Archive
June 2023
Vulnerabilities first published in this month (UTC), newest first.
656 results · Clear filters · Feed
-
High 8.2
ipandlanguageredirect extension vulnerable to SQL Injection
The ipandlanguageredirect extension before 5.1.2 for TYPO3 allows SQL Injection.
-
High 7.5CVE-2023-24243 Scanner template
CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF).
-
High 7.6
Cross-site Scripting (XSS) - Stored in salesagility/suitecrm-core
Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm-core prior to 8.3.0.
-
High 7.6
Cross-site Scripting (XSS) - DOM in saleor/react-storefront
Cross-site Scripting (XSS) - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7.
-
High 7.1
An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c …
-
High 7.7
There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings,…
-
High 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Forcepoint Cloud …
-
High 7.5
snappy-java's unchecked chunk length leads to DoS
snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in versions prior to 1.1.10.1. The code in the function hasNextChunk in the fileSnappyInputStream.java checks if a given st…
-
High 7.1
WordPress Admin side data storage for Contact Form 7 Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Zestard Technologies Admin side data storage for Contact Form 7 plugin <= 1.1.1 versions.
-
High 8.8
WordPress Intrepidity Theme <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability allows arbitrary file upload in Shingo Intrepidity plugin <= 1.5.1 versions.
-
High 7.1
Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access…
-
High 7.8
Local privilege escalation in ESET products for Linux and MacOS
During internal security analysis, a local privilege escalation vulnerability has been identified. On a machine with the affected ESET product installed, it was possible for a user with lower privileges due to improper privilege management to trigger actions …
-
High 7.0
Local privilege escalation using log file
The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for a standard user. The files are created and written with a SYSTEM account except one file (logplaceh…
-
High 7.0
Local privilege escalation
The Netskope client service running with NT\SYSTEM privileges accepts network connections from localhost to start various services and execute commands. The connection handling function of Netskope client before R100 in this service utilized a relative path t…
-
High 8.8
Liferay Portal and Liferay DXP Vulnerable to CSRF via the Layout Module
Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `…
-
High 7.2
IBM Security Directory Suite VA command execution
IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 228439.
-
High 7.5
IBM Security Directory Suite VA information disclosure
IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 228510.
-
High 7.2
IBM Security Directory Suite VA file upload
IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 228586.
-
High 7.5
IBM Security Directory Suite VA denial of service
IBM Security Directory Suite VA 8.0.1 could allow an attacker to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 228588.
-
High 8.1CVE-2023-33243 Public exploit
RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using th…
-
High 7.5
Some access control products are vulnerable to a session hijacking attack because the product does not update the sessi…
-
High 7.8
Adobe Animate FLA files Use After Free Arbitrary code execution
Adobe Animate versions 22.0.9 (and earlier) and 23.0.1 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that …
-
High 7.5
SolarWinds Serv-U Exposure of Sensitive Information Vulnerability
SolarWinds Serv-U is submitting an HTTP request when changing or updating the attributes for File Share or File request. Part of the URL of the request discloses sensitive data.
-
High 7.8
ZDI-CAN-20963: Adobe Substance 3D Designer SBS File Parsing Uninitialized Variable Remote Code Execution Vulnerability
Adobe Substance 3D Designer version 12.4.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in …
-
High 7.5
Adobe Commerce Incorrect Authorization Security feature bypass
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to leak anoth…
-
High 8.8
Grav Server-side Template Injection (SSTI) via Twig Default Filters
Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Co…
-
High 8.8
Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass
Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple…
-
High 8.8
Grav Server-side Template Injection via Insufficient Validation in filterFilter
Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a st…
-
High 7.8
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrar…
-
High 7.8
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrar…
-
High 7.8
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrar…
-
High 7.0
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrar…
-
High 7.8
GlobalProtect App: Local Privilege Escalation (PE) Vulnerability
A local privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user to execute programs with elevated privileges.
-
High 7.0
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrar…
-
High 7.0
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrar…
-
High 7.5
.NET and Visual Studio Denial of Service Vulnerability
.NET and Visual Studio Denial of Service Vulnerability
-
High 7.1
NuGet Client Remote Code Execution Vulnerability
NuGet Client Remote Code Execution Vulnerability
-
High 7.5
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
-
High 7.5
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
-
High 7.8
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability