network Diagnostic Page. The manipulation leads to os command injection. The attack may be initiated remotely. The exp…
-
Medium 5.5
IBOS OA Interview Management Export export&interviews=x actionExport sql injection
A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects the function actionExport of the file ?r=recruit/interview/export&interviews=x of the component Interview Management Export. The manipulation of the argumen…
-
Medium 6.3
IBM Informix JDBC code execution
IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver do not verify supplied LDAP URL in Connect String. IBM X-Force ID: 249511.
-
Medium 4.7
Reflected XSS in BKG Ntrip Professional Caster version <=2.0.44
Reflected XSS affects the ‘mode’ parameter in the /admin functionality of the web application in versions <=2.0.44
-
Medium 4.3
Subscribe2 <= 10.40 - Missing Authorization
The Subscribe2 plugin for WordPress is vulnerable to unauthorized access to email functionality due to a missing capability check when sending test emails in versions up to, and including, 10.40. This makes it possible for author-level attackers to send email…
-
Medium 4.3
Subscribe2 <= 10.40 - Cross-Site Request Forgery
The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40. This is due to missing or incorrect nonce validation when sending test emails. This makes it possible for unauthenticated attackers to sen…
-
Medium 5.4
Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer
The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'save_customer' function. This makes it possible for unauthenticated…
-
Medium 5.5
An issue was discovered in the Linux kernel brcm_nvram_parse in drivers/nvmem/brcm_nvram.c. Lacks for the check of the …
-
Medium 5.5
A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver. This flaw allows a local us…
-
Medium 5.5
A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a…
-
Medium 4.7
A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevan…
-
Medium 4.7
Null pointer dereference in submit_lookup_cmds() in drivers/gpu/drm/msm/msm_gem_submit.c
A NULL pointer dereference flaw was found in the Linux kernel's drivers/gpu/drm/msm/msm_gem_submit.c code in the submit_lookup_cmds function, which fails because it lacks a check of the return value of kmalloc(). This issue allows a local user to crash the sy…
-
Medium 6.5
An issue has been discovered in GitLab affecting all versions starting from 15.10 before 16.1, leading to a ReDoS vulne…
-
Medium 4.4
Improper access control vulnerability in SearchWidget prior to version 3.3 in China models allows untrusted application…
-
Medium 6.1
Improper privilege management vulnerability in CC Mode prior to SMR Jun-2023 Release 1 allows physical attackers to man…
-
Medium 6.2CVE-2023-21237 Exploited
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification…
KEV Mar 5, 2024 -
Medium 6.1
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager,…
-
Medium 4.8
A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Bu…
-
Medium 5.4
Cisco Secure Email Gateway, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance (ESA); and Cisco Secure Web Appliance, formerly Cisco Web Secu…
-
Medium 6.8
A vulnerability in the Administrative XML Web Service (AXL) API of Cisco Unified Communications Manager (Unified CM) an…
-
Medium 5.4
Cisco Secure Email Gateway, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance (ESA); and Cisco Secure Web Appliance, formerly Cisco Web Secu…
-
Medium 4.3
A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileg…
-
Medium 6.2
Cisco Duo Two-Factor Authentication for macOS Authentication Bypass Vulnerability
A vulnerability in Cisco Duo Two-Factor Authentication for macOS could allow an authenticated, physical attacker to bypass secondary authentication and access an affected macOS device. This vulnerability is due to the incorrect handling of responses from Cisc…
-
Medium 6.4
An issue has been discovered in GitLab affecting all versions starting from 15.7 before 15.8.5, from 15.9 before 15.9.4…