Archive
September 2023
Vulnerabilities first published in this month (UTC), newest first.
2,174 results · Feed
-
Medium 5.3
A vulnerability in the SSH service of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to …
-
High 7.5
Vulnerability in the Elasticsearch database used in the of Cisco SD-WAN vManage software could allow an unauthenticated…
-
High 7.1
A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authent…
-
High 7.2
A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow …
-
Unscored —
This module enables notifications to be sent to all users of a particular role, or to the content's author when a piece…
-
High 7.3
Dell AppSync, versions 4.4.0.0 to 4.6.0.0 including Service Pack releases, contains an improper access control vulnerab…
-
Medium 5.9
Dell Data Protection Central, version 19.9, contains an Inadequate Encryption Strength Vulnerability. An unauthenticate…
-
Medium 6.8
BIG-IP APM Clients TunnelCrack vulnerability
BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
-
Medium 5.3
BIG-IP APM Clients TunnelCrack vulnerability
BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
-
Medium 5.3
WS_FTP Server Information Disclosure via Directory Listing
In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing.
-
Medium 6.8
WS_FTP Server Cross-Site Request Forgery (CSRF) Vulnerability
In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transaction corresponding to a WS_FTP Server administrative function.
-
High 8.3
WS_FTP Server Stored Cross-Site Scripting Vulnerability
In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module. An attacker with administrative privileges could import a SSL certificate with malicious attributes containing cross-site s…
-
High 8.2
WS_FTP Server SQL Injection via Administrative Interface
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alte…
-
High 8.3
WS_FTP Server Ad Hoc Transfer Module Reflected Cross-Site Scripting Vulnerability
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module. An attacker could leverage this vulnerability to target WS_FTP Server users with a specialized payload …
-
Critical 9.9CVE-2023-42657 EPSS 16%
WS_FTP Server Directory Traversal
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized W…
-
Critical 10.0
WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
KEV Oct 5, 2023 -
Critical 9.8
During process shutdown, it was possible that an `ImageBitmap` was created that would later be used after being freed f…
-
Unscored —
In a non-standard configuration of Firefox, an integer overflow could have occurred based on network traffic (possibly …
-
Critical 9.8
A hashtable in the Ion Engine could have been mutated while there was a live interior reference, leading to a potential…
-
Unscored —
In canvas rendering, a compromised content process could have caused a surface to change unexpectedly, leading to a mem…
-
Critical 9.8
Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence…
-
Critical 9.8
If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointe…
-
Unscored —
During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to…
-
Unscored —
A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds wri…
-
Critical 9.8
A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds writ…
-
Low 3.6
Messaging - Gaining access to arbitrary content providers via QClipIntentReceiverActivity
The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.android.mms.ui.QClipIntentReceiverActivity" activity. The attacker can abuse this functionality by lau…
-
Medium 5.0
LGInstallService - Deletion of arbitrary files with system privilege
he vulnerability is to delete arbitrary files in LGInstallService ("com.lge.lginstallservies") app. The app contains the exported "com.lge.lginstallservies.InstallService" service that exposes an AIDL interface. All its "installPackage*" methods are finally c…
-
Low 3.6
Call management - Implicit activity intents disclose contact details and phone numbers
he vulnerability is that the Call management ("com.android.server.telecom") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and p…
-
Low 3.6
Call management - Implicit intents disclose telephony data such as phone numbers, call states, contacts
The vulnerability is that the Call management ("com.android.server.telecom") app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as ca…
-
Medium 6.3
HimitZH HOJ Topic sandbox
A vulnerability, which was classified as critical, has been found in HimitZH HOJ up to 4.6-9a65e3f. This issue affects some unknown processing of the component Topic Handler. The manipulation leads to sandbox issue. The attack may be initiated remotely. The e…
-
Medium 6.1
Personalized service - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijacking
The vulnerability is the use of implicit PendingIntents without the PendingIntent.FLAG_IMMUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Personalized service ("com.lge.abba") app. The attacker's app, if it h…
-
Medium 6.1
Screen recording - Theft of arbitrary files with system privilege
The vulnerability is to theft of arbitrary files with system privilege in the Screen recording ("com.lge.gametools.gamerecorder") app in the "com/lge/gametools/gamerecorder/settings/ProfilePreferenceFragment.java" file. The main problem is that the app launch…
-
High 7.5
Undertow: outofmemoryerror due to @multipartconfig handling
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limi…
-
Medium 6.1
Bluetooth - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijacking
The vulnerability is the use of implicit PendingIntents with the PendingIntent.FLAG_MUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Bluetooth ("com.lge.bluetoothsetting") app. The attacker's app, if it had a…
-
Medium 6.1
LockScreenSettings - Theft arbitrary files with system privilege
The vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings ("com.lge.lockscreensettings") app in the "com/lge/lockscreensettings/dynamicwallpaper/MyCategoryGuideActivity.java" file. The main problem is that the app launch…
-
Medium 4.7
Red hat a-mq streams: component version with information disclosure flaw
A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access informa…
-
High 7.4
Apicast proxies the api call with incorrect jwt token to the api backend without proper authorization check
A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a separate realm to be accessible to an attacker, permitting access to unauthorized information.
-
Medium 6.3
Viessmann Vitogate 300 Web Management Interface vitogate.cgi isValidUser hard-coded password
A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. This vulnerability affects the function isValidUser of the file /cgi-bin/vitogate.cgi of the component Web Management Interface. The manipulation leads to use of hard-co…
-
Medium 4.7
ForU CMS index.php code injection
A vulnerability classified as critical has been found in ForU CMS. This affects an unknown part of the file /install/index.php. The manipulation of the argument db_name leads to code injection. It is possible to initiate the attack remotely. The exploit has b…
-
High 7.1
WordPress Sermon'e – Sermons Online Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Beplus Sermon'e – Sermons Online plugin <= 1.0.0 versions.