Archive
September 2023
Vulnerabilities first published in this month (UTC), newest first.
2,174 results · Feed
-
High 7.5
Magento LTS's guest order "protect code" can be brute-forced too easily
Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-f…
-
Medium —
Inventory exposes reference to non-Sync data to an arbitrary thread
Affected versions do not enforce a `Sync` bound on the type of caller-provided value held in the plugin registry. References to these values are made accessible to arbitrary threads other than the one that constructed them. A caller could use this flaw to sub…
-
Medium —
Users vulnerable to unaligned read of `*const *const c_char` pointer
Affected versions dereference a potentially unaligned pointer. The pointer is commonly unaligned in practice, resulting in undefined behavior. In some build modes, this is observable as a panic followed by abort. In other build modes the UB may manifest in so…
-
Medium —
Inventory fails to prohibit standard library access prior to initialization of Rust standard library runtime
Affected versions allow arbitrary caller-provided code to execute before the lifetime of `main`. If the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as `std::io` or `std::thread`, these…
-
High 8.1
Drools: unsafe data deserialization in streamutils
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the s…
-
Unscored —CVE-2023-35687 Public exploit
In MtpPropertyValue of MtpProperty.h, there is a possible memory corruption due to a use after free. This could lead to…
-
Unscored —
In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to an integer overflow. This could lead t…
-
Unscored —
In bindSelection of DatabaseUtils.java, there is a possible way to access files from other applications due to SQL inje…
-
Unscored —
In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. Th…
-
Unscored —
In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission …
-
High 7.8
In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to …
-
Unscored —
In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow. Th…
-
Unscored —
In MtpPropertyValue of MtpProperty.h, there is a possible out of bounds read due to uninitialized data. This could lead…
-
Unscored —
In loadMediaResumptionControls of MediaResumeListener.kt, there is a possible way to play and listen to media files pla…
-
High 8.8
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the co…
KEV Sep 13, 2023 -
Unscored —CVE-2023-35671 Public exploit
In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read t…
-
Unscored —
In createQuickShareAction of SaveImageInBackgroundTask.java, there is a possible way to trigger a background activity l…
-
Unscored —
In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an integer overflow. This could l…
-
Unscored —
In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to control other running acti…
-
Unscored —
In bta_av_rc_msg of bta_av_act.cc, there is a possible use after free due to a logic error in the code. This could lead…
-
Unscored —
In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. T…
-
Unscored —
In updateList of NotificationAccessSettings.java, there is a possible way to hide approved notification listeners in th…
-
High 7.8
In computeValuesFromData of FileUtils.java, there is a possible way to insert files to other apps' external private dir…
-
Unscored —
In multiple files, there is a possible way to import a contact from another user due to a missing permission check. Thi…
-
Unscored —
In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible privilege escalation due to a use after free. This co…
-
High 8.7
Relative Path Traversal in mintplex-labs/anything-llm
Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.
-
Medium 6.1CVE-2023-4294 Public exploit
URL Shortify < 1.7.6 - Unauthenticated Stored XSS via referer header
The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short…
-
Medium 4.8
tagDiv Composer < 4.2 - Admin+ Stored XSS
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even…
-
High 7.5CVE-2023-4278 Public exploit
MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.
-
Medium 4.8
WP Adminify < 3.1.6 - Admin+ Stored XSS
The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for ex…
-
Unscored —
FTP Access <= 1.0 - Subscriber+ Stored XSS
The FTP Access WordPress plugin through 1.0 does not have authorisation and CSRF checks when updating its settings and is missing sanitisation as well as escaping in them, allowing any authenticated users, such as subscriber to update them with XSS payloads, …
-
Medium 6.1CVE-2023-3169 Scanner template
tagDiv Composer < 4.2 - Unauthenticated Stored XSS
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could al…
-
Medium 4.8
Herd Effects < 5.2.3 - Admin+ Stored XSS
The Herd Effects WordPress plugin before 5.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for e…
-
High 7.2
wpDataTables < 2.1.66 - Admin+ PHP Object Injection
The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is prese…
-
Medium 6.1
Appointment booking addon for Gravity Forms < 1.10.0 - Reflected Cross-Site Scripting
The gAppointments WordPress plugin before 1.10.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin
-
Medium 4.3
Herd Effects < 5.2.4 - Effect Deletion via CSRF
The Herd Effects WordPress plugin before 5.2.4 does not have CSRF when deleting its items, which could allow attackers to make logged in admins delete arbitrary effects via a CSRF attack
-
Medium 6.1
Min Max Control < 4.6 - Reflected XSS
The Min Max Control WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
-
Medium 4.3
Lock User Account <= 1.0.3 - Arbitrary Account Lock/Unlock via CSRF
The Lock User Account WordPress plugin through 1.0.3 does not have CSRF check when bulk locking and unlocking accounts, which could allow attackers to make logged in admins lock and unlock arbitrary users via a CSRF attack
-
High 8.8
Dover Fueling Solutions MAGLINK LX Web Console Authentication Bypass by Primary Weakness
Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 could allow a guest user to elevate to admin privileges.
-
Medium 6.8
Dover Fueling Solutions MAGLINK LX Console Path Traversal
Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 vulnerable to a path traversal attack, which could allow an attacker to access files stored on the system.