Archive
3 August 2023
Vulnerabilities first published on this day (UTC), newest first.
27 results · Clear filters · Feed
-
High 7.5
Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.00…
-
High 8.1
A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Campaign
A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks.
-
High 8.1
A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Platform
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. An attacker could hijack a user's session and perform other attacks.
-
High 8.1
A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Platform
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session and perform other attacks.
-
High 8.1
HCL Unica Platform is vulnerable to a privilege escalation by unauthorized group assignation
A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could potentially escalate their privileges.
-
High 8.1
An XML External Entity (XXE) Injection Vulnerability affects HCL Unica Platform
The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.
-
High 7.1
VideoEdge config
A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation.
-
High 7.5
TEL-STER TelWin SCADA WebInterface Path Traversal
External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements within the pathname, which could allow an unauthenticated attacker to read files on the system.
-
High 7.2
A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) a…
KEV Jul 31, 2023 -
High 7.4
Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client
The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a secure manner, however, if a user is connected to WARP over an IPv6-capable network, te WARP client …
-
High 7.4CVE-2023-4136 Scanner template
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through…
-
High 7.6
Dell XtremIO X2 XMS versions prior to 6-4-1.11 contain an improper access control vulnerability. A remote read only use…
-
High 8.8
CODESYS: Improper memory restrictions fro CODESYS Control
In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device.
-
High 7.3
CODESYS: Vulnerability in CODESYS Development System allows for execution of binaries
In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users context .
-
High 8.8
CODESYS: Missing integrity check in CODESYS Development System
In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.
-
High 7.2
Non-sanitized user input could lead to SQL injections in AXIS License Plate Verifier
User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for SQL injections.
-
High 7.2
Non-sanitized user input could lead to arbitrary code execution during Access Control configuration in AXIS License Plate Verifier
User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for arbitrary code execution.
-
High 7.2
Non-sanitized user input could lead to arbitrary code execution in AXIS License Plate Verifier
User provided input is not sanitized on the AXIS License Plate Verifier specific “api.cgi” allowing for arbitrary code execution.
-
High 8.4
Insufficient file permissions leak administrator-privileged credentials in AXIS License Verifier ACAP
Due to insufficient file permissions, unprivileged users could gain access to unencrypted administrator credentials allowing the configuration of the application.
-
High 8.4
Insufficient file permissions leak user credentials of 3rd party integration interfaces in AXIS License Verifier ACAP
Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3rd party systems.
-
High 8.8
Privilege escalation in AXIS License Plate Verifier ACAP
A broken access control was found allowing for privileged escalation of the operator account to gain administrator privileges.
-
High 8.2
Incorrect User Management in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitr…
-
High 8.8
Weak Password Requirements in answerdev/answer
Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0.
-
High 8.1
Missing Authorization in answerdev/answer
Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1.
-
High 7.5
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbi…
KEV May 19, 2025 -
High 7.5CVE-2023-38952 Scanner template
Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due…
-
High 7.2
An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to e…