Archive
14 November 2023
Vulnerabilities first published on this day (UTC), newest first.
118 results · Clear filters · Feed
-
High 8.8CVE-2023-35080 Public exploit
A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticat…
-
High 8.8
A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally a…
-
High 8.8
A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally a…
-
High 7.8
When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the af…
-
High 8.4
Improper Access Control in SMI handler vulnerability in Phoenix SecureCore™ Technology™ 4 allows SPI flash modification…
-
High 7.8
Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct …
-
High 7.8
Link following in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation o…
-
High 7.2
Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation o…
-
High 7.5
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via the PAPI protocol. S…
-
High 7.5
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protoco…
-
High 7.5
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol.…
-
High 7.5
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Succes…
-
High 7.5
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Succes…
-
High 8.2
There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba's access point management…
-
High 8.2
There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point …
-
High 8.2
There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba's access point management …
-
High 7.1
WordPress SendPress Newsletters Plugin <= 1.23.11.6 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <= 1.23.11.6 versions.
-
High 7.1
WordPress Restrict Categories Plugin <= 2.6.4 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Matthew Muro Restrict Categories plugin <= 2.6.4 versions.
-
High 7.1
WordPress Responsive Column Widgets Plugin <= 1.2.7 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Uno (miunosoft) Responsive Column Widgets plugin <= 1.2.7 versions.
-
High 8.8
Remote code execution via form uploads in statamic/cms
Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the …
-
High 7.1
WordPress Photo Feed Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Photo Feed plugin <= 2.2.1 versions.
-
High 8.2
ASP.NET Core Denial of Service Vulnerability
ASP.NET Core Denial of Service Vulnerability
-
High 7.5
Improper input validation in BIOS TCG2
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.
-
High 7.5
Improper input validation in BIOS OFBD
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.
-
High 7.5
Improper input validation in BIOS
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.
-
High 7.2
vantage6 Node accepts non-whitelisted algorithms from malicious server
vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). In affected versions a node does not check if an image is allowed to run if a `parent_id` is set. A malicious party tha…
-
High 7.1
WordPress Atarim Plugin <= 3.12 is vulnerable to Cross Site Scripting (XSS)
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Atarim Visual Website Collaboration, Feedback & Project Management – Atarim plugin <= 3.12 versions.
-
High 7.1
Attacker can cause Kyverno user to unintentionally consume insecure image
Kyverno is a policy engine designed for Kubernetes. An issue was found in Kyverno that allowed an attacker to control the digest of images used by Kyverno users. The issue would require the attacker to compromise the registry that the Kyverno users fetch thei…
-
High 7.1
WordPress Products, Order & Customers Export for WooCommerce Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFactory Products, Order & Customers Export for WooCommerce plugin <= 2.0.7 versions.
-
High 7.2
Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plug…
-
High 8.1
Unsafe deserialization of user data in yiisoft/yii
Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host syste…
-
High 7.1
Crosslinking transaction attack in hyperledger/fabric
Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called "cross-linking" results in a molecule with a chemical formula that is composed of all atoms of the original two molecules. In Fabric…
-
High 7.6
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
-
High 7.6
Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability
Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability
-
High 8.8
Azure DevOps Server Remote Code Execution Vulnerability
Azure DevOps Server Remote Code Execution Vulnerability
-
High 7.1
WordPress Donations Made Easy – Smart Donations Plugin <= 4.0.12 is vulnerable to Cross Site Scripting (XSS)
Cross-Site Request Forgery (CSRF) vulnerability in RedNao Donations Made Easy – Smart Donations allows Stored XSS.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12.
-
High 8.7
TIBCO EBX Cross-site Scripting (XXS) Vulnerability
The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a stored XSS on the a…
-
High 7.9
Buffer overflow in some Intel(R) QAT drivers for Windows - HW Version 1.0 before version 1.10 may allow an authenticate…
-
High 7.5
Improper buffer restrictions in some Intel(R) Server Board M10JNP2SB BIOS firmware before version 7.219 may allow a pri…
-
High 7.5
Improper input validation in some Intel(R) Server System M70KLP Family BIOS firmware before version 01.04.0029 may allo…