35,538 results · Clear filters · Feed
-
High 7.5
HTTP/2 Stream Cancellation Attack
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
KEV Oct 10, 2023 -
Medium 5.4CVE-2023-44763 Public exploit
ConcreteCMS vulnerable to Stored Cross-site Scripting
Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed f…
-
High 8.6CVE-2023-45612 Public exploit
In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE
-
Unscored —CVE-2023-44811 Public exploit
Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a …
-
Unscored —
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a …
-
Unscored —CVE-2023-45239 Public exploit
A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled…
-
Unscored —CVE-2023-36123 Public exploit
Directory Traversal vulnerability in Hex-Dragon Plain Craft Launcher 2 version Alpha 1.3.9, allows local attackers to e…
-
Unscored —CVE-2023-44061 Public exploit
File Upload vulnerability in Simple and Nice Shopping Cart Script v.1.0 allows a remote attacker to execute arbitrary c…
-
Medium 5.4CVE-2023-44764 Public exploit
ConcreteCMS Cross-site Scripting vulnerability
A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings).
-
Medium 5.4CVE-2023-44762 Public exploit
ConcreteCMS Cross-site Scripting vulnerability
A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags.
-
Medium 5.4CVE-2023-44770 Public exploit
Zenario CMS Cross-site Scripting vulnerability
A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias.
-
Medium 5.4CVE-2023-44761 Public exploit
ConcreteCMS Cross-site Scripting vulnerability
Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects.
-
Medium 5.4CVE-2023-44765 Public exploit
ConcreteCMS Cross-site Scripting vulnerability
A Cross Site Scripting (XSS) vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings.
-
Medium 5.4CVE-2023-44771 Public exploit
Zenario CMS Cross-site Scripting vulnerability
A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout.
-
Medium 5.4CVE-2023-44766 Public exploit
ConcreteCMS Cross-site Scripting vulnerability
A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made …
-
Unscored —CVE-2023-44758 Public exploit
GDidees CMS 3.0 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary co…
-
Medium 5.4CVE-2023-43343 Public exploit
Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary c…
-
High 8.8CVE-2023-43284 Public exploit
D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices allow an authenticated remote attacker t…
-
High 7.8
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may…
KEV Oct 5, 2023 -
Medium 5.9CVE-2023-43804 Public exploit
`Cookie` HTTP header isn't stripped on cross-origin redirects
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `C…
-
High 7.3CVE-2023-3971 Public exploit
Controller: html injection in custom login info
An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.
-
Critical 10.0
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploite…
KEV Oct 5, 2023 -
Unscored —CVE-2023-35803 Public exploit
IQ Engine before 10.6r2 on Extreme Network AP devices has a Buffer Overflow.
-
Unscored —CVE-2023-43838 Public exploit
An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code…
-
Unscored —CVE-2023-43877 Public exploit
Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via…
-
High 7.5
An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensit…
-
High 7.8
Glibc: buffer overflow in ld.so leading to privilege escalation
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binar…
KEV Nov 21, 2023 -
High 8.2CVE-2023-3350 Public exploit
Cryptographic Issues on IBERMATICA RPS
A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attacker could retrieve the SQL query sent to the application in plaint text. This log file contains the password hashes code…
-
Medium 6.4CVE-2023-5350 Public exploit
SQL Injection in salesagility/suitecrm
SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1.
-
Medium 4.3CVE-2023-5324 Public exploit
eeroOS Ethernet Interface denial of service
A vulnerability has been found in eeroOS up to 6.16.4-11 and classified as critical. This vulnerability affects unknown code of the component Ethernet Interface. The manipulation leads to denial of service. The attack needs to be approached within the local n…
-
Critical 10.0
TorchServe Server-Side Request Forgery
TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken ad…
-
High 8.8
Electron affected by libvpx's heap buffer overflow in vp8 encoding
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
KEV Oct 2, 2023 -
Medium 6.5CVE-2023-38873 Public exploit
Economizzer vulnerable to Clickjacking
The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or…
-
Unscored —CVE-2023-42222 Public exploit
WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal func…
-
Unscored —CVE-2023-43872 Public exploit
A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Si…
-
Medium 4.8CVE-2023-43879 Public exploit
Rite CMS 3.0 has a Cross-Site scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a craft…
-
Unscored —CVE-2023-43876 Public exploit
A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary …
-
Unscored —CVE-2023-43873 Public exploit
A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a …
-
Unscored —CVE-2023-43878 Public exploit
Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via…