Archive
September 2023
Vulnerabilities first published in this month (UTC), newest first.
145 results · Clear filters · Feed
-
Critical 9.9
OpenHook <= 4.3.0 - Authenticated (Subscriber+) Remote Code Execution via Shortcode
The OpenHook plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.3.0 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server. This requi…
-
Critical 9.0
Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq
Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
-
Critical 9.1
Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq
Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
-
Critical 9.8
A remote unauthorized attacker may connect to the SIM1012, interact with the device and change configuration settings. …
-
Critical 10.0
TorchServe Server-Side Request Forgery
TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken ad…
-
Critical 9.8
Online Movie Ticket Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
The 'age' parameter of the process_registration.php resource does not validate the characters received and they are sent unfiltered to the database.
-
Critical 9.8
Online Movie Ticket Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
The 'Email' parameter of the process_login.php resource does not validate the characters received and they are sent unfiltered to the database.
-
Critical 9.8
Online Movie Ticket Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
The 'search' parameter of the process_search.php resource does not validate the characters received and they are sent unfiltered to the database.
-
Critical 9.8
Online Book Store Project v1.0 - Unauthenticated SQL Injection (SQLi)
The 'bookisbn' parameter of the cart.php resource does not validate the characters received and they are sent unfiltered to the database.
-
Critical 9.8
Asset Management System v1.0 - Unauthenticated SQL Injection (SQLi)
Asset Management System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'email' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control.
-
Critical 9.1
Gym Management System Project v1.0 - Insecure File Upload
Gym Management System Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'file' parameter of profile/i.php page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application.
-
Critical 9.8
SQL Injection in hospital-management-system-in-php 378c157 in index.php
Hospital management system version 378c157 allows to bypass authentication. This is possible because the application is vulnerable to SQLI.
-
Critical 9.8
Hospital-management-system-in-php 378c157 - Blind SQL Injection
Hospital management system version 378c157 allows to bypass authentication. This is possible because the application is vulnerable to SQLI.
-
Critical 9.4
Real Time Automation 460 Series Cross-site Scripting
Real Time Automation 460 Series products with versions prior to v8.9.8 are vulnerable to cross-site scripting, which could allow an attacker to run any JavaScript reference from the URL string. If this were to occur, the gateway's HTTP interface would redirec…
-
Critical 9.8
A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could a…
-
Critical 9.9CVE-2023-42657 EPSS 16%
WS_FTP Server Directory Traversal
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized W…
-
Critical 10.0
WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
KEV Oct 5, 2023 -
Critical 9.8
During process shutdown, it was possible that an `ImageBitmap` was created that would later be used after being freed f…
-
Critical 9.8
A hashtable in the Ion Engine could have been mutated while there was a live interior reference, leading to a potential…
-
Critical 9.8
Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence…
-
Critical 9.8
If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointe…
-
Critical 9.8
A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds writ…
-
Critical 9.8
SQLi in MRV Tech's Logging Administration Panel
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MRV Tech Logging Administration Panel allows SQL Injection. This issue affects Logging Administration Panel: before 20230915 .
-
Critical 9.8
SQLi in Hedef Trackings Admin Panel
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hedef Tracking Admin Panel allows SQL Injection. This issue affects Admin Panel: before 1.2.
-
Critical 9.9
Authenticated RCE due to unsafe JSON deserialization
Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE. Authentication to the API is required to exploit this vulnerability. The flaw exists within the network_traffic API endpoint. An attacker can …
-
Critical 10.0
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed pro…
-
Critical 10.0
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed…
-
Critical 9.8
This issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS …
-
Critical 9.8
OS command injection on EasyPHP Webserver
An OS command injection vulnerability has been found on EasyPHP Webserver affecting version 14.1. This vulnerability could allow an attacker to get full access to the system by sending a specially crafted exploit to the /index.php?zone=settings parameter.
-
Critical 9.8
xunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php. This vulner…
-
Critical 9.1
Improper authentication in the SOCKS5 inbound in sing-box
Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentica…
-
Critical 9.8
Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE
The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue (https://wp…
-
Critical 9.8CVE-2023-4490 Scanner template
WP Job Portal < 2.0.6 - Unauthenticated SQLi
The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users
-
Critical 9.8
A heap-based buffer overflow vulnerability exists in the pictwread functionality of Accusoft ImageGear 20.1. A speciall…
-
Critical 9.8
A use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1. A specially cr…
-
Critical 9.8
An out-of-bounds write vulnerability exists in the dcm_pixel_data_decode functionality of Accusoft ImageGear 20.1. A sp…
-
Critical 9.8
An out-of-bounds write vulnerability exists in the allocate_buffer_for_jpeg_decoding functionality of Accusoft ImageGea…
-
Critical 9.8
UpLight cookiebanner before 1.5.1 was discovered to contain a SQL injection vulnerability via the component Hook::getHo…
-
Critical 9.8
Gevent allows remote attacker to escalate privileges
An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component.
-
Critical 9.8
General Device Manager 2.5.2.2 is vulnerable to Buffer Overflow.