Archive
June 2023
Vulnerabilities first published in this month (UTC), newest first.
2,424 results · Feed
-
Unscored —
An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticat…
-
Unscored —
Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site …
-
Unscored —
Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site …
-
Unscored —
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks…
-
Unscored —
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks…
-
Unscored —
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks…
-
Unscored —
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks…
-
Unscored —
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks…
-
Unscored —
Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated use…
-
Unscored —
Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated use…
-
Unscored —
Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to e…
-
Unscored —
Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to e…
-
Unscored —
Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to …
-
Unscored —
Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to …
-
Unscored —
Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote us…
-
Unscored —
Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote us…
-
Unscored —
A path traversal exists in a specific dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an auth…
-
Unscored —CVE-2023-32521 EPSS 67%
A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow…
-
Unscored —
A privilege escalation vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local at…
-
Unscored —
Trend Micro Security 2021, 2022, and 2023 (Consumer) are vulnerable to a DLL Hijacking vulnerability which could allow …
-
Medium 6.3
Unauthorized users can manipulate a dashboard created by an administrator in DataEase
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions a missing authorization check allows unauthorized users to manipulate a dashboard created by the administrator. This vulner…
-
High 8.8
Use after free in Media in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap …
-
Unscored —
Use after free in Guest View in Google Chrome prior to 114.0.5735.198 allowed an attacker who convinced a user to insta…
-
High 8.8CVE-2023-3420 EPSS 56%
Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap cor…
-
High 8.1
Unauthorized users can delete applications in DataEase
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions Unauthorized users can delete an application erroneously. This vulnerability has been fixed in version 1.18.8. Users are ad…
-
Medium 6.5
DataEase has a privilege bypass vulnerability
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privilege bypass vulnerability where ordinary users can gain access to the user database. Exposed informatio…
-
Medium 4.8
Blind SSRF When Uploading Presentation in BigBlueButton
BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery (SSRF) vulnerability. In an `insertDocument` API request the user is able to supply a URL …
-
Medium 6.5
A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through …
-
Medium 6.5
A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically…
-
High 7.2
A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted cal…
-
High 8.1
A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to…
-
High 8.2
An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) se…
-
Medium 5.4
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API c…
-
High 7.5
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which c…
-
Medium 6.4
A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with local access and ele…
-
Low 3.7
LookupResources may return partial results in spicedb
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affe…
-
Medium 5.9
OpenFGA denial of service die to circular relationship
OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship defi…
-
Medium 6.3
Tenable Plugin Feed ID #202306261202 Fixes Privilege Escalation Vulnerability
Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.This issue affects Tenable.Io: before Plugin Feed ID #202306261202 ; Nessus: before Plugin Feed ID #202306261202 ; Security Center: before Plugin Feed ID #202306261202 . This vulnera…
-
Medium 5.9
WordPress SimpleModal Contact Form (SMCF) Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Martin SimpleModal Contact Form (SMCF) plugin <= 1.2.9 versions.
-
Medium 6.5
WordPress Connections Business Directory Plugin <= 10.4.36 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Steven A. Zahm Connections Business Directory plugin <= 10.4.36 versions.