Archive
September 2023
Vulnerabilities first published in this month (UTC), newest first.
2,174 results · Feed
-
High 8.0
Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL
Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL. This issue affects Docker Desktop: before 4.23.0.
-
High 7.1
Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shell
Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible for a short time window after launching Docker Desktop. The affected functionality is available for…
-
Medium 5.6
A stack-based buffer overflow vulnerability exists in the tif_processing_dng_channel_count functionality of Accusoft Im…
-
High 8.1
A heap-based buffer overflow vulnerability exists in the CreateDIBfromPict functionality of Accusoft ImageGear 20.1. A …
-
Critical 9.8
A heap-based buffer overflow vulnerability exists in the pictwread functionality of Accusoft ImageGear 20.1. A speciall…
-
High 7.0
A heap-based buffer overflow vulnerability exists in the create_png_object functionality of Accusoft ImageGear 20.1. A …
-
High 8.1
An out-of-bounds write vulnerability exists in the tiff_planar_adobe functionality of Accusoft ImageGear 20.1. A specia…
-
Critical 9.8
A use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1. A specially cr…
-
Critical 9.8
An out-of-bounds write vulnerability exists in the dcm_pixel_data_decode functionality of Accusoft ImageGear 20.1. A sp…
-
Critical 9.8
An out-of-bounds write vulnerability exists in the allocate_buffer_for_jpeg_decoding functionality of Accusoft ImageGea…
-
High 7.3
Stored XSS leads to privilege escalation in MediaWiki v1.40.0
Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious lin…
-
Unscored —
Command injection vulnerability in the distributed file system module. Successful exploitation of this vulnerability ma…
-
Unscored —
Input verification vulnerability in the fingerprint module. Successful exploitation of this vulnerability will affect c…
-
Unscored —
Data security classification vulnerability in the DDMP module. Successful exploitation of this vulnerability may affect…
-
Unscored —
Redirection permission verification vulnerability in the home screen module. Successful exploitation of this vulnerabil…
-
Unscored —
Vulnerability of unauthorized API access in the PMS module. Successful exploitation of this vulnerability may cause fea…
-
Unscored —
Vulnerability of parameters not being strictly verified in the PMS module. Successful exploitation of this vulnerabilit…
-
Unscored —
DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.
-
Unscored —
Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect conf…
-
Unscored —
Vulnerability of defects introduced in the design process in the HiviewTunner module. Successful exploitation of this v…
-
Unscored —
Vulnerability of missing authorization in the kernel module. Successful exploitation of this vulnerability may affect i…
-
Unscored —
Vulnerability of improper permission management in the displayengine module. Successful exploitation of this vulnerabil…
-
Unscored —
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super…
-
Unscored —
DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.
-
Unscored —
DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.
-
Unscored —
The Watchkit has a risk of unauthorized file access.Successful exploitation of this vulnerability may affect confidenti…
-
Medium 6.3CVE-2023-5154 EPSS 15%
D-Link DAR-8000 changelogo.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-8000 up to 20151231 and classified as critical. This vulnerability affects unknown code of the file /sysmanage/changelogo.php. The manipulation of the argument file_upload leads to u…
-
Medium 6.3
D-Link DAR-8000 querysql.php sql injection
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-8000 up to 20151231. This affects an unknown part of the file /Tool/querysql.php. The manipulation leads to sql injection. It is possible to initiate th…
-
Medium 6.3
D-Link DAR-7000/DAR-8000 importexport.php sql injection
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected by this issue is some unknown functionality of the file /importexport.php. The manipulation of the argum…
-
Medium 6.3CVE-2023-5151 EPSS 81%
D-Link DAR-8000 autheditpwd.php sql injection
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231. Affected by this vulnerability is an unknown functionality of the file /autheditpwd.php. The manipulation of the argument hid_id leads to sql i…
-
Medium 6.3CVE-2023-5150 EPSS 23%
D-Link DAR-7000/DAR-8000 web.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unknown function of the file /useratte/web.php. The manipulation of the argument file_upload leads to unrestri…
-
High 7.1
WordPress WoodMart Theme <= 7.2.4 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xtemos WoodMart plugin <= 7.2.4 versions.
-
Medium 6.3CVE-2023-5149 EPSS 21%
D-Link DAR-7000 userattestation.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been rated as critical. This issue affects some unknown processing of the file /useratte/userattestation.php. The manipulation of the argument web_img leads to…
-
Medium 6.3CVE-2023-5148 EPSS 31%
D-Link DAR-7000/DAR-8000 uploadfile.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231. It has been declared as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload …
-
High 7.1
WordPress Order Delivery Date for WooCommerce Plugin <= 3.20.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Order Delivery Date for WooCommerce plugin <= 3.20.0 versions.
-
Medium 5.9
WordPress Cookie Notice & Consent Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christoph Rado Cookie Notice & Consent plugin <= 1.6.0 versions.
-
Medium 5.9
WordPress iFolders Plugin <= 1.5.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Avirtum iFolders plugin <= 1.5.0 versions.
-
Medium 6.3CVE-2023-5147 EPSS 26%
D-Link DAR-7000 updateos.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been classified as critical. This affects an unknown part of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload leads to unrestri…
-
Medium 6.3CVE-2023-5146 EPSS 32%
D-Link DAR-7000/DAR-8000 updatelib.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231 and classified as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updatelib.php. The manipulation of the argument fi…
-
Medium 5.3
MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses int…