Archive
July 2023
Vulnerabilities first published in this month (UTC), newest first.
2,318 results · Feed
-
Unscored —
An issue was discovered in Webmin 2.021. A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file u…
-
Unscored —
In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and…
-
Unscored —
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users …
-
Unscored —
An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitra…
-
Unscored —
An issue was discovered in Webmin 2.021. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the pac…
-
Unscored —
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users …
-
Unscored —
An issue was discovered in Webmin 2.021. The download functionality allows an attacker to exploit a Cross-Site Scriptin…
-
Unscored —
An issue was discovered in Webmin 2.021. One can exploit a stored Cross-Site Scripting (XSS) attack to achieve Remote C…
-
Unscored —
An issue was discovered in Webmin 2.021. A Cross-Site Scripting (XSS) vulnerability was discovered in the HTTP Tunnel f…
-
Unscored —
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the System…
-
Unscored —
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the config…
-
Critical 9.8
Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via…
-
High 8.8
Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via…
-
Unscored —
Authentication Bypass vulnerability in D-Link DIR-885L FW102b01 allows remote attackers to gain escalated privileges vi…
-
Unscored —
Authentication Bypass vulnerability in D-Link DIR-645 firmware version 1.03 allows remote attackers to gain escalated p…
-
Unscored —CVE-2023-3983 EPSS 17%
An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. An authenti…
-
Unscored —CVE-2023-37771 Public exploit
Art Gallery Management System v1.0 contains a SQL injection vulnerability via the cid parameter at /agms/product.php.
-
Unscored —
SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php.
-
Medium 6.1
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
KEV Jul 27, 2023 -
Unscored —
Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Server-Side Request Forgery (SSRF).
-
Unscored —
Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Directory Traversal.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in neofarg-cms 0.2.3 allows remoate attacker to run arbitrary code via the cop…
-
Unscored —
Deserialization of Untrusted Data vulnerability in yolo 3 allows attackers to execute arbitrary code via crafted yaml f…
-
Unscored —
Deserialization of Untrusted Data vulnerability in yolo 5 allows attackers to execute arbitrary code via crafted yaml f…
-
Unscored —
`dlopen_derive` is unmaintained
`dlopen_derive` hasn't been updated since June 9, 2019. `dlopen_derive` depends on [`quote = "0.6.12"`] and [`syn = "0.15.34"`]. Versions `1.0.0` of these dependencies were published on August 13, 2019. The `0.*` versions haven't received updates since. Note …
-
High 7.3
Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File
Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File
-
High 7.5
Tadiran Telecom Aeonix - CWE-22: Improper Limitation of a Pathname to a Restricted Directory
Tadiran Telecom Aeonix - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
-
Medium 5.3
Tadiran Telecom Aeonix - CWE-204: Observable Response Discrepancy
Tadiran Telecom Aeonix - CWE-204: Observable Response Discrepancy
-
High 7.5
AnaSystem SensMini M4 – an authenticated user can cause Denial of Service
AnaSystem SensMini M4 – Using the configuration tool, an authenticated user can cause Denial of Service for the device
-
Medium 6.2
JBL soundbar multibeam 5.1 - CWE-798: Use of Hard-coded Credentials
JBL soundbar multibeam 5.1 - CWE-798: Use of Hard-coded Credentials
-
Critical 9.8
Heights Telecom ERO1xS-Pro Dual-Band WiFi command injection
Heights Telecom ERO1xS-Pro Dual-Band FW version BZ_ERO1XP.025.
-
High 8.8
Synel SYnergy Fingerprint Terminals - CWE-78: 'OS Command Injection'
Synel SYnergy Fingerprint Terminals - CWE-78: 'OS Command Injection'
-
Critical 9.8
Synel SYnergy Fingerprint Terminals - CWE-798: Use of Hard-coded Credentials
Synel SYnergy Fingerprint Terminals - CWE-798: Use of Hard-coded Credentials
-
High 8.3
Sysaid - CWE-552: Files or Directories Accessible to External Parties
Sysaid - CWE-552: Files or Directories Accessible to External Parties - Authenticated users may exfiltrate files from the server via an unspecified method.
-
Critical 9.8
Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type
Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method.
-
High 8.8CVE-2023-36542 Public exploit
Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources
Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution i…
-
Unscored —
Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass na…
-
Unscored —
Insufficient policy enforcement in File System API in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to…
-
Unscored —
Inappropriate implementation in Sandbox in Google Chrome on Windows prior to 112.0.5615.49 allowed a remote attacker wh…
-
Medium 6.5
Insufficient policy enforcement in Intents in Google Chrome on Android prior to 109.0.5414.119 allowed a remote attacke…