Archive
June 2023
Vulnerabilities first published in this month (UTC), newest first.
2,424 results · Feed
-
Unscored —
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
-
Medium 5.3
Vulnerability of bypassing the default desktop security controls.Successful exploitation of this vulnerability may caus…
-
Unscored —
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
-
Unscored —
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
-
Unscored —
Vulnerability of missing authentication on certain HUAWEI phones.Successful exploitation of this vulnerability can lead…
-
Unscored —
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
-
Unscored —
Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulner…
-
Unscored —
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
-
Unscored —
Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulner…
-
High 7.5
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
-
Unscored —
Vulnerability of unauthorized access to foreground app information.Successful exploitation of this vulnerability may ca…
-
Low 2.4
PuneethReddyHC online-shopping-system-advanced addsuppliers.php cross site scripting
A vulnerability, which was classified as problematic, was found in PuneethReddyHC online-shopping-system-advanced 1.0. This affects an unknown part of the file addsuppliers.php. The manipulation of the argument First name leads to cross site scripting. It is …
-
Medium 6.3
code-projects Agro-School Management System loaddata.php sql injection
A vulnerability, which was classified as critical, has been found in code-projects Agro-School Management System 1.0. Affected by this issue is some unknown functionality of the file loaddata.php. The manipulation of the argument subject/course leads to sql i…
-
Low 3.5
SourceCodester Resort Reservation System Manage Room Page ?page=rooms cross site scripting
A vulnerability classified as problematic was found in SourceCodester Resort Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file ?page=rooms of the component Manage Room Page. The manipulation of the argument Cottage…
-
Medium 5.5
whaleal IceFrog Aviator Template Engine deserialization
A vulnerability classified as problematic has been found in whaleal IceFrog 1.1.8. Affected is an unknown function of the component Aviator Template Engine. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be use…
-
Medium 6.3
miniCal sql injection
A vulnerability was found in miniCal 1.0.0. It has been rated as critical. This issue affects some unknown processing of the file /booking/show_bookings/. The manipulation of the argument search_query leads to sql injection. The attack may be initiated remote…
-
High 7.3CVE-2023-3306 EPSS 23%
Ruijie RG-EW1200G Admin Password app.09df2a9e44ab48766f5f.js access control
A vulnerability was found in Ruijie RG-EW1200G EW_3.0(1)B11P204. It has been declared as critical. This vulnerability affects unknown code of the file app.09df2a9e44ab48766f5f.js of the component Admin Password Handler. The manipulation leads to improper acce…
-
High 7.3
C-DATA Web Management System User Creation access control
A vulnerability was found in C-DATA Web Management System up to 20230607. It has been classified as critical. This affects an unknown part of the file /cgi-bin/jumpto.php?class=user&page=config_save&isphp=1 of the component User Creation Handler. The manipula…
-
Unscored —
An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/eth…
-
High 7.0CVE-2023-35828 Public exploit
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/…
-
Unscored —
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in drivers/stagin…
-
High 7.0
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/…
-
High 7.0
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/medi…
-
Unscored —
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in cedrus_remove in drivers/stagin…
-
High 8.8
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.66 - Authenticated (Contributor+) Arbitrary File Upload
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation of files in the file manager functionality in versions up to, and including, 1.5.66 . This makes i…
-
High 7.8
Microsoft Publisher Remote Code Execution Vulnerability
Microsoft Publisher Remote Code Execution Vulnerability
-
High 7.8
Microsoft Publisher Remote Code Execution Vulnerability
Microsoft Publisher Remote Code Execution Vulnerability
-
Unscored —
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have bee…
-
High 8.8
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. An Unrestricted File Upload vulner…
-
Unscored —
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Second-Order PHP Object Injectio…
-
Unscored —
Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Exper…
-
Unscored —
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability …
-
Critical 9.8
Nanopb before 0.3.1 allows size_t overflows in pb_dec_bytes and pb_dec_string.
-
Medium 5.3
OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees
OpenZeppelin Contracts is a library for smart contract development. Starting in version 4.7.0 and prior to version 4.9.2, when the `verifyMultiProof`, `verifyMultiProofCalldata`, `procesprocessMultiProof`, or `processMultiProofCalldat` functions are in use, i…
-
Unscored —
The MC990 X and UV300 RMC component has and inadequate default configuration that could be exploited to obtain enhanced…
-
Unscored —
A security vulnerability in HPE Insight Remote Support may result in the local disclosure of privileged LDAP informatio…
-
Unscored —
HP-UX could be exploited locally to create a Denial of Service (DoS) when any physical interface is configured with IPv…
-
Low —
@apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces
### Context Content Security Policies (CSP) are a defense-in-depth strategy against XSS attacks. Improper application of CSP isn't itself a vulnerability, but it does fail to prevent XSS in the event that there is a viable attack vector for an XSS attack. ###…
-
High 8.8
rudder-server vulnerable to SQL Injection
rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the `rudder` role in PostgresSQL having…
-
Unscored —
There is a traffic hijacking vulnerability in Huawei routers. Successful exploitation of this vulnerability can cause p…