Archive
3 September 2023
Vulnerabilities first published on this day (UTC), newest first.
26 results · Feed
-
Medium 6.3
Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform importexport.php sql injection
A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230822. It has been rated as critical. Affected by this issue is some unknown functionality of the file /importexport.php. The manipulation lea…
-
Critical 9.8
Tenda AC8 formSetDeviceName stack-based overflow
A vulnerability was found in Tenda AC8 16.03.34.06_cn_TDC01. It has been declared as critical. Affected by this vulnerability is the function formSetDeviceName. The manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The ex…
-
Low 3.1
Dreamer CMS file access
A vulnerability was found in Dreamer CMS up to 4.1.3. It has been classified as problematic. Affected is an unknown function of the file /upload/ueditorConfig?action=config. The manipulation leads to files or directories accessible. It is possible to launch t…
-
Medium 6.3
IBOS OA export&uid=X sql injection
A vulnerability was found in IBOS OA 4.5.5 and classified as critical. This issue affects some unknown processing of the file ?r=dashboard/user/export&uid=X. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been d…
-
Medium 6.3CVE-2023-4741 Public exploit
IBOS OA Delete Logs del sql injection
A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects unknown code of the file ?r=diary/default/del of the component Delete Logs Handler. The manipulation leads to sql injection. The attack can be initiated rem…
-
Medium 6.3
IBOS OA Delete Draft delDraft&archiveId=0 sql injection
A vulnerability, which was classified as critical, was found in IBOS OA 4.5.5. This affects an unknown part of the file ?r=email/api/delDraft&archiveId=0 of the component Delete Draft Handler. The manipulation leads to sql injection. It is possible to initiat…
-
Medium 6.3
Byzoro Smart S85F Management Platform updateos.php unrestricted upload
A vulnerability, which was classified as critical, has been found in Byzoro Smart S85F Management Platform up to 20230820. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload…
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331.
-
Unscored —
Apache NiFi MiNiFi C++: Incorrect Certificate Validation in InvokeHTTP for MiNiFi C++
Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped…
-
High 7.8
ForeScout NAC SecureConnector – CWE-427: Uncontrolled Search Path Element
ForeScout NAC SecureConnector version 11.2 - CWE-427: Uncontrolled Search Path Element
-
High 7.4
Hyundai car CWE-294: Authentication Bypass by Capture-replay
A Hyundai model (2017) - CWE-294: Authentication Bypass by Capture-replay.
-
High 8.1
StarTrinity Softswitch version 2023-02-16 - multiple CSRF (CWE-352)
StarTrinity Softswitch version 2023-02-16 - Multiple CSRF (CWE-352)
-
High 8.8
StarTrinity Softswitch version 2023-02-16 – Open Redirect (CWE-601)
StarTrinity Softswitch version 2023-02-16 - Open Redirect (CWE-601)
-
High 8.8
StarTrinity Softswitch version 2023-02-16 - Persistent XSS (CWE-79)
StarTrinity Softswitch version 2023-02-16 - Persistent XSS (CWE-79)
-
High 8.8
StarTrinity Softswitch version 2023-02-16 - multiple Reflected XSS (CWE-79)
StarTrinity Softswitch version 2023-02-16 - Multiple Reflected XSS (CWE-79)
-
Critical 10.0
Proscend Advice ICR Series routers fw version 1.76
Proscend Advice ICR Series routers FW version 1.76 - CWE-1392: Use of Default Credentials
-
Medium 4.8
Farsight Tech Nordic AB ProVide
Farsight Tech Nordic AB ProVide version 14.5 - Multiple XSS vulnerabilities (CWE-79) can be exploited by a user with administrator privilege.
-
High 8.8
7Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
7Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
-
High 7.2
Synel Terminals - CWE-494: Download of Code Without Integrity Check
Synel Terminals - CWE-494: Download of Code Without Integrity Check
-
Medium 5.9
WordPress Client Portal : SuiteDash Direct Login Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SuiteDash :: ONE Dashboard® Client Portal : SuiteDash Direct Login plugin <= 1.7.6 versions.
-
Medium 5.9
WordPress Post Affiliate Pro Plugin <= 1.25.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QualityUnit Post Affiliate Pro plugin <= 1.25.0 versions.
-
Medium 6.5
WordPress Audio Player with Playlist Ultimate Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin <= 1.2.2 versions.
-
Medium 5.9
WordPress WRC Pricing Tables Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Realwebcare WRC Pricing Tables plugin <= 2.3.7 versions.
-
Medium 5.9
WordPress Borderless Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Visualmodo Borderless plugin <= 1.4.8 versions.
-
Medium 5.9
WordPress Elastic Email Sender Plugin <= 1.2.6 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Elastic Email Sender plugin <= 1.2.6 versions.
-
Medium 5.9
WordPress Exifography Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Exifography plugin <= 1.3.1 versions.