Archive
October 2023
Vulnerabilities first published in this month (UTC), newest first.
778 results · Clear filters · Feed
-
High 7.5
generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character
JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing…
-
High 7.9
The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plain…
-
High 7.5
TOTOLINK A3300R V17.0.0cu.557_B20221024 is vulnerable to Incorrect Access Control. Attackers are able to reset serveral…
-
High 7.5
TOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control.Attackers can reset login password & W…
-
High 7.5
xkeys Seal encryption used fixed key for all encryption
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authe…
-
High 7.5
Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py`
Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate. This can lead to unauthenticated remote code execution. This can…
-
High 7.5
Frigate cross-site request forgery in `config_save` and `config_set` request handlers
Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the `config/save` and `config/set` endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the config…
-
High 7.5
CloudExplorer Lite permission bypass vulnerability
CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller with path starting with `matching/API/`, which can cause a permission bypass. Version 1.4.1 contain…
-
High 7.3
In Print Service, there is a possible background activity launch due to a logic error in the code. This could lead to l…
-
High 7.8
In Sim, there is a possible way to evade mobile preference restrictions due to a permission bypass. This could lead to …
-
High 7.8
In UWB Google, there is a possible way for a malicious app to masquerade as system app com.android.uwb.resources due to…
-
High 7.7
In multiple locations, there is a possible background activity launch due to a logic error in the code. This could lead…
-
High 7.8
In Permission Manager, there is a possible way to bypass required permissions due to a missing permission check. This c…
-
High 7.8
In RemoteSpeechRecognitionService of RemoteSpeechRecognitionService.java, there is a possible way to launch an activity…
-
High 7.8
In InputMethod, there is a possible way to determine whether an app is installed, without query permissions, due to sid…
-
High 7.5
In Minikin, there is a possible way to trigger ANR by showing a malicious message due to resource exhaustion. This coul…
-
High 7.8
In Package Installer, there is a possible way to determine whether an app is installed, without query permissions, due …
-
High 7.8
In Slice, there is a possible disclosure of installed applications due to side channel information disclosure. This cou…
-
High 7.8
In verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contact…
-
High 8.2
Potential open redirect vulnerability in opentext SMAX and AMX product.
Potential open redirect vulnerability in opentext Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11 and opentext Asset Management X (AMX) versions 2021.08, 2021.11, 2022.05, 2022.11…
-
High 8.8
Grid Plus <= 1.3.3 - Authenticated (Subscriber+) Local File Inclusion via Shortcode
The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.3 via a shortcode attribute. This allows subscriber-level, and above, attackers to include and execute arbitrary files on the server, allowing the e…
-
High 8.8
Google Maps made Simple <= 0.6 - Authenticated (Subscriber+) SQL Injection via Shortcode
The Google Maps made Simple plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL…
-
High 8.8
WP Simple Galleries <= 1.34 - Authenticated (Contributor+) PHP Object Injection
The WP Simple Galleries plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.34 via deserialization of untrusted input from the 'wpsimplegallery_gallery' post meta via 'wpsgallery' shortcode. This allows authenticated…
-
High 8.1
Improper Access Control in mintplex-labs/anything-llm
Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.
-
High 7.2
MLSoft TCO!stream Remote Code Execution Vulnerability
In MLSoft TCO!stream versions 8.0.22.1115 and below, a vulnerability exists due to insufficient permission validation. This allows an attacker to make the victim download and execute arbitrary files.
-
High 8.4
Yettiesoft VestCert Remote Code Execution Vulnerability
In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution.
-
High 7.5
tinyfiledialogs (aka tiny file dialogs) before 3.8.0 allows shell metacharacters in titles, messages, and other input d…
-
High 8.8CVE-2023-46478 Public exploit
An issue in minCal v.1.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the customer_data…
-
High 7.5
An issue discovered in Govee LED Strip v3.00.42 allows attackers to cause a denial of service via crafted Move and Move…
-
High 8.8
Cross Site Request Forgery (CSRF) vulnerability in DouHaocms v.3.3 allows a remote attacker to execute arbitrary code v…
-
High —
NATS.io: Adding accounts for just the system account adds auth bypass
NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an acc…
-
High 7.8
The installer (aka openvpn-client-installer) in Securepoint SSL VPN Client before 2.0.40 allows local privilege escalat…
-
High 8.4
Run copy with container in a malicious directory may cause container escaping
When the isula cp command is used to copy files from a container to a host machine and the container is controlled by an attacker, the attacker can escape the container.
-
High 8.4
Export container in a malicious directory may cause process to be hijacked
When the isula export command is used to export a container to an image and the container is controlled by an attacker, the attacker can escape the container.
-
High 8.4
Load malicious images may cause process to be hijacked
When the isula load command is used to load malicious images, attackers can execute arbitrary code.
-
High 7.4
IBM i privilege escalation
Management Central as part of IBM i 7.2, 7.3, 7.4, and 7.5 Navigator contains a local privilege escalation vulnerability. A malicious actor with command line access to the operating system can exploit this vulnerability to elevate privileges to gain root acce…
-
High 8.8
Privilege Chaining in hestiacp/hestiacp
Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.
-
High 8.8
Post Meta Data Manager <=1.2.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_change_user_meta and pmdm_wp_change_post_meta functions in versions up to, and including, 1.2.0. This makes it …
-
High 7.5
Post Meta Data Manager <=1.2.0 - Missing Authorization to User, Term, and Post Meta Deletion
The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_delete_user_meta, pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta functions in versions up to, and inclu…
-
High 7.5
Apache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend
Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about th…