Archive
19 December 2023
Vulnerabilities first published on this day (UTC), newest first.
31 results · Clear filters · Feed
-
High 8.2
Cross-Site Request Forgery in EFACEC BCU 500
A successful CSRF attack could force the user to perform state changing requests on the application. If the victim is an administrative account, a CSRF attack could compromise the entire web application.
-
High 8.1
Expired tokens can be renewed without validating the account password
### Impact In versions of the proxy from `2022-09-05` onwards (since 8c874c2ff3d503ac20c7d32f46e08547fcb9e23f), expired OAuth 2.0 client credentials grant (CCG) flow authorisation tokens could be renewed automatically without checking their validity against t…
-
High 7.5
Authorization Bypass Through User-Controlled Key in EuroTel ETL3100
EuroTel ETL3100 versions v01c01 and v01x37 are vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers can bypass authorizatio…
-
High 7.2CVE-2023-38126 EPSS 71%
Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability
Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. Authentication is required to explo…
-
High 7.6
WordPress WC Vendors Marketplace Plugin <= 2.4.7 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Vendors WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketplace, Product Vendors.This issue affects WC Vendors – WooCommerce Multi-Vendor, WooComme…
-
High 7.6
WordPress ChatBot Plugin <= 4.7.8 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuantumCloud AI ChatBot.This issue affects AI ChatBot: from n/a through 4.7.8.
-
High 7.6
WordPress WordPress Brute Force Protection – Stop Brute Force Attacks Plugin <= 2.2.5 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GuardGiant Brute Force Protection WordPress Brute Force Protection – Stop Brute Force Attacks.This issue affects WordPress Brute Force Protection – Stop Brut…
-
High 7.6
WordPress Advanced Database Cleaner Plugin <= 3.1.2 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Younes JFR. Advanced Database Cleaner.This issue affects Advanced Database Cleaner: from n/a through 3.1.2.
-
High 8.3
WordPress Recently Viewed Products Plugin <= 1.0.0 is vulnerable to PHP Object Injection
Deserialization of Untrusted Data vulnerability in Rajnish Arora Recently Viewed Products.This issue affects Recently Viewed Products: from n/a through 1.0.0.
-
High 8.3
WordPress Themesflat Addons For Elementor Plugin <= 2.0.0 is vulnerable to PHP Object Injection
Deserialization of Untrusted Data vulnerability in Themesflat Themesflat Addons For Elementor.This issue affects Themesflat Addons For Elementor: from n/a through 2.0.0.
-
High 7.2CVE-2023-46263 EPSS 82%
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that coul…
-
High 7.5
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could …
-
High 7.5CVE-2023-46262 EPSS 83%
An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) …
-
High 7.2CVE-2023-46264 EPSS 90%
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that coul…
-
High 7.3
An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resourc…
-
High 7.5
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could …
-
High 7.5
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could …
-
High 7.3CVE-2021-22962 EPSS 91%
An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resourc…
-
High 7.5
A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out…
-
High 8.1
When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could acce…
-
High 7.2
XML External Entity Reference on 52North WPS
An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP …
-
High 8.1
Session Hijacking on Imou Life app
A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an attacker to hijack user accounts due to the QR code functionality not properly filtering codes when scanning a new devi…
-
High 7.4CVE-2023-1514 Public exploit
A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the s…
-
High 7.8
Use-after-free in Linux kernel's ipv4: igmp component
A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another…
-
High 7.8CVE-2023-6931 Public exploit
Out-of-bounds write in Linux kernel's Performance Events system component
A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_…
-
High 8.8
TypedArrays can be fallible and lacked proper exception handling. This could lead to abuse in other APIs which expect T…
-
High 8.8
Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling. This vulnerabil…
-
High 7.7
Apache Superset: Privilege Escalation Vulnerability
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset:…
-
High 7.1
WordPress Simple Membership Plugin <= 4.3.8 is vulnerable to Unauth. Reflected Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smp7, wp.Insider Simple Membership allows Reflected XSS.This issue affects Simple Membership: from n/a through 4.3.8.
-
High 7.8
Out-of-bouds read vulnerability in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute a…
-
High 7.8
Stack-based buffer overflow in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbit…