Archive
September 2023
Vulnerabilities first published in this month (UTC), newest first.
2,174 results · Feed
-
High 8.8
Cross-Site Scripting (XSS) vulnerability in Plesk
Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additional user), can fully compromise the server if an administrator visits a certain page in Plesk related to the malicious …
-
High 7.5
named may terminate unexpectedly under high DNS-over-TLS query load
A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load. This issue affect…
-
High 7.5
A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly
The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing co…
-
Low 3.5
Cross-site Scripting in M4 PDF plugin for Prestashop sites
M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource /m4pdf/pdf.php uses templates to dynamically create documents. In the case that the template does not exist, …
-
Medium 5.5
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber…
-
Low 3.9
Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8.
-
High 8.1
Quarkus: http security policy bypass
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy al…
-
Medium 6.5
Path Traversal in M4 PDF plugin for Prestashop sites
M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerability. The “f” parameter is not properly checked in the resource /m4pdf/pdf.php, returning any file given its relative path. An attacker that e…
-
Low 3.1
Exposure of data and identity to wrong session in Spring for GraphQL
A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions …
-
Unscored —
Double free issue exists in Kostac PLC Programming Software Version 1.6.11.0 and earlier. Arbitrary code may be execute…
-
Unscored —
Use after free vulnerability exists in Kostac PLC Programming Software Version 1.6.11.0. Arbitrary code may be executed…
-
Critical 9.4
JWT token compromise can allow malicious actions including Remote Code Execution (RCE)
A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.
-
High 7.5
Allocation of Resources Without Limits or Throttling in Ormazabal products
Vulnerability in the RCPbind service running on UDP port (111), allowing a remote attacker to create a denial of service (DoS) condition.
-
High 7.3
Unprotected Storage of Credentials in Ormazabal products
The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them …
-
Medium 5.7
Cleartext Transmission of Sensitive Information in Ormazabal products
The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to execute malicious actions when a user is logged in.
-
Unscored —
Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-…
-
Unscored —
imagecodecs versions before v2023.9.18 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previou…
-
Critical 10.0CVE-2023-2163 Public exploit
Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation
Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape.
-
Medium 5.3CVE-2023-26144 Public exploit
graphql Uncontrolled Resource Consumption vulnerability
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade sys…
-
Medium 6.4
Widget Responsive for Youtube <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Widget Responsive for Youtube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube' shortcode in versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This ma…
-
Medium 6.4
WordPress Charts <= 0.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WordPress Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wp_charts' shortcode in versions up to, and including, 0.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it poss…
-
Critical 9.3
Malicious Code Execution Vulnerability in FA Engineering Software Products
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a deni…
-
Medium 4.2CVE-2023-31014 Public exploit
NVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application o…
-
Medium 6.6
NVIDIA DGX H100 BMC contains a vulnerability in the REST service where a host user may cause as improper authentication…
-
Medium 6.1
NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation…
-
Medium 6.1
NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation.…
-
Medium 5.2
NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation.…
-
Medium 6.8
NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successf…
-
High 8.3
NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation…
-
High 7.3
NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successf…
-
Medium 5.7
NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successf…
-
High 8.3
NVIDIA DGX H100 BMC contains a vulnerability in the web UI, where an attacker may cause improper input validation. A su…
-
Medium 6.5
NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credential…
-
High 7.6
NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credential…
-
High 8.0
NVIDIA DGX H100 BMC contains a vulnerability in the KVM service, where an attacker may cause improper input validation.…
-
High 8.0
NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker…
-
High 8.8
NVIDIA DGX H100 baseboard management controller (BMC) contains a vulnerability in a web server plugin, where an unauthe…
-
High 7.8
NVIDIA DGX H100 BMC contains a vulnerability in the host KVM daemon, where an authenticated local attacker may cause co…
-
Medium 6.5
NVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may c…
-
High 7.5
NVIDIA Cumulus Linux contains a vulnerability in forwarding where a VxLAN-encapsulated IPv6 packet received on an SVI i…