Archive
October 2023
Vulnerabilities first published in this month (UTC), newest first.
124 results · Clear filters · Feed
-
Critical 10.0
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authori…
KEV Nov 7, 2023 -
Unscored —
Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload
The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.
-
High 8.8CVE-2023-5412 Public exploit
Image horizontal reel scroll slideshow <= 13.2 - Authenticated (Subscriber+) SQL Injection via Shortcode
The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on …
-
Unscored —CVE-2023-46451 Public exploit
Best Courier Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the change username field.
-
High 8.8CVE-2023-46478 Public exploit
An issue in minCal v.1.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the customer_data…
-
Unscored —
/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary P…
-
Unscored —CVE-2023-40133 Public exploit
In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused dep…
-
Unscored —CVE-2023-40127 Public exploit
In multiple locations, there is a possible way to access screenshots due to a confused deputy. This could lead to local…
-
High 7.8CVE-2023-40130 Public exploit
In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code. T…
-
Critical 10.0
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class …
KEV Nov 2, 2023 -
Unscored —CVE-2023-35794 Public exploit
An issue was discovered in Cassia Access Controller 2.1.1.2303271039. The Web SSH terminal endpoint (spawned console) c…
-
High 7.2
An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by…
-
High 7.0CVE-2023-46813 Public exploit
An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO regi…
-
Unscored —CVE-2023-45499 Public exploit
VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials.
-
Critical 9.8
VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerabilit…
-
Critical 9.8
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have …
KEV Oct 31, 2023 -
Medium 6.5
Elasticsearch StackOverflow vulnerability
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
-
Unscored —CVE-2023-46449 Public exploit
Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. An arbi…
-
Unscored —CVE-2023-46450 Public exploit
Sourcecodester Free and Open Source inventory management system 1.0 is vulnerable to Cross Site Scripting (XSS) via the…
-
Unscored —CVE-2023-43352 Public exploit
An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Conte…
-
Critical 9.8
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that…
KEV May 20, 2024 -
High 7.6
Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation
Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.
-
High 7.6CVE-2023-5043 Public exploit
Ingress nginx annotation injection causes arbitrary command execution
Ingress nginx annotation injection causes arbitrary command execution.
-
Unscored —CVE-2023-40404 Public exploit
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sonoma 14.1. An app …
-
Critical 9.1CVE-2023-37908 Public exploit
org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability
XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-si…
-
High 7.8CVE-2023-5717 Public exploit
Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component
A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's si…
-
High 7.8CVE-2023-38041 Public exploit
A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a …
-
High 8.0CVE-2023-46136 Public exploit
Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: a…
-
High 7.8CVE-2022-3699 Public exploit
A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo …
-
High 7.2
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject …
KEV Oct 23, 2023 -
High 7.1CVE-2023-46071 Public exploit
WordPress Protección de Datos RGPD Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ClickDatos Protección de Datos RGPD plugin <= 3.1.0 versions.
-
Unscored —CVE-2023-36085 Public exploit
The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIden…
-
Unscored —CVE-2023-46371 Public exploit
TP-Link device TL-WDR7660 2.0.30 and TL-WR886N 2.0.12 has a stack overflow vulnerability via the function upgradeInfoJs…
-
Medium 5.4CVE-2023-44769 Public exploit
Zenario CMS Cross-site Scripting vulnerability
A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare aliases from Alias.
-
Unscored —CVE-2023-44767 Public exploit
A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content.
-
Unscored —CVE-2023-43360 Public exploit
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a cr…
-
Unscored —
Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" a…
-
Unscored —CVE-2023-45802 Public exploit
Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping t…
-
Medium 4.3
Viessmann Vitogate 300 direct request
A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /cgi-bin/. The manipulation leads to direct request. The exploit has been disclosed to the public…
-
High 7.5CVE-2023-45966 Public exploit
umputun remark42 version 1.12.1 and before has a Blind Server-Side Request Forgery (SSRF) vulnerability.