Archive
September 2023
Vulnerabilities first published in this month (UTC), newest first.
597 results · Clear filters · Feed
-
High 7.5
Denial of Service in gRPC Core
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Pyt…
-
High 7.5
ITM MacOS Agent Improper Certificate Validation
An improper certification validation vulnerability in the Insider Threat Management (ITM) Agent for MacOS could be used by an anonymous actor on an adjacent network to establish a man-in-the-middle position between the agent and the ITM server after the agent…
-
High 7.5
Crashes on parsing certain invalid RPKI objects
NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914.
-
High 7.5
BER/CER/DER decoder panics on invalid input
NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delay…
-
High 7.4
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface…
-
High 7.3
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in Forti…
-
High 7.1
A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.…
-
High 7.5
Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request
Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possibl…
-
High 7.8CVE-2023-26369 Exploited
[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation o…
KEV Sep 14, 2023 -
High 8.8
BAN Users <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update & Privilege Escalation
The BAN Users plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.5.3 due to a missing capability check on the 'w3dev_save_ban_user_settings_callback' function. This makes it possible for authenticated attackers, wit…
-
High 8.8
Login with phone number <= 1.5.6 - Cross-Site Request Forgery to User Password Change
The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwp_update_password_action' function. This makes it possible for unauthentica…
-
High 8.8
Simplr Registration Form Plus+ <= 2.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change
The Simplr Registration Form Plus+ plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.4.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and …
-
High 7.2
SQL Injection in instantsoft/icms2
SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1.
-
High 7.2
Untrusted search path in CleanZoom before file date 07/24/2023 may allow a privileged user to conduct an escalation of …
-
High 7.1
Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network acce…
-
High 7.8
Macvim's Insecure Usage of IPC Mechanisms
Macvim is a text editor for MacOS. Prior to version 178, Macvim makes use of an insecure interprocess communication (IPC) mechanism which could lead to a privilege escalation. Distributed objects are a concept introduced by Apple which allow one program to ve…
-
High 7.8
Use-after-free in Linux kernel's net/sched: sch_qfq component
A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue()…
-
High 8.8
Plaintext storage of user password
A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and client…
-
High 7.8
3D Viewer Remote Code Execution Vulnerability
3D Viewer Remote Code Execution Vulnerability
-
High 7.8
3D Viewer Remote Code Execution Vulnerability
3D Viewer Remote Code Execution Vulnerability
-
High 7.8
3D Viewer Remote Code Execution Vulnerability
3D Viewer Remote Code Execution Vulnerability
-
High 7.3
Microsoft Word Remote Code Execution Vulnerability
Microsoft Word Remote Code Execution Vulnerability
-
High 8.8
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Microsoft SharePoint Server Elevation of Privilege Vulnerability
-
High 7.5
Microsoft Outlook Information Disclosure Vulnerability
Microsoft Outlook Information Disclosure Vulnerability
-
High 7.8
3D Builder Remote Code Execution Vulnerability
3D Builder Remote Code Execution Vulnerability
-
High 7.8
3D Builder Remote Code Execution Vulnerability
3D Builder Remote Code Execution Vulnerability
-
High 7.8
3D Builder Remote Code Execution Vulnerability
3D Builder Remote Code Execution Vulnerability
-
High 7.8
3D Builder Remote Code Execution Vulnerability
3D Builder Remote Code Execution Vulnerability
-
High 7.8
.NET Framework Remote Code Execution Vulnerability
.NET Framework Remote Code Execution Vulnerability
-
High 7.8
Visual Studio Remote Code Execution Vulnerability
Visual Studio Remote Code Execution Vulnerability
-
High 7.8
Visual Studio Remote Code Execution Vulnerability
Visual Studio Remote Code Execution Vulnerability
-
High 7.8
Visual Studio Remote Code Execution Vulnerability
Visual Studio Remote Code Execution Vulnerability
-
High 7.8
Visual Studio Remote Code Execution Vulnerability
Visual Studio Remote Code Execution Vulnerability
-
High 7.6
Dynamics Finance and Operations Cross-site Scripting Vulnerability
Dynamics Finance and Operations Cross-site Scripting Vulnerability
-
High 7.0
Azure DevOps Server Remote Code Execution Vulnerability
Azure DevOps Server Remote Code Execution Vulnerability
-
High 7.8
Windows Defender Attack Surface Reduction Security Feature Bypass
Windows Defender Attack Surface Reduction Security Feature Bypass
-
High 7.6
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
-
High 7.6
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
-
High 8.8
Azure DevOps Server Remote Code Execution Vulnerability
Azure DevOps Server Remote Code Execution Vulnerability
-
High 7.5
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability