Archive
September 2023
Vulnerabilities first published in this month (UTC), newest first.
2,174 results · Feed
-
Medium 6.3
Frappe LMS SQL Injection Issue on People Page
Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The issue has been fixed in the `main` branch. Users won't face this issue if they are using the latest …
-
Low 3.7
Zope vulnerable to Stored Cross Site Scripting with SVG images
Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross site scripting vulnerability for SVG images. Note that an image tag with an SVG image as source is never vulnerable, even when the SVG image contains ma…
-
Low 3.3
sudo-rs Session File Relative Path Traversal vulnerability
Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout …
-
High 7.5
plone.rest vulnerable to Denial of Service when ++api++ is used many times
plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingl…
-
Low 3.7
plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images
plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site scripting vulnerability for SVG images. A security hotfix…
-
High 7.5
DataEase has a vulnerability to obtain user cookies
DataEase is an open source data visualization and analysis tool. Prior to version 1.18.11, DataEase has a vulnerability that allows an attacker to to obtain user cookies. The program only uses the `ImageIO.read()` method to determine whether the file is an im…
-
High 7.8
Vault Key Partially Predetermined
Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be "arfoobarfoobarfo". This issue happens because "deriveVaultKey" calls "retrieveCloudKey" (which will always r…
-
High 8.8
SSH as Root Unlockable Without Triggering Measured Boot
On boot, the Pillar eve container checks for the existence and content of “/config/authorized_keys”. If the file is present, and contains a supported public key, the container will go on to open port 22 and enable sshd with the given keys as the authorized ke…
-
Critical 9.0
Freely Allocate Buffer on The Stack With Data From Socket
As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port 8877 in EVE, exposing limited functionality of the TPM to the clients. VTPM allows clients to execute tpm2-tools binaries from a list of hardcoded options” The commun…
-
High 8.8
Debug Functions Unlockable Without Triggering Measured Boot
On boot, the Pillar eve container checks for the existence and content of “/config/GlobalConfig/global.json”. If the file exists, it overrides the existing configuration on the device on boot. This allows an attacker to change the system’s configuration, whic…
-
High 8.8
Config Partition Not Protected by Measured Boot
When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used. In a previous project, CYMOTIVE found that the configuration is not protected by the secure boot, and in response Zededa implemented measurements on the config …
-
Low 3.9
OpenHarmony v3.2.1 and prior version has a system call function usage error
OpenHarmony v3.2.1 and prior version has a system call function usage error. Local attackers can crash kernel by the error input.
-
Medium 5.7
Improper Input Validation in nocodb/nocodb
Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0.
-
High 7.6
Remote Code Execution in Eclipse RAP on Windows
In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reason for this is a not completely secure extraction of the file name in the FileUploadProcessor.stripFileNam…
-
Medium 5.3
Frauscher FDS101 for FAdC/FAdCi SQL injection vulnerability
Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a SQL injection vulnerability via manipulated parameters of the web interface without authentication. The database contains limited, non-critical log inform…
-
High 7.5
Frauscher FDS101 for FAdC/FAdCi path traversal vulnerability
Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a crafted URL without authentication. This enables an remote attacker to read all files on the filesy…
-
Critical 9.8
Frauscher FDS101 for FAdC/FAdCi remote code execution vulnerability
Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a remote code execution (RCE) vulnerability via manipulated parameters of the web interface without authentication. This could lead to a full compromise of …
-
Medium 5.9
Dell SCG Policy Manager 5.16.00.14 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated at…
-
High 8.8
Composer allows cache poisoning from other projects built on the same host
Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is de…
-
Critical 9.8
Yii2 allows attackers to execute any local .php file via a relative path in the view parameter
web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.
-
Critical 9.8
SQL injection vulnerability in updatepos.php in PrestaShop opartfaq through 1.0.3 allows remote attackers to run arbitr…
-
Critical 9.8
SQL injection vulnerability in Prestashop opartplannedpopup 1.4.11 and earlier allows remote attackers to run arbitrary…
-
Unscored —
An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 202…
-
Unscored —
An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFi…
-
Critical 9.8
FUXA SQL Injection vulnerability
FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.
-
High 7.5CVE-2023-31716 Public exploit
FUXA vulnerable to Local File Inclusion
FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log
-
High 7.5CVE-2023-31718 Public exploit
FUXA local file inclusion vulnerability
FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.
-
High 7.5CVE-2023-31717 Public exploit
FUXA SQL Injection vulnerability
A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.
-
Unscored —
A reflected cross-site scripting (XSS) vulnerability in the Search Student function of Student Management System v1.2.3…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in the Add Animal Details function of Zoo Management System v1.0 allo…
-
High 7.5
Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions. NOTE: the vendor's position is t…
-
Medium 4.7
Samsung Mobile Processor Exynos 2200 allows a GPU Use After Free.
-
Unscored —
mee-admin 1.5 is vulnerable to Directory Traversal. The download method in the CommonFileController.java file does not …
-
Unscored —
Dreamer CMS v4.1.3 was discovered to contain a SQL injection vulnerability via the model-form-management-field form.
-
High 8.8
D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter statuscheckpppoeuser in dir_setWa…
-
Unscored —
D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter TXPower and GuardInt in SetWLanRadio…
-
High 7.5
Phpjabbers PHP Shopping Cart 4.2 is vulnerable to SQL Injection via the id parameter.
-
High 8.8CVE-2023-43237 EPSS 14%
D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter macCloneMac in setMAC.
-
High 7.5
Tungstenite allows remote attackers to cause a denial of service
The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., …
-
Unscored —
D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter StartTime and EndTime in SetWifiDown…