Archive
1 August 2023
Vulnerabilities first published on this day (UTC), newest first.
84 results · Feed
-
Unscored —
When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only…
-
Unscored —
Full screen notification obscured by external program
A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefo…
-
Unscored —
The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that …
-
Unscored —
Full screen notification obscured by file open dialog
A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.
-
Unscored —CVE-2023-4050 EPSS 13%
In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a pot…
-
Unscored —
Race conditions in reference counting code were found through code inspection. These could have resulted in potentially…
-
Unscored —
An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations.…
-
Unscored —
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into grantin…
-
Unscored —
In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in …
-
Unscored —
Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from ano…
-
High 7.5CVE-2023-37478 Public exploit
pnpm incorrectly parses tar archives relative to specification
pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on t…
-
Medium 5.4
XSS in business intelligence
Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30.
-
High 7.5
underscore-keypath vulnerable to Prototype Pollution
Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments …
-
High 8.3
HCL Verse is susceptible to a Stored Cross-Site Scripting (XSS) Vulnerability
HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser to perform operations as the victim and/or steal the victim's cookies, session tokens, or other sensitive information.
-
High 8.8
OS Command Injection in mlflow/mlflow
OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0.
-
Unscored —
In PowerShell App Deployment Toolkit (aka PSAppDeployToolkit) through 3.8.0, an incorrect access control vulnerability …
-
Unscored —
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to e…
-
Unscored —
PHPJabbers Catering System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component …
-
Medium 4.0
In certain EZVIZ products, two stack based buffer overflows in mulicast_parse_sadp_packet and mulicast_get_pack_type fu…
-
Unscored —
In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ SDK command server c…
-
Unscored —CVE-2023-34634 Public exploit
Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .gree…
-
Critical 9.8
An Unrestricted Upload of File with Dangerous Type vulnerability in the Ajaxmanager File and Database explorer (ajaxman…
-
Unscored —
Improper input validation of password parameter in PHP Jabbers Time Slots Booking Calendar v 3.3 results in insecure pa…
-
Unscored —
In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (o…
-
Unscored —
User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3. This issue occurs during password recover…
-
Unscored —
There is a Cross Site Scripting (XSS) vulnerability in "cid" parameter of preview.php in PHPJabbers Time Slots Booking …
-
Unscored —
There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Time Slots Bo…
-
Unscored —CVE-2023-39147 Public exploit
An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a craft…
-
Unscored —CVE-2023-39108 Scanner template
rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Fu…
-
Unscored —CVE-2023-39109 Scanner template
rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Fu…
-
Unscored —CVE-2023-39110 Scanner template
rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByP…
-
Unscored —
An issue in the delete function in the MenuController class of jeesite v1.2.6 allows authenticated attackers to arbitra…
-
Unscored —CVE-2023-38357 Public exploit
Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized …
-
Unscored —
An issue in Viatom Health ViHealth for Android v.2.74.58 and before allows a remote attacker to execute arbitrary code …
-
Unscored —
LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.
-
Unscored —CVE-2023-36210 EPSS 31%
MotoCMS Version 3.4.3 Store Category Template was discovered to contain a Server-Side Template Injection (SSTI) vulnera…
-
Unscored —
The Barebones CMS v2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with c…
-
Unscored —
Cross Site Scripting vulnerability in Faculty Evaulation System using PHP/MySQLi v.1.0 allows an attacker to execute ar…
-
Unscored —
Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the descripti…
-
Unscored —
LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.