Archive
June 2023
Vulnerabilities first published in this month (UTC), newest first.
2,424 results · Feed
-
Medium 5.9
MainWP Child <= 4.4.1.1 - Information Disclosure via Back-Up Files
The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on the storage of back-up files. This makes it possible for unauthenticated attackers to extract sensi…
-
Medium 5.3
EmbedPress <= 3.7.3 - Sensitive Information Exposure
The EmbedPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'lock_content_form_handler' and 'display_password_form' function in versions up to, and including, 3.7.3. This makes it possible for una…
-
Unscored —
Cross Site Request Forgery (CSRF) vulnerability was discovered in CatfishCMS 4.8.63 that would allow attackers to obtai…
-
Unscored —
Stored cross site scripting (XSS) vulnerability in Chaoji CMS v2.18 that allows attackers to execute arbitrary code via…
-
Unscored —
A Cross site request forgery (CSRF) vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to cr…
-
Unscored —
An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of…
-
Unscored —
An cross site request forgery (CSRF) vulnerability discovered in Jymusic v2.0.0.,that allows attackers to execute arbit…
-
Unscored —
Stored cross site scripting (XSS) vulnerability in /index.php?admin-master-navmenu-add of Chaoji CMS v2.18 that allows …
-
Unscored —
A stored cross site scripting (XSS) vulnerability in /index.php?admin-master-article-edit of Chaoji CMS v2.18 that allo…
-
Unscored —
An issue was discovered in espcms version P8.18101601. There is a cross site scripting (XSS) vulnerability that allows …
-
Unscored —
Directory Traversal vulnerability found in Cryptoprof WCMS v.0.3.2 allows a remote attacker to execute arbitrary code v…
-
Unscored —CVE-2023-34839 Public exploit
A Cross Site Request Forgery (CSRF) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain pri…
-
Unscored —CVE-2023-34838 Public exploit
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remo…
-
Unscored —CVE-2023-34836 Public exploit
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remo…
-
Unscored —CVE-2023-34837 Public exploit
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remo…
-
Unscored —CVE-2023-34830 Public exploit
i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout paramete…
-
Unscored —CVE-2023-34835 Public exploit
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remo…
-
Unscored —
Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. An ACL entry on the SES Evolution…
-
Unscored —
Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the S…
-
Unscored —
A maliciously crafted file consumed through pskernel.dll file could lead to memory corruption vulnerabilities. These vu…
-
Unscored —
A maliciously crafted SKP file in Autodesk Navisworks 2023 and 2022 be used to trigger use-after-free vulnerability. Ex…
-
Unscored —
A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of th…
-
Unscored —
A maliciously crafted pskernel.dll file in Autodesk products is used to trigger integer overflow vulnerabilities. Explo…
-
Unscored —
Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice 2.02.1_SC_UTF8 allows unauthent…
-
Unscored —CVE-2021-30203 Scanner template
A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers…
-
Low 2.7
The contour service was not checking that users had permission to create an analysis for a given dataset
The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass folders with extraneous analyses, that the attacker would otherwise not have permission to create.
-
Critical 9.8
CVE-2023-30945
Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious attacker co…
-
Unscored —
A remote attacker could leverage a vulnerability in Trend Micro Mobile Security (Enterprise) 9.8 SP5 to download a part…
-
Unscored —
An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could …
-
Unscored —
An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could …
-
Unscored —
An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could …
-
Unscored —
An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow…
-
Unscored —
An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow…
-
Unscored —
Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site …
-
Unscored —
Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site …
-
Unscored —
A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated att…
-
Unscored —
A link following vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker…
-
Unscored —
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a loc…
-
Unscored —
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a loc…
-
Unscored —
An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticat…