Archive
1 November 2023
Vulnerabilities first published on this day (UTC), newest first.
30 results · Clear filters · Feed
-
High 8.6
SQUID-2023:4 Denial of Service in SSL Certificate validation
Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation…
-
High 7.0
Kernel: slab-use-after-free write in txend due to race condition
A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threads. This flaw allows a local attacker with normal user privileges to crash the system or leak internal kernel information.
-
High 8.6
A vulnerability in ICMPv6 inspection when configured with the Snort 2 detection engine for Cisco Firepower Threat Defen…
-
High 8.6
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepowe…
-
High 8.8
Use after free in Reading Mode in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user …
-
High 8.8
Use after free in Side Panel in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to…
-
High 8.8
Use after free in Profiles in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to e…
-
High 8.8
Use after free in Printing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to e…
-
High 8.8
Integer overflow in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit heap …
-
High 8.8
Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out o…
-
High 8.8
A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command inj…
-
High 8.2
Cisco Cisco Firepower Threat Defense Software and Cisco Firepower Management Center Code Injection Vulnerability
A vulnerability in the inter-device communication mechanisms between devices that are running Cisco Firepower Threat Defense (FTD) Software and devices that are running Cisco Firepower Management (FMC) Software could allow an authenticated, local attacker to …
-
High 7.2
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software coul…
-
High 7.2
Multiple vulnerabilities in the web management interface of Cisco Firepower Management Center (FMC) Software could allo…
-
High 8.8
A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to …
-
High 8.6
A vulnerability in the internal packet processing of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower …
-
High 7.5
A vulnerability in a logging API in Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, re…
-
High 8.6
A vulnerability in ICMPv6 processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Def…
-
High 8.8CVE-2023-5178 Public exploit
Kernel: use after free in nvmet_tcp_free_crypto in nvme
A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, whic…
-
High 7.8
Insights-client: unsafe handling of temporary files and directories
A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the s…
-
High 8.0
Directory Traversal Remote Code Execution Vulnerability
The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability This vulnerability allows a low level user to perform the actions with SYSTEM privileges.
-
High 8.0
Directory Traversal Remote Code Execution Vulnerability
The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM privileges.
-
High 8.8
Insecure Job Execution Mechanism Vulnerability
Insecure job execution mechanism vulnerability. This vulnerability can lead to other attacks as a result.
-
High 8.0
Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability
SolarWinds Platform Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability. If executed, this vulnerability would allow a low-privileged user to execute commands with SYSTEM privileges.
-
High 7.5
Incorrect Implementation of Authentication Algorithm Vulnerability
A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implementation of sensitive information protection, potentially allowing malicious users to gain unauthorize…
-
High 7.5CVE-2023-1719 Scanner template
Bitrix24 Insecure Global Variable Extraction
Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitra…
-
High 7.5
Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access
Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause denial-of-service via a crafted "tmp_url".
-
High 8.8
Bitrix24 Remote Command Execution (RCE) via Unsafe Variable Extraction
Unsafe variable extraction in bitrix/modules/main/classes/general/user_options.php in Bitrix24 22.0.300 allows remote authenticated attackers to execute arbitrary code via (1) appending arbitrary content to existing PHP files or (2) PHAR deserialization.
-
High 8.8
Bitrix24 Remote Command Execution (RCE) via Insecure Temporary File Creation
Insecure temporary file creation in bitrix/modules/crm/lib/order/import/instagram.php in Bitrix24 22.0.300 hosted on Apache HTTP Server allows remote authenticated attackers to execute arbitrary code via uploading a crafted ".htaccess" file.
-
High 7.5
Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE
Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.