Archive
5 September 2023
Vulnerabilities first published on this day (UTC), newest first.
123 results · Feed
-
Critical 9.8
ARDEREG Sistemas SCADA SQL Injection
ARDEREG Sistema SCADA Central versions 2.203 and prior login page are vulnerable to an unauthenticated blind SQL injection attack. An attacker could manipulate the application's SQL query logic to extract sensitive information or perform unauthorized actions…
-
High 7.8
GE Digital CIMPLICITY Process Control
GE CIMPLICITY 2023 is by a process control vulnerability, which could allow a local attacker to insert malicious configuration files in the expected web server execution path to escalate privileges and gain full control of the HMI software.
-
High 8.8
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a…
KEV Feb 6, 2024 -
Unscored —
Incorrect security UI in BFCache in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to spoof the conten…
-
High 8.8
Use after free in Networks in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to potentially exploit he…
-
High 8.1
Out of bounds memory access in FedCM in Google Chrome prior to 116.0.5845.179 allowed a remote attacker who had comprom…
-
Medium 4.3CVE-2023-30534 Scanner template
Insecure Deserialization in Cacti
Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory (phpseclib), the necessary gadgets are n…
-
High 7.8
Cacti Privilege Escalation
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a privilege escalation vulnerability. A low-privileged OS user with access to a Windows host where Cacti is installed can create arbitrary PHP file…
-
High 7.2
Authenticated command injection in SNMP options of a Device
Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining …
-
Low 3.5
Open redirect in change password functionality in Cacti
Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected to an arbitrary website after a change password performed via a specifically crafted URL. The `auth_changepassword.php`…
-
Medium 6.1
Stored Cross-Site-Scripting on data_sources.php debug html-block in Cacti
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data wi…
-
Medium 4.6
Unchecked regular expressions can lead to SQL Injection and data leakage in Cacti
Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been address…
-
High 8.8
A Defect in sql_save() Causes Multiple SQL Injection Vulnerabilities in Cacti
Cacti is an open source operational monitoring and fault management framework. A defect in the sql_save function was discovered. When the column type is numeric, the sql_save function directly utilizes user input. Many files and functions calling the sql_save…
-
High 8.8
Authenticated SQL injection vulnerability in reports_user.php in Cacti
Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in…
-
High 8.8
Authenticated SQL injection vulnerability in graphs.php in Cacti
Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in…
-
Critical 9.8
Unauthenticated SQL Injection in graph_view.php in Cacti
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are bei…
-
Medium 6.1
Reflected Cross-site Scripting in graphs_new.php in Cacti
Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data. The vulnerability is found in `graphs_new.php`. Sever…
-
Medium 6.1
Stored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in Cacti
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be …
-
Medium 6.1
Stored Cross-site Scripting in reports_admin.php through Device-Name in 'select' input in Cacti
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be …
-
Medium 6.1
Stored Cross-site Scripting on data_sources.php device name view in Cacti
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data wi…
-
Unscored —
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injecti…
-
Medium 6.1
Stored Cross-site Scripting on host.php verbose data-query debug view in Cacti
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data wi…
-
Medium 6.1
Stored Cross-site Scripting on data_debug.php datasource path view in Cacti
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be vi…
-
Medium 6.1
Stored Cross-site Scripting on graphs.php data template formated name view in Cacti
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data wi…
-
Unscored —CVE-2020-10128 Public exploit
SearchBlox product before V-9.2.1 is vulnerable to Stored-Cross Site Scripting
SearchBlox product with version before 9.2.1 is vulnerable to stored cross-site scripting at multiple user input parameters. In SearchBlox products multiple parameters are not sanitized/validate properly which allows an attacker to inject malicious JavaScript.
-
Critical 9.8
Authentication Bypass in Neutron Smart VMS
Authentication Bypass by Spoofing vulnerability in Neutron Neutron Smart VMS allows Authentication Bypass. This issue affects Neutron Smart VMS: before b1130.1.0.1.
-
Critical 9.8
SQLi in Mestavs E-commerce Software
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestav Software E-commerce Software allows SQL Injection. This issue affects E-commerce Software: before 20230901 .
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.
-
High 7.5
Unnamed "Subscription" operation results in Denial-of-Service in apollographql/router
The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and …
-
Critical 9.8
SQLi in Smartrise Document Management System
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digita Information Technology Smartrise Document Management System allows SQL Injection. This issue affects Smartrise Document Management System: before Hvl-…
-
Critical 9.8
SQLi in Mava Softwares Hotel Management System
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mava Software Hotel Management System allows SQL Injection. This issue affects Hotel Management System: before 2.0.
-
Critical 9.8
SQLi in Coyav Travels Proagent
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Coyav Travel Proagent allows SQL Injection. This issue affects Proagent: before 20230904 .
-
Critical 9.8
SQLi in BMAs Personnel Tracking System
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BMA Personnel Tracking System allows SQL Injection. This issue affects Personnel Tracking System: before 20230904.
-
Critical 9.8
SQLi in Osofts Paint Production Management
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Osoft Paint Production Management allows SQL Injection. This issue affects Paint Production Management: before 2.1.
-
High 7.2
Unrestricted File Upload in Bookreen
Unrestricted Upload of File with Dangerous Type vulnerability in Unisign Bookreen allows OS Command Injection. This issue affects Bookreen: before 3.0.0.
-
Critical 9.8
Privilege Escalation in Bookreen
Incomplete List of Disallowed Inputs vulnerability in Unisign Bookreen allows Privilege Escalation. This issue affects Bookreen: before 3.0.0.
-
High 8.1
An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform …
-
High 8.1
An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform …
-
Medium 6.5
An improper input validation vulnerability exists in the OAS Engine User Creation functionality of Open Automation Soft…
-
Medium 6.5
A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platfor…