Archive
August 2023
Vulnerabilities first published in this month (UTC), newest first.
2,514 results · Feed
-
Unscored —
Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7…
-
Unscored —
Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7…
-
Unscored —
"FFRI yarai", "FFRI yarai Home and Business Edition" and their OEM products handle exceptional conditions improperly, w…
-
High 8.8
Real Estate Manager <= 7.2 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
The Real Estate Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.2 due to insufficient restriction on the 'rem_save_profile_front' function. This makes it possible for authenticated attackers, with minimal…
-
Unscored —
A SQL injection vulnerability in CSZCMS 1.3.0 allows remote attackers to run arbitrary SQL commands via p parameter or …
-
Unscored —
KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables…
-
Unscored —
In instances where the screen is visible and remote mouse connection is enabled, KramerAV VIA Connect (2) and VIA Go (2…
-
Medium 5.7
The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a lo…
-
Unscored —CVE-2023-39910 Public exploit
The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Mi…
-
Unscored —
Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edi…
-
Unscored —
A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7…
-
Unscored —CVE-2023-39002 Scanner template
A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition…
-
Unscored —
The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before…
-
Unscored —
OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permission…
-
Unscored —
Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.…
-
Unscored —CVE-2023-39007 Scanner template
/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 a…
-
Unscored —
A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community E…
-
Unscored —
A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Busine…
-
Unscored —
A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Busin…
-
Unscored —
An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows …
-
Unscored —
An issue was discovered in LWsystems Benno MailArchiv 2.10.1. Attackers can cause XSS via JavaScript content to a mailb…
-
Unscored —
A CSRF issue was discovered in LWsystems Benno MailArchiv 2.10.1.
-
Unscored —
A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and…
-
Unscored —
A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an a…
-
Unscored —CVE-2023-32782 EPSS 56%
A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authen…
-
Unscored —
An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the…
-
Unscored —
An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. The VPN client insecurely configures the operati…
-
Unscored —
An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the…
-
Unscored —
A cross-site request forgery (CSRF) token bypass was identified in PRTG 23.2.84.1566 and earlier versions that allows r…
-
Unscored —
A path traversal vulnerability was identified in the SQL v2 sensors in PRTG 23.2.84.1566 and earlier versions where an …
-
Unscored —
A path traversal vulnerability was identified in the HL7 sensor in PRTG 23.2.84.1566 and earlier versions where an auth…
-
Unscored —
A path traversal vulnerability was identified in the WMI Custom sensor in PRTG 23.2.84.1566 and earlier versions where …
-
Unscored —CVE-2023-37068 Public exploit
Code-Projects Gym Management System V1.0 allows remote attackers to execute arbitrary SQL commands via the login form, …
-
Medium 5.9
Improper input validation in Zoom Desktop Client for Windows before 5.15.5 may allow an authenticated user to enable an…
-
High 7.6
Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial…
-
Critical 9.6
Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may al…
-
High 7.9
Untrusted search path in Zoom Rooms for Windows before version 5.15.5 may allow an authenticated user to enable a denia…
-
High 8.8
Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an …
-
Medium 5.5
Cleartext storage of sensitive information in Zoom Client SDK for Windows before 5.15.0 may allow an authenticated user…
-
Medium 6.5
Instrumentation for AWS SDK v2 captures email content when using Amazon Simple Email Service (SES) v1 API, exposing that content to the telemetry backend
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. OpenTelemetry Java Instrumentation prior to version 1.28.0 contains an issue related to the instrumentation of Java applications using the A…