Archive
July 2023
Vulnerabilities first published in this month (UTC), newest first.
2,318 results · Feed
-
High 8.3
Heap buffer overflow in paddle.trace
Heap buffer overflow in paddle.trace in PaddlePaddle before 2.5.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible.
-
High 7.2CVE-2023-28130 EPSS 21%
Local user may lead to privilege escalation using Gaia Portal hostnames page.
-
Medium 4.7
Null pointer dereference in paddle.flip
Null pointer dereference in paddle.flip in PaddlePaddle before 2.5.0. This resulted in a runtime crash and denial of service.
-
High 8.3
Use after free in PaddlePaddle
Use after free in paddle.diagonal in PaddlePaddle before 2.5.0. This resulted in a potentially exploitable condition.
-
Critical 9.8
Apache Helix: Deserialization vulnerability in Helix workflow and REST
An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remo…
-
Unscored —CVE-2023-38433 Scanner template
Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthentica…
-
Unscored —
Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent un…
-
Medium 5.8
Dell ECS Streamer, versions prior to 2.0.7.1, contain an insertion of sensitive information in log files vulnerability.…
-
Medium 5.0
Insertion of Sensitive Information Into Sent Data in GitLab
An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies on redirect during authorization.
-
Medium 6.5
VMware Tanzu Application Service for VMs and Isolation Segment information disclosure vulnerability
The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform syste…
-
High 7.5
A vulnerability exists in HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The v…
-
High 7.5
A vulnerability exists in the HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. T…
-
Medium 5.4
A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated a…
-
Low 3.7
Video Conferencing with Zoom <= 4.2.1 - Sensitive Information Exposure
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This makes it possible for unauthenticated …
-
High 7.8CVE-2023-32629 Public exploit
Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks…
-
High 7.8
On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overla…
-
Unscored —CVE-2023-33802 Public exploit
A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of Service (DoS) via a crafted text fi…
-
Unscored —
Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.
-
Unscored —
An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper s…
-
Unscored —
An XSS issue was discovered in FSMLabs TimeKeeper 8.0.17. On the "Configuration -> Compliance -> Add a new compliance r…
-
High 7.8
AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for …
-
Unscored —CVE-2023-30367 Public exploit
Multi-Remote Next Generation Connection Manager (mRemoteNG) is free software that enables users to store and manage mul…
-
Unscored —
emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\template.php.
-
Medium 5.4
Stored Cross-Site Scripting October CMS
An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file.
-
Unscored —
Netdisco before v2.063000 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Web/T…
-
Unscored —
Netdisco before v2.063000 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulner…
-
Unscored —
Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c and /elf/elf.c, which allows the attack…
-
Unscored —
ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which al…
-
Unscored —
SQL injection vulnerability found in PrestaShop sendinblue v.4.0.15 and before allow a remote attacker to gain privileg…
-
Medium 6.1
A cross-site scripting (XSS) vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HTML…
-
Unscored —
* A cross-site scripting (XSS) vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HT…
-
Unscored —
Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data inp…
-
Unscored —
Interactive Forms (IAF) in GX Software XperienCentral versions 10.31.0 until 10.33.0 was vulnerable to cross site reque…
-
Unscored —
Interactive Forms (IAF) in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scrip…
-
Unscored —
POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are …
-
Medium 5.7
Directus has Incorrect Permission Checking for GraphQL Subscriptions
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.3.0 and prior to version 10.5.0, the permission filters (i.e. `user_created IS $CURRENT_USER`) are not properly checked when using GraphQL subscription res…
-
Low 3.5
phpscriptpoint Lawyer search.php cross site scripting
A vulnerability was found in phpscriptpoint Lawyer 1.6. It has been classified as problematic. This affects an unknown part of the file search.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The identifier …
-
Medium 6.5
TDengine Database Denial-of-Service
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query. This issue affects TDengine Databases which let users connect and run arbitrary queries. Versio…
-
Medium 6.3
copyparty vulnerable to reflected cross-site scripting via k304 parameter
copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, o…
-
Medium 6.1
Apptainer's ineffective privileges drop when requesting container network
Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users…