Archive
27 September 2023
Vulnerabilities first published on this day (UTC), newest first.
146 results · Feed
-
High 8.2
WS_FTP Server SQL Injection via Administrative Interface
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alte…
-
High 8.3
WS_FTP Server Ad Hoc Transfer Module Reflected Cross-Site Scripting Vulnerability
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module. An attacker could leverage this vulnerability to target WS_FTP Server users with a specialized payload …
-
Critical 9.9CVE-2023-42657 EPSS 16%
WS_FTP Server Directory Traversal
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized W…
-
Critical 10.0
WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
KEV Oct 5, 2023 -
Critical 9.8
During process shutdown, it was possible that an `ImageBitmap` was created that would later be used after being freed f…
-
Unscored —
In a non-standard configuration of Firefox, an integer overflow could have occurred based on network traffic (possibly …
-
Critical 9.8
A hashtable in the Ion Engine could have been mutated while there was a live interior reference, leading to a potential…
-
Unscored —
In canvas rendering, a compromised content process could have caused a surface to change unexpectedly, leading to a mem…
-
Critical 9.8
Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence…
-
Critical 9.8
If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointe…
-
Unscored —
During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to…
-
Unscored —
A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds wri…
-
Critical 9.8
A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds writ…
-
Low 3.6
Messaging - Gaining access to arbitrary content providers via QClipIntentReceiverActivity
The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.android.mms.ui.QClipIntentReceiverActivity" activity. The attacker can abuse this functionality by lau…
-
Medium 5.0
LGInstallService - Deletion of arbitrary files with system privilege
he vulnerability is to delete arbitrary files in LGInstallService ("com.lge.lginstallservies") app. The app contains the exported "com.lge.lginstallservies.InstallService" service that exposes an AIDL interface. All its "installPackage*" methods are finally c…
-
Low 3.6
Call management - Implicit activity intents disclose contact details and phone numbers
he vulnerability is that the Call management ("com.android.server.telecom") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and p…
-
Low 3.6
Call management - Implicit intents disclose telephony data such as phone numbers, call states, contacts
The vulnerability is that the Call management ("com.android.server.telecom") app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as ca…
-
Medium 6.3
HimitZH HOJ Topic sandbox
A vulnerability, which was classified as critical, has been found in HimitZH HOJ up to 4.6-9a65e3f. This issue affects some unknown processing of the component Topic Handler. The manipulation leads to sandbox issue. The attack may be initiated remotely. The e…
-
Medium 6.1
Personalized service - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijacking
The vulnerability is the use of implicit PendingIntents without the PendingIntent.FLAG_IMMUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Personalized service ("com.lge.abba") app. The attacker's app, if it h…
-
Medium 6.1
Screen recording - Theft of arbitrary files with system privilege
The vulnerability is to theft of arbitrary files with system privilege in the Screen recording ("com.lge.gametools.gamerecorder") app in the "com/lge/gametools/gamerecorder/settings/ProfilePreferenceFragment.java" file. The main problem is that the app launch…
-
High 7.5
Undertow: outofmemoryerror due to @multipartconfig handling
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limi…
-
Medium 6.1
Bluetooth - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijacking
The vulnerability is the use of implicit PendingIntents with the PendingIntent.FLAG_MUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Bluetooth ("com.lge.bluetoothsetting") app. The attacker's app, if it had a…
-
Medium 6.1
LockScreenSettings - Theft arbitrary files with system privilege
The vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings ("com.lge.lockscreensettings") app in the "com/lge/lockscreensettings/dynamicwallpaper/MyCategoryGuideActivity.java" file. The main problem is that the app launch…
-
Medium 4.7
Red hat a-mq streams: component version with information disclosure flaw
A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access informa…
-
High 7.4
Apicast proxies the api call with incorrect jwt token to the api backend without proper authorization check
A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a separate realm to be accessible to an attacker, permitting access to unauthorized information.
-
Medium 6.3
Viessmann Vitogate 300 Web Management Interface vitogate.cgi isValidUser hard-coded password
A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. This vulnerability affects the function isValidUser of the file /cgi-bin/vitogate.cgi of the component Web Management Interface. The manipulation leads to use of hard-co…
-
Medium 4.7
ForU CMS index.php code injection
A vulnerability classified as critical has been found in ForU CMS. This affects an unknown part of the file /install/index.php. The manipulation of the argument db_name leads to code injection. It is possible to initiate the attack remotely. The exploit has b…
-
High 7.1
WordPress Sermon'e – Sermons Online Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Beplus Sermon'e – Sermons Online plugin <= 1.0.0 versions.
-
Medium 5.9
WordPress Snap Pixel Plugin <= 1.5.7 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hassan Ali Snap Pixel plugin <= 1.5.7 versions.
-
Medium 5.9
WordPress SureCart Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SureCart WordPress Ecommerce For Creating Fast Online Stores plugin <= 2.5.0 versions.
-
High 7.5
Soundminer – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Soundminer – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
-
Medium 6.3
Fortect - CWE-428: Unquoted Search Path or Element
Fortect - CWE-428: Unquoted Search Path or Element, may be used by local user to elevate privileges.
-
High 7.6
One Identity Password Manager version 5.9.7.1 - Unauthenticated physical access privilege escalation
One Identity Password Manager version 5.9.7.1 - An unauthenticated attacker with physical access to a workstation may upgrade privileges to SYSTEM through an unspecified method. CWE-250: Execution with Unnecessary Privileges.
-
Medium 6.7
Stored cross-site scripting (XSS) vulnerability in protection plan name. The following products are affected: Acronis C…
-
High 7.1
Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: A…
-
Medium 5.5
Sensitive information disclosure due to cleartext storage of sensitive information. The following products are affected…
-
Medium 5.7
Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Protect 15 (L…
-
Low 3.5
Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Prot…
-
Low 3.1
Sensitive information manipulation due to cross-site request forgery. The following products are affected: Acronis Cybe…
-
Low 3.1
Sensitive information manipulation due to cross-site request forgery. The following products are affected: Acronis Cybe…