Archive
11 July 2023
Vulnerabilities first published on this day (UTC), newest first.
278 results · Feed
-
Low —
Vendure Cross Site Request Forgery vulnerability impacting all API requests
### Impact Vendure is an e-commerce GraphQL framework with a number of APIs and different levels of authorization. By default the Cookie settings are insecure, having the SameSite setting as false which results in not having one (originates from the cookie-se…
-
Medium 6.5
A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries
Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r ### Summary Jaeger UI is using the `json-markup` dependency to display span attributes and resources. This dependency is not sanitising keys …
-
Critical 9.6
A vulnerability has been discovered in the Citrix Secure Access client for Ubuntu which, if exploited, could allow an a…
-
High 7.8
A vulnerability has been discovered in the Citrix Secure Access client for Windows which, if exploited, could allow an …
-
High 7.5
Improper Authentication in iSTAR
An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.
-
Unscored —
Extension - advcomsys.com - XSS in oneVote component for Joomla <= 1.7.0
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script Elements.
-
Unscored —CVE-2023-29406 Public exploit
Insufficient sanitization of Host header in net/http
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Reque…
-
Medium 6.5
A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the powe…
-
Medium 5.0
Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page
Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup two factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute …
-
High 7.5
Windows Search Remote Code Execution Vulnerability
Windows Search Remote Code Execution Vulnerability
KEV Jul 17, 2023 -
Medium 6.3
Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System UpLoadFloodPlanFile UpLoadFloodPlanFile.ashx unrestricted upload
A vulnerability, which was classified as critical, has been found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706. This issue affects some unknown processing of the file /Duty/AjaxHandle/UpLoadFloodPlanFile.a…
-
High 8.8
MediaWiki PandocUpload Extension Remote Code Execution Vulnerability
MediaWiki PandocUpload Extension Remote Code Execution Vulnerability
-
Critical 9.7
Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution
Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untruste…
-
High 8.1
Decidim Cross-site Scripting vulnerability in the processes filter
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The processes filter feature is susceptible to Cross-site scripting. This allows a remot…
-
Medium 6.3
Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System Duty Write-UploadFile UploadFile.ashx unrestricted upload
A vulnerability classified as critical was found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706. This vulnerability affects unknown code of the file /Duty/AjaxHandle/Write/UploadFile.ashx of the component Du…
-
High 7.5
Decidim vulnerable to sensitive data disclosure
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collecti…
-
High 8.1
Decidim Cross-site Scripting vulnerability in the external link redirections
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The external link feature is susceptible to cross-site scripting. This allows a remote a…
-
High 8.4
RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape
RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible …
-
High 8.4
Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an es…
-
High 7.3
Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable…
-
High 8.2
Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user…
-
High 8.2
Insecure temporary file in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated us…
-
Medium 6.5
Azure Active Directory Security Feature Bypass Vulnerability
Azure Active Directory Security Feature Bypass Vulnerability
-
Medium 6.5
Azure Service Fabric on Windows Information Disclosure Vulnerability
Azure Service Fabric on Windows Information Disclosure Vulnerability
-
High 7.8
Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability
Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability
-
High 7.8
Paint 3D Remote Code Execution Vulnerability
Paint 3D Remote Code Execution Vulnerability
-
Medium 5.3
Mono Authenticode Validation Spoofing Vulnerability
Mono Authenticode Validation Spoofing Vulnerability
-
High 8.2
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
-
High 8.8
Microsoft Outlook Security Feature Bypass Vulnerability
Microsoft Outlook Security Feature Bypass Vulnerability
KEV Jul 11, 2023 -
High 7.8
Microsoft VOLSNAP.SYS Elevation of Privilege Vulnerability
Microsoft VOLSNAP.SYS Elevation of Privilege Vulnerability
-
Medium 6.6
Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
-
High 7.5
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
-
Medium 6.5
Windows MSHTML Platform Security Feature Bypass Vulnerability
Windows MSHTML Platform Security Feature Bypass Vulnerability
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
Medium 5.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
-
High 8.8
USB Audio Class System Driver Remote Code Execution Vulnerability
USB Audio Class System Driver Remote Code Execution Vulnerability
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
High 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
-
High 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
-
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability