Archive
October 2023
Vulnerabilities first published in this month (UTC), newest first.
35 results · Clear filters · Feed
-
High 8.8CVE-2023-5412 Public exploit
Image horizontal reel scroll slideshow <= 13.2 - Authenticated (Subscriber+) SQL Injection via Shortcode
The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on …
-
High 8.8CVE-2023-46478 Public exploit
An issue in minCal v.1.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the customer_data…
-
High 7.8CVE-2023-40130 Public exploit
In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code. T…
-
High 7.2
An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by…
-
High 7.0CVE-2023-46813 Public exploit
An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO regi…
-
High 7.6
Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation
Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.
-
High 7.6CVE-2023-5043 Public exploit
Ingress nginx annotation injection causes arbitrary command execution
Ingress nginx annotation injection causes arbitrary command execution.
-
High 7.8CVE-2023-5717 Public exploit
Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component
A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's si…
-
High 7.8CVE-2023-38041 Public exploit
A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a …
-
High 8.0CVE-2023-46136 Public exploit
Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: a…
-
High 7.8CVE-2022-3699 Public exploit
A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo …
-
High 7.2
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject …
KEV Oct 23, 2023 -
High 7.1CVE-2023-46071 Public exploit
WordPress Protección de Datos RGPD Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ClickDatos Protección de Datos RGPD plugin <= 3.1.0 versions.
-
High 7.5CVE-2023-45966 Public exploit
umputun remark42 version 1.12.1 and before has a Blind Server-Side Request Forgery (SSRF) vulnerability.
-
High 8.6CVE-2023-41898 Public exploit
Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android
Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited nat…
-
High 8.8
LangChain Server Side Request Forgery vulnerability
LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.
-
High 7.5CVE-2023-45277 Public exploit
Yamcs Path Traversal vulnerability
Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2). The vulnerability is in the storage functionality of the API and allows one to escape the base directory of the buckets, freely navigate system directories, and read arbitrary files.
-
High 7.2CVE-2023-5538 Public exploit
MpOperationLogs <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting
The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated att…
-
High 8.8
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the h…
-
High 8.2CVE-2023-22098 Public exploit
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 7.8CVE-2023-20598 Public exploit
An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOC…
-
High 7.5CVE-2023-45131 Public exploit
Unauthenticated access to new private chat messages in Discourse
Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. Users are advised to upgrade…
-
High 7.2CVE-2023-4861 Public exploit
File Manager Pro < 1.8.1 - Admin+ Remote Code Execution
The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code executio…
-
High 7.5CVE-2023-39325 Public exploit
HTTP/2 rapid reset can cause excessive work in net/http
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…
-
High 7.3CVE-2023-5521 Public exploit
Incorrect Authorization in tiann/kernelsu
Incorrect Authorization in GitHub repository tiann/kernelsu prior to v0.6.9.
-
High 7.8CVE-2023-36723 Public exploit
Windows Container Manager Service Elevation of Privilege Vulnerability
Windows Container Manager Service Elevation of Privilege Vulnerability
-
High 7.8
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
-
High 7.5
HTTP/2 Stream Cancellation Attack
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
KEV Oct 10, 2023 -
High 8.6CVE-2023-45612 Public exploit
In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE
-
High 8.8CVE-2023-43284 Public exploit
D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices allow an authenticated remote attacker t…
-
High 7.8
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may…
KEV Oct 5, 2023 -
High 7.3CVE-2023-3971 Public exploit
Controller: html injection in custom login info
An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.
-
High 7.5
An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensit…
-
High 7.8
Glibc: buffer overflow in ld.so leading to privilege escalation
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binar…
KEV Nov 21, 2023 -
High 8.2CVE-2023-3350 Public exploit
Cryptographic Issues on IBERMATICA RPS
A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attacker could retrieve the SQL query sent to the application in plaint text. This log file contains the password hashes code…