Archive
August 2023
Vulnerabilities first published in this month (UTC), newest first.
2,514 results · Feed
-
High 8.0
WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previ…
-
High 7.5
WP Ultimate CSV Importer <= 7.9.8 - Sensitive Information Exposure via Directory Listing
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and including, 7.9.8. This makes it possible for unauthenticated at…
-
Medium 6.6
WP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction on the 'get_header_values' function. This makes it possible for authenticated attackers, with minim…
-
Medium 5.3
Insertion of Sensitive Information Into Sent Data in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for EE-licensed users to link any security policy …
-
Medium 6.3
Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path traversal vulnerability exists in the `AssetController::importServerFilesAction`, which allows an attacker to overwrite or modify sensitive…
-
Medium 4.3
Sulu Observable Response Discrepancy on Admin Login
Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which user (username, email) exists and which one do not exist. Sulu Installation not using the old Symfony 5.4 security System …
-
Unscored —
Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware used for dev…
-
Unscored —
Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communication pr…
-
Unscored —
Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communicat…
-
Unscored —
Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication,…
-
Unscored —
Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate th…
-
Unscored —
Connected IO v2.1.0 and prior has a stack-based buffer overflow vulnerability in its communication protocol, enabling a…
-
Unscored —
Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to s…
-
Unscored —
Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its comm…
-
Unscored —
ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel.
-
Critical 9.8
PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delet…
-
Unscored —
An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allow…
-
Unscored —
PHPGurukul Online Security Guards Hiring System v.1.0 is vulnerable to SQL Injection via osghs/admin/search.php.
-
Unscored —
Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensiti…
-
Unscored —CVE-2023-38964 Scanner template
Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability.
-
Medium 4.3
An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cros…
-
Critical 9.8
PyroCMS remote code execution vulnerability
PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw. This vulnerability allows a malicious attacker to send customized commands to the server and execute arbitrary code on…
-
Unscored —CVE-2023-30146 Public exploit
Assmann Digitus Plug&View IP Camera HT-IP211HDP, version 2.000.022 allows unauthenticated attackers to download a copy …
-
Medium 6.5CVE-2022-41401 Public exploit
OpenRefine Server-Side Request Forgery vulnerability
OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.
-
Medium 5.9
Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model…
-
High 7.5
Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.00…
-
High 8.1
A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Campaign
A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks.
-
High 8.1
A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Platform
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. An attacker could hijack a user's session and perform other attacks.
-
High 8.1
A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Platform
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session and perform other attacks.
-
High 8.1
HCL Unica Platform is vulnerable to a privilege escalation by unauthorized group assignation
A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could potentially escalate their privileges.
-
Critical 9.1
A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow …
-
Medium 6.1
A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an un…
-
Medium 5.8
A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow a…
-
Medium 4.4
A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authentic…
-
Medium 5.8
A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthe…
-
Medium 5.4
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an…
-
High 8.1
An XML External Entity (XXE) Injection Vulnerability affects HCL Unica Platform
The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.
-
Medium 5.0
Foundry Issues reporterPath phishing by parameter injection
A security defect was discovered in Foundry Issues that enabled users to create convincing phishing links by editing the request sent when creating an Issue. This defect was resolved in Frontend release 6.228.0 .
-
Medium 6.5
CVE-2023-30950
The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint
-
Medium 4.7
DOM XSS in Developer mode dashboard via redirect GET parameter
A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.225.0.