Archive
November 2023
Vulnerabilities first published in this month (UTC), newest first.
94 results · Clear filters · Feed
-
High 8.6
The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in t…
-
Medium 5.3
WordPress EWWW Image Optimizer Plugin <= 7.2.0 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exactly WWW EWWW Image Optimizer. It works only when debug.log is turned on.This issue affects EWWW Image Optimizer: from n/a through 7.2.0.
-
Medium 5.3CVE-2023-6401 Public exploit
NotePad++ dbghelp.exe uncontrolled search path
A vulnerability classified as problematic was found in NotePad++ up to 8.1. Affected by this vulnerability is an unknown functionality of the file dbghelp.exe. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The ide…
-
Medium 4.7CVE-2023-5966 Public exploit
Unrestricted Upload of File with Dangerous Type in EspoCRM
An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which could lead to arbitrary PHP code execution.
-
Medium 4.7CVE-2023-5965 Public exploit
Unrestricted Upload of File with Dangerous Type in EspoCRM
An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution.
-
Unscored —
Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arb…
-
High 8.8CVE-2023-49052 Public exploit
Microweber file upload vulnerability
File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component.
-
Unscored —CVE-2023-40626 Public exploit
[20231101] - Core - Exposure of environment variables
The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.
-
Unscored —CVE-2023-6350 Public exploit
Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit hea…
-
High 8.8
Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePos…
-
High 8.8CVE-2023-4226 Public exploit
Chamilo LMS File Upload Functionality Remote Code Execution
Unrestricted file upload in `/main/inc/ajax/work.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.
-
High 8.1
Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via…
-
Critical 9.8
Ray has arbitrary code execution via jobs submission API
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictl…
-
Unscored —CVE-2023-46944 Public exploit
An issue in GitKraken GitLens before v.14.0.0 allows an attacker to execute arbitrary code via a crafted file to the Vi…
-
High 8.2CVE-2023-45539 Public exploit
HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive inf…
-
Unscored —CVE-2023-49313 Public exploit
A dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity. By exploiting this, unau…
-
Unscored —CVE-2023-49314 Public exploit
Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection a…
-
Critical 9.8
Control iD iDSecure passwordCustom Authentication Bypass
An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a "passwordCustom" option that allows an unauthenticated attacker to compute valid credentials that can be used to bypass authentic…
-
High 8.8CVE-2023-35985 Public exploit
An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due…
-
High 7.3CVE-2023-4590 Public exploit
Buffer Overflow vulnerability in Frhed
Buffer overflow vulnerability in Frhed hex editor, affecting version 1.6.0. This vulnerability could allow an attacker to execute arbitrary code via a long filename argument through the Structured Exception Handler (SEH) registers.
-
Unscored —CVE-2023-48034 Public exploit
An issue discovered in Acer Wireless Keyboard SK-9662 allows attacker in physical proximity to both decrypt wireless ke…
-
Unscored —CVE-2023-47437 Public exploit
A vulnerability has been identified in Pachno 1.0.6 allowing an authenticated attacker to execute a cross-site scriptin…
-
Low 3.5
TOTVS Fluig Platform mobileredir openApp.jsp cross site scripting
A vulnerability was found in TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /mobileredir/openApp.jsp of the component mobileredir. The manipulation of the argume…
-
Medium 5.3CVE-2023-47529 Public exploit
WordPress Cloud Templates & Patterns collection Plugin <= 1.2.2 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeIsle Cloud Templates & Patterns collection.This issue affects Cloud Templates & Patterns collection: from n/a through 1.2.2.
-
Medium 5.3CVE-2023-47668 Public exploit
WordPress Restrict Content Plugin <= 3.2.7 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.
-
Critical 9.8
UserPro <= 5.1.1 - Authentication Bypass to Administrator
The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthe…
-
Unscored —CVE-2023-47250 Public exploit
In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows…
-
Unscored —CVE-2023-47014 Public exploit
A Cross-Site Request Forgery (CSRF) vulnerability in Sourcecodester Sticky Notes App Using PHP with Source Code v.1.0 a…
-
Critical 10.0
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relie…
KEV Nov 30, 2023 -
Critical 9.8
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file wi…
KEV Aug 27, 2026 -
Medium 6.5CVE-2023-6199 Public exploit
Book Stack v23.10.2 - LFR via Blind SSRF
Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF.
-
Critical 9.7
XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks
The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacke…
-
Medium 5.9CVE-2023-48223 Public exploit
fast-jwt JWT Algorithm Confusion
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match …
-
Unscored —
CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attribute…
-
High 7.5
Ray Static File Local File Include
LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.
-
High 8.0
Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code exec…
-
Critical 9.8
Ray Command Injection in cpu_profile Parameter
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here…
-
Unscored —CVE-2023-43757 Public exploit
Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION al…
-
High 8.8CVE-2023-35080 Public exploit
A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticat…
-
Medium 4.7CVE-2023-47125 Public exploit
By-passing Cross-Site Scripting Protection in HTML Sanitizer
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vuln…