Archive
June 2023
Vulnerabilities first published in this month (UTC), newest first.
131 results · Clear filters · Feed
-
High 8.2
A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege e…
-
Critical 9.8
Remote Code Execution in OpenTSDB
OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. Th…
-
Medium 6.1CVE-2023-34840 Public exploit
angular-ui-notification Cross-site Scripting vulnerability
angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.
-
Unscored —CVE-2023-1206 Public exploit
A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a use…
-
Unscored —
An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to downl…
-
Unscored —CVE-2023-36146 Public exploit
A Stored Cross-Site Scripting (XSS) vulnerability was found in Multilaser RE 170 using firmware 2.2.6733.
-
Unscored —CVE-2023-36143 Public exploit
Maxprint Maxlink 1200G v3.4.11E has an OS command injection vulnerability in the "Diagnostic tool" functionality of the…
-
Medium 6.5CVE-2023-3338 Public exploit
Crash due to a null pointer dereference in the dn_nsp_send function
A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash the system.
-
Critical 9.1CVE-2023-36471 Public exploit
HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml
Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either cr…
-
Critical 9.8
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login …
-
Unscored —CVE-2023-34834 Public exploit
A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attacke…
-
Unscored —
Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to e…
-
Unscored —
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several file…
-
High 7.8CVE-2023-3390 Public exploit
Use-after-free in Linux kernel's netfilter subsystem
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vu…
-
Medium 4.7
Ruijie RG-BCR860 Network Diagnostic Page os command injection
A vulnerability was found in Ruijie RG-BCR860 2.5.13 and classified as critical. This issue affects some unknown processing of the component Network Diagnostic Page. The manipulation leads to os command injection. The attack may be initiated remotely. The exp…
-
Unscored —
Traggo Server 0.3.0 is vulnerable to directory traversal via a crafted GET request.
-
Unscored —CVE-2023-33592 Public exploit
Lost and Found Information System v1.0 was discovered to contain a SQL injection vulnerability via the component /php-l…
-
Unscored —CVE-2023-21173 Public exploit
In multiple methods of DataUsageList.java, there is a possible way to learn about admin user's network activities due t…
-
High 7.8CVE-2023-20178 Public exploit
A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco …
-
Unscored —CVE-2022-44276 Public exploit
In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE.
-
Unscored —
File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode
The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the …
-
Unscored —
Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution
The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of …
-
Unscored —CVE-2023-2744 Public exploit
WP ERP < 1.12.4 - Admin+ SQL Injection
The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as…
-
Unscored —CVE-2023-34839 Public exploit
A Cross Site Request Forgery (CSRF) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain pri…
-
Unscored —CVE-2023-34838 Public exploit
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remo…
-
Unscored —CVE-2023-34836 Public exploit
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remo…
-
Unscored —CVE-2023-34837 Public exploit
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remo…
-
Unscored —CVE-2023-34830 Public exploit
i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout paramete…
-
Unscored —CVE-2023-34835 Public exploit
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remo…
-
Unscored —CVE-2023-34924 Public exploit
H3C Magic B1STW B1STV100R012 was discovered to contain a stack overflow via the function SetAPInfoById. This vulnerabil…
-
Unscored —CVE-2023-33580 Public exploit
Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the "Admin Name" …
-
Unscored —
An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net ver…
-
High 7.5CVE-2023-36661 Public exploit
Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyI…
-
Unscored —CVE-2023-36664 Public exploit
Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | p…
-
Unscored —CVE-2023-35801 Public exploit
A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass validation…
-
Unscored —CVE-2023-32413 Public exploit
A race condition was addressed with improved state handling. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventu…
-
High 7.8
An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 1…
KEV Jun 23, 2023 -
Unscored —CVE-2023-32353 Public exploit
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.9 for Windows. An app may be able…
-
Unscored —CVE-2023-32422 Public exploit
This issue was addressed by adding additional SQLite logging restrictions. This issue is fixed in iOS 16.5 and iPadOS 1…
-
Unscored —CVE-2023-32407 Public exploit
A logic issue was addressed with improved state management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventur…