Archive
5 July 2023
Vulnerabilities first published on this day (UTC), newest first.
80 results · Feed
-
Unscored —
Vulnerability of unstrict data verification and parameter check. Successful exploitation of this vulnerability may affe…
-
Unscored —
Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this v…
-
Medium 5.8
TLS Private Key Accessible to External Parties
A CWE-552 "Files or Directories Accessible to External Parties” in the web interface of the Tyan S5552 BMC version 3.00 allows an unauthenticated remote attacker to retrieve the private key of the TLS certificate in use by the BMC via forced browsing. This ca…
-
Unscored —
Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this v…
-
Medium 5.3
TN-5900 Series User Enumeration Vulnerability
TN-5900 Series version 3.3 and prior versions is vulnearble to user enumeration vulnerability. The vulnerability may allow a remote attacker to determine whether a user is valid during password recovery through the web login page and enable a brute force atta…
-
Unscored —
Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we presume that …
-
Unscored —
A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confus…
-
Unscored —
A use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry` object was freed and…
-
High 7.5
Frauscher Sensortechnik Diagnostic System FDS001 for FAdC/FAdCi Path Traversal vulnerability
Frauscher Sensortechnik GmbH FDS001 for FAdC/FAdCi v1.3.3 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a crafted URL without authentication. This enables an remote attacker to read all files on the filesys…
-
Unscored —
Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a…
-
Unscored —
The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability affects Firef…
-
Unscored —
A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensiv…
-
High 7.8
Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker t…
-
Unscored —
When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by usin…
-
Unscored —
Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed eviden…
-
Unscored —
When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerabili…
-
Unscored —
A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, …
-
Unscored —
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in …
-
Unscored —
An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerab…
-
Medium 6.5
Apache Any23: Possible excessive allocation of resources reading input.
** UNSUPPORTED WHEN ASSIGNED ** Use of TikaEncodingDetector in Apache Any23 can cause excessive memory usage.
-
Unscored —
A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to execute arbitrary web scripts…
-
Unscored —
gnuplot v5.5 was discovered to contain a buffer overflow via the function plotrequest().
-
Unscored —
taocms <=3.0.2 is vulnerable to Cross Site Scripting (XSS).
-
Medium 5.3
Bouncy Castle For Java LDAP injection vulnerability
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Cast…
-
Unscored —
Cross Site Scripting (XSS) in Sophos Sophos iView (The EOL was December 31st 2020) in grpname parameter that allows arb…
-
Unscored —
In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching t…
-
Unscored —
Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files.
-
Unscored —CVE-2023-36932 EPSS 81%
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1…
-
Critical 9.8
protobufjs Prototype Pollution vulnerability
"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and o…
-
Unscored —
Loxone Miniserver Go Gen.2 through 14.0.3.28 allows an authenticated operating system user to escalate privileges via t…
-
Unscored —CVE-2023-36933 EPSS 72%
In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023…
-
Unscored —
The root password of the Loxone Miniserver Go Gen.2 before 14.2 is calculated using hard-coded secrets and the MAC addr…
-
Unscored —
The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated admi…
-
Unscored —
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1…
-
Unscored —
PAX Technology A930 PayDroid_7.1.1_Virgo_V04.5.02_20220722 allows attackers to compile a malicious shared library and u…
-
Unscored —
PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow an attacker to gain root access by running a craf…
-
Medium 6.8
PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow the execution of arbitrary commands by using the …
-
Unscored —
A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of …
-
Medium 5.5
A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() …
-
Unscored —
Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the passwor…