Archive
26 July 2023
Vulnerabilities first published on this day (UTC), newest first.
73 results · Feed
-
Medium 4.7
Null pointer dereference in paddle.flip
Null pointer dereference in paddle.flip in PaddlePaddle before 2.5.0. This resulted in a runtime crash and denial of service.
-
High 8.3
Use after free in PaddlePaddle
Use after free in paddle.diagonal in PaddlePaddle before 2.5.0. This resulted in a potentially exploitable condition.
-
Critical 9.8
Apache Helix: Deserialization vulnerability in Helix workflow and REST
An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remo…
-
Unscored —CVE-2023-38433 Scanner template
Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthentica…
-
Unscored —
Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent un…
-
Medium 5.8
Dell ECS Streamer, versions prior to 2.0.7.1, contain an insertion of sensitive information in log files vulnerability.…
-
Medium 5.0
Insertion of Sensitive Information Into Sent Data in GitLab
An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies on redirect during authorization.
-
Medium 6.5
VMware Tanzu Application Service for VMs and Isolation Segment information disclosure vulnerability
The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform syste…
-
High 7.5
A vulnerability exists in HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The v…
-
High 7.5
A vulnerability exists in the HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. T…
-
Medium 5.4
A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated a…
-
Low 3.7
Video Conferencing with Zoom <= 4.2.1 - Sensitive Information Exposure
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This makes it possible for unauthenticated …
-
High 7.8CVE-2023-32629 Public exploit
Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks…
-
High 7.8
On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overla…
-
Unscored —CVE-2023-33802 Public exploit
A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of Service (DoS) via a crafted text fi…
-
Unscored —
Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.
-
Unscored —
An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper s…
-
Unscored —
An XSS issue was discovered in FSMLabs TimeKeeper 8.0.17. On the "Configuration -> Compliance -> Add a new compliance r…
-
High 7.8
AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for …
-
Unscored —CVE-2023-30367 Public exploit
Multi-Remote Next Generation Connection Manager (mRemoteNG) is free software that enables users to store and manage mul…
-
Unscored —
emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\template.php.
-
Medium 5.4
Stored Cross-Site Scripting October CMS
An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file.
-
Unscored —
Netdisco before v2.063000 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Web/T…
-
Unscored —
Netdisco before v2.063000 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulner…
-
Unscored —
Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c and /elf/elf.c, which allows the attack…
-
Unscored —
ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which al…
-
Unscored —
SQL injection vulnerability found in PrestaShop sendinblue v.4.0.15 and before allow a remote attacker to gain privileg…
-
Medium 6.1
A cross-site scripting (XSS) vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HTML…
-
Unscored —
* A cross-site scripting (XSS) vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HT…
-
Unscored —
Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data inp…
-
Unscored —
Interactive Forms (IAF) in GX Software XperienCentral versions 10.31.0 until 10.33.0 was vulnerable to cross site reque…
-
Unscored —
Interactive Forms (IAF) in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scrip…
-
Unscored —
POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are …