Archive
September 2023
Vulnerabilities first published in this month (UTC), newest first.
2,174 results · Feed
-
High 7.5
Socomec MOD3GP-SY-120K Insecure Storage of Sensitive Information
Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process.
-
Medium 6.3
Juplink RX4-1500 Hard-coded Credential Vulnerability
Hard-coded credentials in Juplink RX4-1500 versions V1.0.2 through V1.0.5 allow unauthenticated attackers to log in to the web interface or telnet service as the 'user' user.
-
Medium 5.9
Glibc: potential use-after-free in getaddrinfo()
A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_…
-
Medium 6.5
Glibc: stack read overflow in getaddrinfo in no-aaaa mode
A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents thr…
-
High 7.5
K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack
An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.…
-
High 8.4
A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) th…
-
High 7.3
Cross-Site Request Forgery (CSRF) in usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1.
-
Medium 6.3
SourceCodester My Food Recipe Image Upload index.php unrestricted upload
A vulnerability classified as problematic was found in SourceCodester My Food Recipe 1.0. This vulnerability affects unknown code of the file index.php of the component Image Upload Handler. The manipulation leads to unrestricted upload. The attack can be ini…
-
Medium 6.3
OpenRapid RapidCMS cate-edit-run.php sql injection
A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /admin/category/cate-edit-run.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack re…
-
Medium 6.3
OpenRapid RapidCMS article-edit-run.php sql injection
A vulnerability was found in OpenRapid RapidCMS 1.3.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/article/article-edit-run.php. The manipulation of the argument id leads to sql injection. The attack …
-
High 8.8
ASUS RT-AX88U - externally-controlled format string
ASUS router RT-AX88U has a vulnerability of using externally controllable format strings within its Advanced Open VPN function. An authenticated remote attacker can exploit the exported OpenVPN configuration to execute an externally-controlled format string a…
-
High 7.5
SUNNET WMPro - SQL Injection
SUNNET WMPro portal's FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain sensitive information via a database.
-
High 7.2
SUNNET WMPro - Command Injection
SUNNET WMPro portal's file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or a privileged account can exploit this vulnerability to inject and execute arbitrary system commands …
-
Medium 6.3
OpenRapid RapidCMS article-add.php sql injection
A vulnerability was found in OpenRapid RapidCMS 1.3.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/article/article-add.php. The manipulation of the argument id leads to sql injection. The att…
-
Unscored —
An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte of kernel mem…
-
Unscored —
An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The impl…
-
Critical 9.8
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.
-
Unscored —
An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted …
-
Medium 6.5
An information leak in TonTon-Tei_waiting Line v13.6.1 allows attackers to obtain the channel access token and send cra…
-
Unscored —
An information leak in youmart-tokunaga v13.6.1 allows attackers to obtain the channel access token and send crafted me…
-
Unscored —
An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and se…
-
Unscored —
An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send cra…
-
Medium 6.5
An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted me…
-
Unscored —
An information leak in Coffee-jumbo v13.6.1 allows attackers to obtain the channel access token and send crafted messag…
-
Unscored —
SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway re…
-
High 7.3
A DLL hijacking vulnerability in Samsung Memory Card & UFD Authentication Utility PC Software before 1.0.1 could allow …
-
Unscored —
SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted scri…
-
Unscored —
An issue in xui-xray v1.8.3 allows attackers to obtain sensitive information via default password.
-
Unscored —
Certain WithSecure products allow a remote crash of a scanning engine via unpacking of a PE file. This affects WithSecu…
-
Unscored —
Certain WithSecure products allow a remote crash of a scanning engine via processing of a compressed file. This affects…
-
Unscored —
Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSe…
-
Unscored —
Certain WithSecure products allow a remote crash of a scanning engine via unpacking of crafted data files. This affects…
-
Unscored —
An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and e…
-
Unscored —
Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file. …
-
Unscored —
Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting (XSS) in Add Accounts via Invoice No, To, an…
-
Unscored —
An issue in TDSQL Chitu management platform v.10.3.19.5.0 allows a remote attacker to obtain sensitive information via …
-
Unscored —
SQL injection vulnerability in Exam Form Submission in PHP with Source Code v.1.0 allows a remote attacker to escalate …
-
Unscored —
Cross Site Scripting vulnerability in Summernote Rich Text Editor v.0.8.18 and before allows a remote attacker to execu…
-
Unscored —
Buffer Overflow vulnerability in Tenda AC10V4 v.US_AC10V4.0si_V16.03.10.13_cn_TDC01 allows a remote attacker to cause a…
-
Unscored —
Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSe…