Archive
September 2023
Vulnerabilities first published in this month (UTC), newest first.
597 results · Clear filters · Feed
-
High 7.5
Socomec MOD3GP-SY-120K Insecure Storage of Sensitive Information
Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process.
-
High 7.5
K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack
An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.…
-
High 8.4
A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) th…
-
High 7.3
Cross-Site Request Forgery (CSRF) in usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1.
-
High 8.8
ASUS RT-AX88U - externally-controlled format string
ASUS router RT-AX88U has a vulnerability of using externally controllable format strings within its Advanced Open VPN function. An authenticated remote attacker can exploit the exported OpenVPN configuration to execute an externally-controlled format string a…
-
High 7.5
SUNNET WMPro - SQL Injection
SUNNET WMPro portal's FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain sensitive information via a database.
-
High 7.2
SUNNET WMPro - Command Injection
SUNNET WMPro portal's file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or a privileged account can exploit this vulnerability to inject and execute arbitrary system commands …
-
High 7.3
A DLL hijacking vulnerability in Samsung Memory Card & UFD Authentication Utility PC Software before 1.0.1 could allow …
-
High 7.3
07FLY CRM Administrator Login Page sql injection
A vulnerability, which was classified as critical, has been found in 07FLY CRM V2. This issue affects some unknown processing of the file /index.php/sysmanage/Login/login_auth/ of the component Administrator Login Page. The manipulation of the argument accoun…
-
High 7.2
Dropbox Folder Share <= 1.9.7 - Unauthenticated Server-Side Request Forgery via 'link'
The Dropbox Folder Share plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.9.7 via the 'link' parameter. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from …
-
High 7.1
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
High 8.2
JumpServer session replays download without authentication
JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, O…
-
High 7.5
GeoNode SSRF Bypass to return internal host data
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal …
-
High 7.5
Network-observability-console-plugin-container: setting loki authtoken configuration to disable or host mode leads to authentication longer being enforced
A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluste…
-
High 8.8
Odh-notebook-controller-container: missing authorization allows for file contents disclosure
A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.
-
High 7.5
OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack
OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue.
-
High 7.4
OP-TEE double free in shdr_verify_signature
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20 and prior to version 3.22, `shdr_verify_signature` can make a double fre…
-
High 7.5
FreeSWITCH allows authorized users to cause a denial of service attack by sending re-INVITE with SDP containing duplicate codec names
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.10, FreeSWITCH allows authorized users to cause a deni…
-
High 7.5
FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.10, FreeSWITCH allows remote users to trigger out of b…
-
High 7.3
Strapi Improper Rate Limiting vulnerability
Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brut…
-
High 7.6
Directus affected by VM2 sandbox escape vulnerability
### Impact In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code. Within Directus this applies to the "Run Script" operation in flows being able to escape the sandbox ru…
-
High 7.8
NextBX QWAlerter QWAlerter.exe unquoted search path
A vulnerability was found in NextBX QWAlerter 4.50. It has been rated as critical. Affected by this issue is some unknown functionality of the file QWAlerter.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local…
-
High 8.8
Privilage Escalation in Saphira Connect
Incorrect Execution-Assigned Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation. This issue affects Saphira Connect: before 9.
-
High 8.8
Privilage Escalation in Saphira Connect
Incorrect Default Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation. This issue affects Saphira Connect: before 9.
-
High 7.5
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl…
-
High 7.3
Lapce v0.2.8 - Privilege escalation via Race Condition
Race condition in Lapce v0.2.8 allows an attacker to elevate privileges on the system
-
High 8.8
Cross-site Scripting (XSS) - DOM in librenms/librenms
Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.
-
High 8.8
Cross-site Scripting (XSS) - Generic in librenms/librenms
Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0.
-
High 7.3
Code Injection in librenms/librenms
Code Injection in GitHub repository librenms/librenms prior to 23.9.0.
-
High 8.8
Cross-site Scripting (XSS) - Reflected in librenms/librenms
Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.9.0.
-
High 7.5
Undertow: infinite loop in sslconduit during close
A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.
-
High 8.0
Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a mis…
-
High 8.2
A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q3). The affected product assigns improper a…
-
High 7.8
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the IGSS Update Service that could allo…
-
High 7.8
Apache HDFS Provider error message suggested installation of incorrect pip package
In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed w…
-
High 7.5
ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298
Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the…
KEV Jul 20, 2023 -
High 7.1
A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete a…
-
High 7.5
sidekiq Denial of Service vulnerability
Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive pol…
-
High 7.8CVE-2023-36250 Public exploit
CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via c…
-
High 7.5
Dma reentrancy issue (incomplete fix for cve-2021-3750)
This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.