Archive
July 2023
Vulnerabilities first published in this month (UTC), newest first.
112 results · Clear filters · Feed
-
Critical 9.1CVE-2023-30799 Public exploit
MikroTik RouterOS Administrator Privilege Escalation
MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface. The attacker can abuse t…
-
Critical 9.1CVE-2023-34034 Public exploit
Access Control Bypass in Spring Security
Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.
-
High 7.5
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers…
-
Low 2.7
what3words Autosuggest Plugin Setting class-w3w-autosuggest-public.php enqueue_scripts information disclosure
A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the c…
-
High 7.3CVE-2023-34035 Public exploit
Spring Security's authorization rules can be misconfigured when using multiple servlets
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s Dispatche…
-
Medium 5.5CVE-2020-36762 Public exploit
ONS Digital RAS Collection Instrument comment.yml jobs os command injection
A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the file .github/workflows/comment.yml. The manipulation of the argument $COMMENT_BODY leads to os comma…
-
High 8.8CVE-2022-34155 Public exploit
WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken Authentication
Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.
-
Unscored —CVE-2023-38434 Public exploit
xHTTP 72f812d has a double free in close_connection in xhttp.c via a malformed HTTP request method.
-
High 8.8CVE-2023-33012 Public exploit
A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.…
-
Unscored —CVE-2023-2636 Public exploit
AN_GradeBook <= 5.0.1 - Subscriber+ SQLi
The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber
-
Unscored —CVE-2023-2579 Public exploit
InventoryPress <= 1.7 - Author+ Stored XSS
The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.
-
Unscored —CVE-2023-31851 Public exploit
Cudy LT400 1.13.4 is has a cross-site scripting (XSS) vulnerability in /cgi-bin/luci/admin/network/wireless/status via …
-
Unscored —CVE-2023-31852 Public exploit
Cudy LT400 1.13.4 is vulnerable to Cross Site Scripting (XSS) in cgi-bin/luci/admin/network/wireless/config via the ifa…
-
Unscored —CVE-2023-31853 Public exploit
Cudy LT400 1.13.4 is vulnerable Cross Site Scripting (XSS) in /cgi-bin/luci/admin/network/bandwidth via the icon parame…
-
High 7.5
Path traversal in copyparty
Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside …
-
High 8.1CVE-2023-37273 Public exploit
Docker escape in Auto-GPT when running from docker-compose.yml included in git repo
Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. Running Auto-GPT version prior to 0.4.3 by cloning the git repo and executing `docker compose run auto-gpt` in the repo root uses a different docker-c…
-
High 7.0
Heap overflow issue with the Lua cjson library used by Redis
Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions…
-
High 7.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and…
-
Unscored —CVE-2023-34132 Public exploit
Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-th…
-
High 8.8
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall G…
-
Critical 9.8
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authenticati…
-
Unscored —CVE-2023-33768 Public exploit
Incorrect signature verification of the firmware during the Device Firmware Update process of Belkin Wemo Smart Plug WS…
-
Unscored —CVE-2023-31704 Public exploit
Sourcecodester Online Computer and Laptop Store 1.0 is vulnerable to Incorrect Access Control, which allows remote atta…
-
Unscored —CVE-2023-31705 Public exploit
A Reflected Cross-site scripting (XSS) vulnerability in Sourcecodester Task Reminder System 1.0 allows an authenticated…
-
Unscored —CVE-2023-37598 Public exploit
A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial o…
-
Unscored —CVE-2023-37786 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts …
-
Unscored —
An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory
-
Unscored —CVE-2022-42045 Public exploit
Certain Zemana products are vulnerable to Arbitrary code injection. This affects Watchdog Anti-Malware 4.1.422 and Zema…
-
Unscored —CVE-2023-21251 Public exploit
In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper i…
-
Unscored —CVE-2023-21246 Public exploit
In ShortcutInfo of ShortcutInfo.java, there is a possible way for an app to retain notification listening access due to…
-
Unscored —CVE-2023-21238 Public exploit
In visitUris of RemoteViews.java, there is a possible leak of images between users due to a confused deputy. This could…
-
Unscored —CVE-2023-20918 Public exploit
In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused de…
-
Medium 5.9CVE-2023-3635 Public exploit
Okio GzipSource unhandled exception Denial of Service
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
-
High 7.3
Boss Mini document file inclusion
A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. The manipulation of the argument path leads to file inclusion. It is possible to initiate the attack r…
-
Unscored —CVE-2023-37456 Public exploit
The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affe…
-
Critical 9.8
Apache RocketMQ: Possible remote code execution when using the update configuration function
The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can ex…
-
Unscored —CVE-2023-33902 Public exploit
In bluetooth service, there is a missing permission check. This could lead to local information disclosure with no addi…
-
Unscored —CVE-2023-33668 Public exploit
DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access PII and takeover account…
-
Unscored —CVE-2023-36266 Public exploit
An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 (fixed in 17.2), and the KeeperFill Brow…
-
Unscored —CVE-2023-30226 Public exploit
An issue was discovered in function get_gnu_verneed in rizinorg Rizin prior to 0.5.0 verneed_entry allows attackers to …