Archive
September 2023
Vulnerabilities first published in this month (UTC), newest first.
2,174 results · Feed
-
Medium 6.0
Pgadmin4: remote code execution by an authenticated user
A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code exec…
-
Medium 6.4
WP-Matomo Integration (WP-Piwik) <= 1.0.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WP-Matomo Integration (WP-Piwik) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp-piwik' shortcode in versions up to, and including, 1.0.28 due to insufficient input sanitization and output escaping on user supplied attributes…
-
Medium 6.4
Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to, and including, 3.10 due to insufficient input sanitization and output escaping on user supplied attributes. This m…
-
Medium 5.5
Gnome-shell: screenshot tool allows viewing open windows when session is locked
A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.
-
High 8.1
Multimedia Console
A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors. We have already fixed the vulnerability in the…
-
High 8.1
QTS
A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors. We have already fixed the vulnerability in the …
-
High 8.8
QTS, QuTS hero, QuTScloud
An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices. We have already fixed the vulnerability in the follow…
-
High 8.8
An issue was discovered in Wind River VxWorks 6.9 and 7. The function ``tarExtract`` implements TAR file extraction and…
-
Critical 9.8CVE-2023-40989 Public exploit
SQL injection in jeecgboot
SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.
-
Unscored —
Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/cadence-wineasio.reg Temporary File. The filename is used even i…
-
Unscored —
D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection.
-
Unscored —
Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/.cadence-aloop-daemon.x Temporary File. The file is used even if…
-
Unscored —
SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via…
-
Unscored —
SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via t…
-
Unscored —
Certain WithSecure products allow Local privilege escalation via the lhz archive unpack handler. This affects WithSecur…
-
Unscored —
Certain WithSecure products allow Denial of Service via the aepack archive unpack handler. This affects WithSecure Clie…
-
Unscored —
D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of…
-
Unscored —
Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. NOT…
-
Medium 6.1
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with craf…
KEV Feb 12, 2024 -
Unscored —CVE-2023-43144 Public exploit
Projectworldsl Assets-management-system-in-php 1.0 is vulnerable to SQL Injection via the "id" parameter in delete.php.
-
High 7.5
Certain WithSecure products allow Denial of Service (infinite loop). This affects WithSecure Client Security 15, WithSe…
-
Unscored —
Certain WithSecure products allow XSS via an unvalidated parameter in the endpoint. This affects WithSecure Policy Mana…
-
Unscored —
SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via t…
-
High 7.5
Certain WithSecure products allow Denial of Service in the aeelf component. This affects WithSecure Client Security 15,…
-
Unscored —
dst-admin v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the userId parameter at /…
-
Unscored —
Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr()…
-
Critical 9.8
Certain WithSecure products allow Unauthenticated Remote Code Execution via the web server (backend). This affects With…
-
Medium 5.5
In nqptp-message-handlers.c in nqptp before 1.2.3, crafted packets received on the control port could crash the program.
-
Unscored —
Certain WithSecure products allow Denial of Service via a fuzzed PE32 file. This affects WithSecure Client Security 15,…
-
High 7.0CVE-2023-4504 Public exploit
OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow
Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in Septembe…
-
High 7.8
Delta Electronics DIAScreen Out-of-bounds Write
Delta Electronics DIAScreen may write past the end of an allocated buffer while parsing a specially crafted input file. This could allow an attacker to execute code in the context of the current process.
-
High 8.8
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead t…
KEV Sep 25, 2023 -
High 7.8
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, mac…
KEV Sep 25, 2023 -
Medium 5.5
A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A ma…
KEV Sep 25, 2023 -
Low 3.7
plone.restapi vulnerable to Stored Cross Site Scripting with SVG image in user portrait
### Impact There is a stored cross site scripting vulnerability for SVG images uploaded in user portraits. Note that a page that uses an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the…
-
Critical 9.8
systeminformation SSID Command Injection Vulnerability
systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that…
-
Critical —
CefSharp affected by heap buffer overflow in WebP
**Google is aware that an exploit for [CVE-2023-4863](https://www.cve.org/CVERecord?id=CVE-2023-4863) exists in the wild.** ### Description Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bo…
-
Low —
Vulnerable OpenSSL included in cryptography wheels
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 2.5-41.0.3 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openss…
-
Medium 6.5
Snapshot signature not including HeadID will allow replay attacks
Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, not signing and verifying `$\mathsf{cid}$` allows an attacker (which must be a participant of this head) to use a snapshot from an old head instance with the same participants t…
-
High 7.5
quinn-proto Denial of Service vulnerability
quinn-proto is a state machine for the QUIC transport protocol. Prior to versions 0.9.5 and 0.10.5, receiving unknown QUIC frames in a QUIC packet could result in a panic. The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.