Archive
28 November 2023
Vulnerabilities first published on this day (UTC), newest first.
72 results · Feed
-
Critical 9.8
Chamilo LMS Unauthenticated Command Injection
Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960.
-
High 8.5
Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without …
-
Medium 4.3
WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the su_meta shortcode due to missing validation on the user controlled keys 'key' and 'post_…
-
Medium 6.4
WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_meta shortcode combined with post meta data in all versions up to, and including, 5.13.3 due to insufficient input sanitizatio…
-
Medium 6.5
Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Servic…
-
Medium 5.8
OroCommerce get-totals-for-checkout API endpoint returns unwanted data
OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1.
-
Medium 5.0
OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility
OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue …
-
Medium 5.0
OroCRMCallBundle has incorrect call view page visibility
OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in v…
-
High 7.2
BookingPress <= 1.0.76 - Authenticated (Administrator+) Arbitrary File Upload
The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'bookingpress_process_upload' function in versions up to, and including, 1.0.76. This makes it possible for authenticated attackers with a…
-
Medium 5.5
An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.…
-
Medium 5.5
An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 …
-
Medium 5.5
An improper privilege management vulnerability in the ZySH of the Zyxel ATP series firmware versions 4.32 through 5.37,…
-
High 7.5
An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel…
-
Medium 4.4
A buffer overflow vulnerability in the Zyxel ATP series firmware version 5.37, USG FLEX series firmware version 5.37, U…
-
Medium 5.5
A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware v…
-
Medium 5.5
An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 …
-
Unscored —
A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows …
-
Medium 5.2
A cross-site scripting (XSS) vulnerability in the CGI program of the Zyxel ATP series firmware versions 5.10 through 5.…
-
Medium 5.5
An improper input validation vulnerability in the “Quagga” package of the Zyxel ATP series firmware versions 4.32 throu…
-
Medium 6.4
Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 …
-
Unscored —
Cross Site Scripting (XSS) in Search filters in Prestashop Amazzing filter version up to version 3.2.5, allows remote a…
-
Critical 9.8
Ray has arbitrary code execution via jobs submission API
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictl…
-
Unscored —
Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via b…
-
High 7.5
ureport arbitrary file read vulnerability
An arbitrary file read vulnerability in ureport v2.2.9 allows a remote attacker to arbitrarily read files on the server by inserting a crafted path.
-
Unscored —
An authentication bypass vulnerability in the Direct Connection Module in Ezviz CS-C6N-xxx prior to v5.3.x build 202304…
-
Critical 9.1
Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant beca…
-
Unscored —CVE-2023-46944 Public exploit
An issue in GitKraken GitLens before v.14.0.0 allows an attacker to execute arbitrary code via a crafted file to the Vi…
-
High 8.2CVE-2023-45539 Public exploit
HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive inf…
-
Critical 9.8
Netwrix Usercube before 6.0.215, in certain misconfigured on-premises installations, allows authentication bypass on de…
-
Unscored —
An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the lo…
-
Unscored —CVE-2023-49313 Public exploit
A dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity. By exploiting this, unau…
-
Unscored —CVE-2023-49314 Public exploit
Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection a…