Archive
14 November 2023
Vulnerabilities first published on this day (UTC), newest first.
339 results · Feed
-
Medium 5.0
Generic Extractor MITM Vulnerability in yt-dlp
yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP sessio…
-
High 8.8CVE-2023-35080 Public exploit
A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticat…
-
Unscored —
A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticate…
-
Unscored —
A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolle…
-
Medium 5.3
A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings.…
-
High 8.8
A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally a…
-
High 8.8
A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally a…
-
High 7.8
When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the af…
-
High 8.4
Improper Access Control in SMI handler vulnerability in Phoenix SecureCore™ Technology™ 4 allows SPI flash modification…
-
High 7.8
Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct …
-
High 7.8
Link following in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation o…
-
Medium 5.5
Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via netw…
-
Low 3.5
Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information dis…
-
Medium 4.9
Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information d…
-
Low 3.7
Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network acces…
-
Medium 4.3
An authenticated Denial-of-Service (DoS) vulnerability exists in the CLI service. Successful exploitation of this vulne…
-
Medium 5.5
An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged pers…
-
High 7.2
Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation o…
-
High 7.5
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via the PAPI protocol. S…
-
Medium 6.3
Hub: insecure galaxy-importer tarfile extraction
A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritt…
-
High 7.5
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protoco…
-
High 7.5
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol.…
-
High 7.5
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Succes…
-
High 7.5
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Succes…
-
High 8.2
There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba's access point management…
-
High 8.2
There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point …
-
High 8.2
There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba's access point management …
-
Critical 9.8
There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated re…
-
Critical 9.8
There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code …
-
Critical 9.8
There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code …
-
Medium 4.3
Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of ser…
-
Medium 4.3
Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network acces…
-
Medium 4.3
Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow a…
-
Low 3.1
Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a den…
-
High 7.1
WordPress SendPress Newsletters Plugin <= 1.23.11.6 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <= 1.23.11.6 versions.
-
High 7.1
WordPress Restrict Categories Plugin <= 2.6.4 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Matthew Muro Restrict Categories plugin <= 2.6.4 versions.
-
High 7.1
WordPress Responsive Column Widgets Plugin <= 1.2.7 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Uno (miunosoft) Responsive Column Widgets plugin <= 1.2.7 versions.
-
High 8.8
Remote code execution via form uploads in statamic/cms
Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the …
-
High 7.1
WordPress Photo Feed Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Photo Feed plugin <= 2.2.1 versions.
-
High 8.2
ASP.NET Core Denial of Service Vulnerability
ASP.NET Core Denial of Service Vulnerability