Archive
25 September 2023
Vulnerabilities first published on this day (UTC), newest first.
93 results · Feed
-
Critical 9.8
A heap-based buffer overflow vulnerability exists in the pictwread functionality of Accusoft ImageGear 20.1. A speciall…
-
High 7.0
A heap-based buffer overflow vulnerability exists in the create_png_object functionality of Accusoft ImageGear 20.1. A …
-
High 8.1
An out-of-bounds write vulnerability exists in the tiff_planar_adobe functionality of Accusoft ImageGear 20.1. A specia…
-
Critical 9.8
A use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1. A specially cr…
-
Critical 9.8
An out-of-bounds write vulnerability exists in the dcm_pixel_data_decode functionality of Accusoft ImageGear 20.1. A sp…
-
Critical 9.8
An out-of-bounds write vulnerability exists in the allocate_buffer_for_jpeg_decoding functionality of Accusoft ImageGea…
-
High 7.3
Stored XSS leads to privilege escalation in MediaWiki v1.40.0
Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious lin…
-
Unscored —
Command injection vulnerability in the distributed file system module. Successful exploitation of this vulnerability ma…
-
Unscored —
Input verification vulnerability in the fingerprint module. Successful exploitation of this vulnerability will affect c…
-
Unscored —
Data security classification vulnerability in the DDMP module. Successful exploitation of this vulnerability may affect…
-
Unscored —
Redirection permission verification vulnerability in the home screen module. Successful exploitation of this vulnerabil…
-
Unscored —
Vulnerability of unauthorized API access in the PMS module. Successful exploitation of this vulnerability may cause fea…
-
Unscored —
Vulnerability of parameters not being strictly verified in the PMS module. Successful exploitation of this vulnerabilit…
-
Unscored —
DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.
-
Unscored —
Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect conf…
-
Unscored —
Vulnerability of defects introduced in the design process in the HiviewTunner module. Successful exploitation of this v…
-
Unscored —
Vulnerability of missing authorization in the kernel module. Successful exploitation of this vulnerability may affect i…
-
Unscored —
Vulnerability of improper permission management in the displayengine module. Successful exploitation of this vulnerabil…
-
Unscored —
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super…
-
Unscored —
DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.
-
Unscored —
DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.
-
Unscored —
The Watchkit has a risk of unauthorized file access.Successful exploitation of this vulnerability may affect confidenti…
-
Medium 6.3CVE-2023-5154 EPSS 15%
D-Link DAR-8000 changelogo.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-8000 up to 20151231 and classified as critical. This vulnerability affects unknown code of the file /sysmanage/changelogo.php. The manipulation of the argument file_upload leads to u…
-
Medium 6.3
D-Link DAR-8000 querysql.php sql injection
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-8000 up to 20151231. This affects an unknown part of the file /Tool/querysql.php. The manipulation leads to sql injection. It is possible to initiate th…
-
Medium 6.3
D-Link DAR-7000/DAR-8000 importexport.php sql injection
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected by this issue is some unknown functionality of the file /importexport.php. The manipulation of the argum…
-
Medium 6.3CVE-2023-5151 EPSS 81%
D-Link DAR-8000 autheditpwd.php sql injection
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231. Affected by this vulnerability is an unknown functionality of the file /autheditpwd.php. The manipulation of the argument hid_id leads to sql i…
-
Medium 6.3CVE-2023-5150 EPSS 23%
D-Link DAR-7000/DAR-8000 web.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unknown function of the file /useratte/web.php. The manipulation of the argument file_upload leads to unrestri…
-
High 7.1
WordPress WoodMart Theme <= 7.2.4 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xtemos WoodMart plugin <= 7.2.4 versions.
-
Medium 6.3CVE-2023-5149 EPSS 21%
D-Link DAR-7000 userattestation.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been rated as critical. This issue affects some unknown processing of the file /useratte/userattestation.php. The manipulation of the argument web_img leads to…
-
Medium 6.3CVE-2023-5148 EPSS 31%
D-Link DAR-7000/DAR-8000 uploadfile.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231. It has been declared as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload …
-
High 7.1
WordPress Order Delivery Date for WooCommerce Plugin <= 3.20.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Order Delivery Date for WooCommerce plugin <= 3.20.0 versions.
-
Medium 5.9
WordPress Cookie Notice & Consent Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christoph Rado Cookie Notice & Consent plugin <= 1.6.0 versions.
-
Medium 5.9
WordPress iFolders Plugin <= 1.5.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Avirtum iFolders plugin <= 1.5.0 versions.
-
Medium 6.3CVE-2023-5147 EPSS 26%
D-Link DAR-7000 updateos.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been classified as critical. This affects an unknown part of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload leads to unrestri…
-
Medium 6.3CVE-2023-5146 EPSS 32%
D-Link DAR-7000/DAR-8000 updatelib.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231 and classified as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updatelib.php. The manipulation of the argument fi…
-
Medium 5.3
MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses int…
-
Critical 9.8
UpLight cookiebanner before 1.5.1 was discovered to contain a SQL injection vulnerability via the component Hook::getHo…
-
Unscored —
An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, …
-
Critical 9.8
Gevent allows remote attacker to escalate privileges
An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component.
-
Medium 6.1CVE-2023-42426 Public exploit
Cross-site scripting (XSS) vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary c…