9 October 2023

13 results · Clear filters · Feed

• High 7.8
  CVE-2023-5463

  XINJE XDPPro cfgmgr32.dll uncontrolled search path

  A vulnerability was found in XINJE XDPPro up to 3.7.17a. It has been rated as critical. Affected by this issue is some unknown functionality in the library cfgmgr32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locall…

  XINJE XDPPro
  Oct 9, 2023
• High 8.8
  CVE-2023-43641 EPSS 17%

  libcue vulnerable to out-of-bounds array access

  libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Becaus…

  lipnitsk libcue libcue libcue Debian Ubuntu Alpine
  Oct 9, 2023
• High 8.3
  CVE-2023-44392

  Arbitrary code execution vulnerability when using shared Kubernetes cluster

  Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is vulnerable to code injection due to an insecure implementation of deserialization. Garden stores se…

  garden-io garden
  Oct 9, 2023
• High 8.8
  CVE-2023-42455

  Wazuh vulnerable to user privilege escalation

  Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashb…

  wazuh wazuh-kibana-app
  Oct 9, 2023
• High 7.1
  CVE-2023-44378

  gnark vulnerable to unsoundness in variable comparison/non-unique binary decomposition

  gnark is a zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.9.0, for some in-circuit values, it is possible to construct two valid decomposition to bits. In addition to the canonical decomposition of `a`, for small values t…

  Consensys gnark github.com/consensys/gnark Go
  Oct 9, 2023
• High 7.1
  CVE-2023-43698

  Improper Neutralization of Input During Web Page Generation (’Cross-site Scripting’) in RDT400 in SICK APU allows an un…

  SICK APU0200
  Oct 9, 2023
• High 7.5
  CVE-2023-43699

  Improper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU allows an unprivileged remote attacker …

  SICK APU0200
  Oct 9, 2023
• High 7.7
  CVE-2023-43700

  Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests tha…

  SICK APU0200
  Oct 9, 2023
• High 8.2
  CVE-2023-43696

  Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary file…

  SICK APU0200
  Oct 9, 2023
• High 7.1
  CVE-2023-45247

  Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…

  Acronis Acronis Cyber Protect Cloud Agent Acronis Cyber Protect 16
  Oct 9, 2023
• High 8.6
  CVE-2023-45612 Public exploit

  In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE

  JetBrains Ktor
  Oct 9, 2023
• High 7.5
  CVE-2023-45363 EPSS 24%

  MediaWiki Denial of Service vulnerability

  An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected …

  mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  Oct 9, 2023
• High 7.3
  CVE-2022-36228

  Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions. By sending a request, you can add any de…

  Oct 9, 2023