Archive
October 2023
Vulnerabilities first published in this month (UTC), newest first.
184 results · Clear filters · Feed
-
Critical 9.7
authentik potential installation takeover when default admin user is deleted
authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authent…
-
Critical 9.1
Overwrite of builtin Cody commands facilitates RCE
Cody is an artificial intelligence (AI) coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution under certain conditions. An attacker in control of a malicious repository could modify the Cody conf…
-
Critical 10.0
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authori…
KEV Nov 7, 2023 -
Critical 9.9
Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application
Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution.
-
Critical 9.8
Prestashop opartlimitquantity 1.4.5 and before is vulnerable to SQL Injection. OpartlimitquantityAlertlimitModuleFrontC…
-
Critical 9.8
An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setTracer…
-
Critical 9.8
An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setLedCfg…
-
Critical 9.8
TOTOLINK A3300R 17.0.0cu.557_B20221024 contains a command injection via the file_name parameter in the UploadFirmwareFi…
-
Critical 9.8
In TOTOLINK A3300R V17.0.0cu.557_B20221024 when dealing with setLedCfg request, there is no verification for the enable…
-
Critical 9.8
TOTOLINK LR1200GB V9.1.0u.6619_B20230130 was discovered to contain a stack overflow via the password parameter in the f…
-
Critical 9.8
TOTOLINK X6000R V9.4.0cu.852_B20230719 was discovered to contain a command injection vulnerability via the enable param…
-
Critical 9.9
PHP to Page <= 0.3 - Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcode
The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to include …
-
Critical 9.0
Ads by datafeedr.com <= 1.1.3 - Unauthenticated (Limited) Remote Code Execution
The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the 'dfads_ajax_load_ads' function. This allows unauthenticated attackers to execute code on the server. The parameters of the cal…
-
Critical 9.1
Improper Input Validation in mintplex-labs/anything-llm
Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.
-
Critical 9.8
DreamSecurity MagicLine Buffer Overflow Vulnerability
A Buffer overflow vulnerability in DreamSecurity MagicLine4NX versions 1.0.0.1 to 1.0.0.26 allows an attacker to remotely execute code.
-
Critical 9.8
OpenCRX allows a remote attacker to execute arbitrary code via a crafted request
An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory.
-
Critical 9.8
tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign…
-
Critical 9.8
Pull malicious images may cause process to be hijacked
When malicious images are pulled by isula pull, attackers can execute arbitrary code.
-
Critical 9.8
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.…
-
Critical 9.8
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-…
-
Critical 10.0
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class …
KEV Nov 2, 2023 -
Critical 9.8
SQLi in TRtek Software's Education Portal
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TRtek Software Education Portal allows SQL Injection. This issue affects Education Portal: before 3.2023.29.
-
Critical 9.6
The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. Thi…
-
Critical 9.8
VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerabilit…
-
Critical 9.8
Improper Access Control in Sielco PolyEco1000
Sielco PolyEco1000 is vulnerable to an authentication bypass vulnerability due to an attacker modifying passwords in a POST request and gain unauthorized access to the affected device with administrative privileges.
-
Critical 9.8
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have …
KEV Oct 31, 2023 -
Critical 9.8
Improper Access Control in Sielco PolyEco1000
Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.
-
Critical 9.1
Improper Restriction of Excessive Authentication Attempts in Sielco PolyEco1000
Sielco PolyEco1000 uses a weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.
-
Critical 9.8
Online Art Gallery v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'lnm' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.
-
Critical 9.8
Sielco Radio Link and Analog FM Transmitters Improper Access Control
The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass authentication, and manipulate the transmitter.
-
Critical 9.0
Kibana Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the %meta patter…
-
Critical 9.0
ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a h…
-
Critical 9.8
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that…
KEV May 20, 2024 -
Critical 9.8
Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVI…
-
Critical 9.8
Gotham Orbital Simulator path traversal
Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files on the file system.
-
Critical 9.1
crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SH…
-
Critical 9.1
crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is beca…
-
Critical 9.1
XWiki Platform XSS with edit right in the create document form for existing pages
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. `org.xwiki.platform:xwiki-platform-web` starting in version 3.1-milestone-2 and prior to version 13.4-rc-1, as well as `org.xwiki.platform:xwiki-platform-…
-
Critical 9.7CVE-2023-45136 Scanner template
XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name strategy (disabled by default), XWiki starting in version 12.0-rc-1 and prior to versions 12.10.12 a…
-
Critical 9.1
XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In `org.xwiki.platform:xwiki-platform-web` versions 7.2-milestone-2 until 14.10.12 and `org.xwiki.platform:xwiki-platform-web-templates` prior to versions…