Archive
September 2023
Vulnerabilities first published in this month (UTC), newest first.
700 results · Clear filters · Feed
-
Medium 6.4
In camsys, there is a possible use after free due to a race condition. This could lead to local escalation of privilege…
-
Medium 6.4
In pda, there is a possible use after free due to a race condition. This could lead to local escalation of privilege wi…
-
Medium 4.4
In keyinstall, there is a possible information disclosure due to a missing bounds check. This could lead to local infor…
-
Medium 6.7
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p…
-
Medium 6.7
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p…
-
Medium 6.7
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p…
-
Medium 6.7
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p…
-
Medium 6.7
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p…
-
Medium 6.7
In ims service, there is a possible memory corruption due to a race condition. This could lead to local escalation of p…
-
Medium 5.5
In cta, there is a possible information disclosure due to a missing permission check. This could lead to local informat…
-
Medium 6.7
In netdagent, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
Medium 6.7
In nvram, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
-
Medium 4.4
In vdsp device, there is a possible system crash due to improper input validation.This could lead to local denial of se…
-
Medium 6.3
SourceCodester Inventory Management System index.php file inclusion
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page leads to file inclusion. It is possible to launch the …
-
Medium 6.3
DedeCMS tags.php sql injection
A vulnerability classified as critical was found in DedeCMS 5.7.110. This vulnerability affects unknown code of the file /uploads/tags.php. The manipulation of the argument tag_alias leads to sql injection. The attack can be initiated remotely. The exploit ha…
-
Medium 6.3
Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform importexport.php sql injection
A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230822. It has been rated as critical. Affected by this issue is some unknown functionality of the file /importexport.php. The manipulation lea…
-
Medium 6.3
IBOS OA export&uid=X sql injection
A vulnerability was found in IBOS OA 4.5.5 and classified as critical. This issue affects some unknown processing of the file ?r=dashboard/user/export&uid=X. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been d…
-
Medium 6.3CVE-2023-4741 Public exploit
IBOS OA Delete Logs del sql injection
A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects unknown code of the file ?r=diary/default/del of the component Delete Logs Handler. The manipulation leads to sql injection. The attack can be initiated rem…
-
Medium 6.3
IBOS OA Delete Draft delDraft&archiveId=0 sql injection
A vulnerability, which was classified as critical, was found in IBOS OA 4.5.5. This affects an unknown part of the file ?r=email/api/delDraft&archiveId=0 of the component Delete Draft Handler. The manipulation leads to sql injection. It is possible to initiat…
-
Medium 6.3
Byzoro Smart S85F Management Platform updateos.php unrestricted upload
A vulnerability, which was classified as critical, has been found in Byzoro Smart S85F Management Platform up to 20230820. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload…
-
Medium 4.8
Farsight Tech Nordic AB ProVide
Farsight Tech Nordic AB ProVide version 14.5 - Multiple XSS vulnerabilities (CWE-79) can be exploited by a user with administrator privilege.
-
Medium 5.9
WordPress Client Portal : SuiteDash Direct Login Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SuiteDash :: ONE Dashboard® Client Portal : SuiteDash Direct Login plugin <= 1.7.6 versions.
-
Medium 5.9
WordPress Post Affiliate Pro Plugin <= 1.25.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QualityUnit Post Affiliate Pro plugin <= 1.25.0 versions.
-
Medium 6.5
WordPress Audio Player with Playlist Ultimate Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin <= 1.2.2 versions.
-
Medium 5.9
WordPress WRC Pricing Tables Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Realwebcare WRC Pricing Tables plugin <= 2.3.7 versions.
-
Medium 5.9
WordPress Borderless Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Visualmodo Borderless plugin <= 1.4.8 versions.
-
Medium 5.9
WordPress Elastic Email Sender Plugin <= 1.2.6 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Elastic Email Sender plugin <= 1.2.6 versions.
-
Medium 5.9
WordPress Exifography Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Exifography plugin <= 1.3.1 versions.
-
Medium 4.8
Out-of-bounds Write in vim/vim
Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.
-
Medium 5.3
MXsecurity Register Database Pollution
A vulnerability that poses a potential risk of polluting the MXsecurity sqlite database and the nsm-web UI has been identified in MXsecurity versions prior to v1.0.1. This vulnerability might allow an unauthenticated remote attacker to register or add devices…
-
Medium 6.4
Font Awesome 4 Menus <= 4.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Font Awesome 4 Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fa' and 'fa-stack' shortcodes in versions up to, and including, 4.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. T…
-
Medium 4.3CVE-2023-4714 Scanner template
PlayTube Redirect information disclosure
A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. The identifier VDB…
-
Medium 5.5
IBOS OA addcomment addComment sql injection
A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects the function addComment of the file ?r=weibo/comment/addcomment. The manipulation of the argument touid leads to sql injection. The exploit has been disclos…
-
Medium 6.3
Velocity execution without script rights in Xwiki platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "Ve…
-
Medium 5.5
Xintian Smart Table Integrated Management System AddUpdateRole.aspx sql injection
A vulnerability, which was classified as critical, was found in Xintian Smart Table Integrated Management System 5.6.9. This affects an unknown part of the file /SysManage/AddUpdateRole.aspx. The manipulation of the argument txtRoleName leads to sql injection…
-
Medium 5.0
D-Link DAR-8000-10 decodmail.php os command injection
A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230819. Affected by this issue is some unknown functionality of the file /log/decodmail.php. The manipulation of the argument file leads to os command injection. T…
-
Medium 4.3
TOTVS RM Portal cross site scripting
A vulnerability classified as problematic was found in TOTVS RM 12.1. Affected by this vulnerability is an unknown functionality of the component Portal. The manipulation of the argument d leads to cross site scripting. The attack can be launched remotely. Th…
-
Medium 6.3
Infosoftbd Clcknshop GET Parameter all sql injection
A vulnerability was found in Infosoftbd Clcknshop 1.0.0. It has been rated as critical. This issue affects some unknown processing of the file /collection/all of the component GET Parameter Handler. The manipulation of the argument tag leads to sql injection.…
-
Medium 4.9
I some cases, when the device is USB-tethered to a host PC, and the device is sharing its mobile network connection wit…
-
Medium 5.9
Out-of-bounds Read in gpac/gpac
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.