Archive
11 September 2023
Vulnerabilities first published on this day (UTC), newest first.
118 results · Feed
-
Unscored —
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Big Su…
-
High 7.8CVE-2023-41990 Exploited
The issue was addressed with improved handling of caches. This issue is fixed in tvOS 16.3, iOS 16.3 and iPadOS 16.3, m…
KEV Jan 8, 2024 -
High 7.5
This issue was addressed with improved state management of S/MIME encrypted emails. This issue is fixed in macOS Monter…
-
High 8.1
SQL Injection in mintplex-labs/anything-llm
SQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.
-
High 8.2
Authentication Bypass by Primary Weakness in mintplex-labs/anything-llm
Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.
-
High 7.5
Magento LTS's guest order "protect code" can be brute-forced too easily
Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-f…
-
Medium —
Inventory exposes reference to non-Sync data to an arbitrary thread
Affected versions do not enforce a `Sync` bound on the type of caller-provided value held in the plugin registry. References to these values are made accessible to arbitrary threads other than the one that constructed them. A caller could use this flaw to sub…
-
Medium —
Users vulnerable to unaligned read of `*const *const c_char` pointer
Affected versions dereference a potentially unaligned pointer. The pointer is commonly unaligned in practice, resulting in undefined behavior. In some build modes, this is observable as a panic followed by abort. In other build modes the UB may manifest in so…
-
Medium —
Inventory fails to prohibit standard library access prior to initialization of Rust standard library runtime
Affected versions allow arbitrary caller-provided code to execute before the lifetime of `main`. If the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as `std::io` or `std::thread`, these…
-
High 8.1
Drools: unsafe data deserialization in streamutils
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the s…
-
Unscored —CVE-2023-35687 Public exploit
In MtpPropertyValue of MtpProperty.h, there is a possible memory corruption due to a use after free. This could lead to…
-
Unscored —
In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to an integer overflow. This could lead t…
-
Unscored —
In bindSelection of DatabaseUtils.java, there is a possible way to access files from other applications due to SQL inje…
-
Unscored —
In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. Th…
-
Unscored —
In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission …
-
High 7.8
In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to …
-
Unscored —
In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow. Th…
-
Unscored —
In MtpPropertyValue of MtpProperty.h, there is a possible out of bounds read due to uninitialized data. This could lead…
-
Unscored —
In loadMediaResumptionControls of MediaResumeListener.kt, there is a possible way to play and listen to media files pla…
-
High 8.8
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the co…
KEV Sep 13, 2023 -
Unscored —CVE-2023-35671 Public exploit
In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read t…
-
Unscored —
In createQuickShareAction of SaveImageInBackgroundTask.java, there is a possible way to trigger a background activity l…
-
Unscored —
In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an integer overflow. This could l…
-
Unscored —
In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to control other running acti…
-
Unscored —
In bta_av_rc_msg of bta_av_act.cc, there is a possible use after free due to a logic error in the code. This could lead…
-
Unscored —
In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. T…
-
Unscored —
In updateList of NotificationAccessSettings.java, there is a possible way to hide approved notification listeners in th…
-
High 7.8
In computeValuesFromData of FileUtils.java, there is a possible way to insert files to other apps' external private dir…
-
Unscored —
In multiple files, there is a possible way to import a contact from another user due to a missing permission check. Thi…
-
Unscored —
In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible privilege escalation due to a use after free. This co…
-
High 8.7
Relative Path Traversal in mintplex-labs/anything-llm
Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.
-
Medium 6.1CVE-2023-4294 Public exploit
URL Shortify < 1.7.6 - Unauthenticated Stored XSS via referer header
The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short…
-
Medium 4.8
tagDiv Composer < 4.2 - Admin+ Stored XSS
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even…
-
High 7.5CVE-2023-4278 Public exploit
MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.
-
Medium 4.8
WP Adminify < 3.1.6 - Admin+ Stored XSS
The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for ex…
-
Unscored —
FTP Access <= 1.0 - Subscriber+ Stored XSS
The FTP Access WordPress plugin through 1.0 does not have authorisation and CSRF checks when updating its settings and is missing sanitisation as well as escaping in them, allowing any authenticated users, such as subscriber to update them with XSS payloads, …
-
Medium 6.1CVE-2023-3169 Scanner template
tagDiv Composer < 4.2 - Unauthenticated Stored XSS
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could al…
-
Medium 4.8
Herd Effects < 5.2.3 - Admin+ Stored XSS
The Herd Effects WordPress plugin before 5.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for e…
-
High 7.2
wpDataTables < 2.1.66 - Admin+ PHP Object Injection
The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is prese…
-
Medium 6.1
Appointment booking addon for Gravity Forms < 1.10.0 - Reflected Cross-Site Scripting
The gAppointments WordPress plugin before 1.10.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin