Archive
13 September 2023
Vulnerabilities first published on this day (UTC), newest first.
60 results · Feed
-
Medium 6.1
Adobe Connect Reflected Cross-Site Scripting (XSS) Arbitrary code execution
Adobe Connect versions 12.3 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the con…
-
Medium 6.1
Adobe Connect Reflected Cross-Site Scripting (XSS) Arbitrary code execution
Adobe Connect versions 12.3 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the con…
-
High 7.8
[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o…
KEV Sep 14, 2023 -
Medium 4.8
GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64
**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-prote…
-
Medium 6.2
A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x pr…
-
Medium 5.3
WP User Control <= 1.5.3 - Insecure Password Reset Mechanism
The WP User Control plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.5.3. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (in…
-
Medium 5.3
Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure
The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.7 via the 'leyka_ajax_get_env_and_options' function. This can allow authenticated attackers with subscriber-level permissions or above to ext…
-
High 8.8
BAN Users <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update & Privilege Escalation
The BAN Users plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.5.3 due to a missing capability check on the 'w3dev_save_ban_user_settings_callback' function. This makes it possible for authenticated attackers, wit…
-
High 8.8
Login with phone number <= 1.5.6 - Cross-Site Request Forgery to User Password Change
The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwp_update_password_action' function. This makes it possible for unauthentica…
-
High 8.8
Simplr Registration Form Plus+ <= 2.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change
The Simplr Registration Form Plus+ plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.4.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and …
-
High 7.2
SQL Injection in instantsoft/icms2
SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1.
-
Unscored —
A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start 7 allows remote attackers to execu…
-
Unscored —
netentsec NS-ASG 6.3 is vulnerable to Incorrect Access Control. There is a file leak in the website source code of the …
-
Unscored —
A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attacker…
-
Unscored —
A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attacker…
-
Unscored —
A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers t…
-
Unscored —
A Stored Cross-Site Scripting (XSS) vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attacke…
-
Unscored —
A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 al…
-
Unscored —CVE-2023-42469 Public exploit
The com.full.dialer.top.secure.encrypted application through 1.0.1 for Android enables any installed application (with …
-
Unscored —CVE-2023-42468 Public exploit
The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls…