Weekly Vulnerabilities Reports > November 20 to 26, 2023

Overview

371 new vulnerabilities reported during this period, including 48 critical vulnerabilities and 136 high severity vulnerabilities. This weekly summary report vulnerabilities in 362 products from 223 vendors including Artica, Mozilla, Userproplugin, Funnelforms, and Autodesk. Vulnerabilities are notably categorized as "Cross-site Scripting", "Cross-Site Request Forgery (CSRF)", "Out-of-bounds Write", "SQL Injection", and "Path Traversal".

  • 321 reported vulnerabilities are remotely exploitables.
  • 137 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
  • 200 reported vulnerabilities are exploitable by an anonymous user.
  • Artica has the most reported vulnerabilities, with 14 reported vulnerabilities.
  • Autodesk has the most reported critical vulnerabilities, with 4 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

48 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2023-11-24 CVE-2023-48312 Clastix Improper Authentication vulnerability in Clastix Capsule-Proxy

capsule-proxy is a reverse proxy for the capsule operator project.

9.8
2023-11-24 CVE-2023-46575 Layer5 SQL Injection vulnerability in Layer5 Meshery

A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the “order” parameter

9.8
2023-11-24 CVE-2023-6274 Byzoro Unrestricted Upload of File with Dangerous Type vulnerability in Byzoro Smart S80 Firmware 20231108

A vulnerability was found in Byzoro Smart S80 up to 20231108.

9.8
2023-11-23 CVE-2023-49214 Usedesk Injection vulnerability in Usedesk

Usedesk before 1.7.57 allows chat template injection.

9.8
2023-11-23 CVE-2023-49210 Node Openssl Project Command Injection vulnerability in Node-Openssl Project Node-Openssl 1.0.2

The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argument that contains a verb field (used for command execution).

9.8
2023-11-23 CVE-2023-49208 Glewlwyd SSO Server Project Classic Buffer Overflow vulnerability in Glewlwyd SSO Server Project Glewlwyd SSO Server

scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registration.

9.8
2023-11-23 CVE-2023-41790 Artica Uncontrolled Search Path Element vulnerability in Artica Pandora FMS

Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths.

9.8
2023-11-23 CVE-2023-4677 Artica Information Exposure Through Log Files vulnerability in Artica Pandora FMS

Cron log backup files contain administrator session IDs.

9.8
2023-11-23 CVE-2023-3631 Medart Notification Panel Project SQL Injection vulnerability in Medart Notification Panel Project Medart Notification Panel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Medart Health Services Medart Notification Panel allows SQL Injection.This issue affects Medart Notification Panel: through 20231123.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

9.8
2023-11-23 CVE-2023-28812 Hikvision Classic Buffer Overflow vulnerability in Hikvision Localservicecomponents 1.0.0.78

There is a buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted messages to computers installed with this plug-in, which could lead to arbitrary code execution or cause process exception of the plug-in.

9.8
2023-11-23 CVE-2023-3377 Veribase SQL Injection vulnerability in Veribase

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veribilim Software Computer Veribase allows SQL Injection.This issue affects Veribase: through 20231123.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

9.8
2023-11-23 CVE-2023-29074 Autodesk Out-of-bounds Write vulnerability in Autodesk products

A maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write.

9.8
2023-11-23 CVE-2023-29075 Autodesk Out-of-bounds Write vulnerability in Autodesk products

A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write.

9.8
2023-11-23 CVE-2023-29076 Autodesk Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Autodesk products

A maliciously crafted MODEL, SLDASM, SAT or CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 could cause memory corruption vulnerability.

9.8
2023-11-23 CVE-2023-29073 Autodesk Out-of-bounds Write vulnerability in Autodesk products

A maliciously crafted MODEL file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow.

9.8
2023-11-22 CVE-2023-46357 Myprestamodules SQL Injection vulnerability in Myprestamodules Cross Selling in Modal Cart

In the module "Cross Selling in Modal Cart" (motivationsale) < 3.5.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection.

9.8
2023-11-22 CVE-2023-45377 Chronopost SQL Injection vulnerability in Chronopost

In the module "Chronopost Official" (chronopost) for PrestaShop, a guest can perform SQL injection.

9.8
2023-11-22 CVE-2023-2449 Userproplugin Unspecified vulnerability in Userproplugin Userpro

The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1.

9.8
2023-11-22 CVE-2023-5815 Infornweb Unspecified vulnerability in Infornweb News & Blog Designer Pack

The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for WordPress is vulnerable to Remote Code Execution via Local File Inclusion in all versions up to, and including, 3.4.1 via the bdp_get_more_post function hooked via a nopriv AJAX.

9.8
2023-11-22 CVE-2023-5822 Codedropz Unrestricted Upload of File with Dangerous Type vulnerability in Codedropz Drag and Drop multiple File Upload - Contact Form 7

The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3.

9.8
2023-11-22 CVE-2023-2889 Veom SQL Injection vulnerability in Veom Service Tracking 20231122

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veon Computer Service Tracking Software allows SQL Injection.This issue affects Service Tracking Software: before crm 2.0.

9.8
2023-11-22 CVE-2023-5047 DRD SQL Injection vulnerability in DRD Drdrive

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DRD Fleet Leasing DRDrive allows SQL Injection.This issue affects DRDrive: before 20231006.

9.8
2023-11-22 CVE-2023-37924 Apache SQL Injection vulnerability in Apache Submarine 0.7.0

Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in.

9.8
2023-11-21 CVE-2023-48306 Nextcloud Server-Side Request Forgery (SSRF) vulnerability in Nextcloud Server

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.

9.8
2023-11-21 CVE-2023-48307 Nextcloud Server-Side Request Forgery (SSRF) vulnerability in Nextcloud Mail

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform.

9.8
2023-11-21 CVE-2023-48699 Ubertidavide Code Injection vulnerability in Ubertidavide Fastbots

fastbots is a library for fast bot and scraper development using selenium and the Page Object Model (POM) design.

9.8
2023-11-21 CVE-2023-49105 Owncloud Improper Authentication vulnerability in Owncloud

An issue was discovered in ownCloud owncloud/core before 10.13.1.

9.8
2023-11-21 CVE-2023-6248 Digitalcomtech Unspecified vulnerability in Digitalcomtech Syrus 4G IOT Telematics Gateway Firmware Apex23.43.2

The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code on any Syrus4 device connected to the cloud service.

9.8
2023-11-21 CVE-2023-48228 Goauthentik Unspecified vulnerability in Goauthentik Authentik

authentik is an open-source identity provider.

9.8
2023-11-21 CVE-2023-48230 Capnproto Out-of-bounds Write vulnerability in Capnproto 1.0.0/1.0.1

Cap'n Proto is a data interchange format and capability-based RPC system.

9.8
2023-11-21 CVE-2023-5055 Zephyrproject Out-of-bounds Write vulnerability in Zephyrproject Zephyr

Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.

9.8
2023-11-21 CVE-2023-49060 Mozilla Unspecified vulnerability in Mozilla Firefox

An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referrerpolicy` attribute.

9.8
2023-11-21 CVE-2023-4149 Wago OS Command Injection vulnerability in Wago products

A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control.

9.8
2023-11-21 CVE-2023-42770 Redlioncontrols Missing Authentication for Critical Function vulnerability in Redlioncontrols products

Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP.

9.8
2023-11-21 CVE-2023-40151 Redlioncontrols Unspecified vulnerability in Redlioncontrols products

When user authentication is not enabled the shell can execute commands with the highest privileges.

9.8
2023-11-20 CVE-2023-48176 Mizhexiaoxiao Unspecified vulnerability in Mizhexiaoxiao Websiteguide 0.2

An Insecure Permissions issue in WebsiteGuide v.0.2 allows a remote attacker to gain escalated privileges via crafted jwt (JSON web token).

9.8
2023-11-20 CVE-2023-38823 Tenda Classic Buffer Overflow vulnerability in Tenda products

Buffer Overflow vulnerability in Tenda Ac19 v.1.0, AC18, AC9 v.1.0, AC6 v.2.0 and v.1.0 allows a remote attacker to execute arbitrary code via the formSetCfm function in bin/httpd.

9.8
2023-11-20 CVE-2023-46990 Publiccms Deserialization of Untrusted Data vulnerability in Publiccms 4.0.202302.E

Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function.

9.8
2023-11-20 CVE-2023-38880 Os4Ed Unspecified vulnerability in Os4Ed Opensis 9.0

The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality.

9.8
2023-11-20 CVE-2023-5340 Fivestarplugins Injection vulnerability in Fivestarplugins Five Star Restaurant Menu

The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX action available to unauthenticated users, allowing them to perform PHP Object Injection when a suitable gadget is present on the blog.

9.8
2023-11-20 CVE-2023-5640 Dguzun SQL Injection vulnerability in Dguzun Article Analytics

The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection vulnerability.

9.8
2023-11-20 CVE-2023-5652 Thimpress SQL Injection vulnerability in Thimpress WP Hotel Booking

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admin_init, allowing unauthenticated users to perform SQL injections

9.8
2023-11-20 CVE-2023-29155 Inea Improper Authentication vulnerability in Inea ME RTU Firmware 3.36

Versions of INEA ME RTU firmware 3.36b and prior do not require authentication to the "root" account on the host system of the device.

9.8
2023-11-20 CVE-2023-35762 Inea OS Command Injection vulnerability in Inea ME RTU Firmware 3.36

Versions of INEA ME RTU firmware 3.36b and prior are vulnerable to operating system (OS) command injection, which could allow remote code execution.

9.8
2023-11-20 CVE-2022-46337 Apache Injection vulnerability in Apache Derby

A cleverly devised username might bypass LDAP authentication checks.

9.8
2023-11-20 CVE-2023-46302 Apache Deserialization of Untrusted Data vulnerability in Apache Submarine 0.7.0

Apache Software Foundation Apache Submarine has a bug when serializing against yaml.

9.8
2023-11-20 CVE-2023-46700 Luxsoft SQL Injection vulnerability in Luxsoft Luxcal web Calendar

SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request, and obtain or alter information stored in the database.

9.8
2023-11-26 CVE-2023-49312 Precisionbridge Improper Certificate Validation vulnerability in Precisionbridge Precision Bridge

Precision Bridge PrecisionBridge.exe (aka the thick client) before 7.3.21 allows an integrity violation in which the same license key is used on multiple systems, via vectors involving a Process Hacker memory dump, error message inspection, and modification of a MAC address.

9.1

136 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2023-11-24 CVE-2023-48712 Warpgate Project Incorrect Authorization vulnerability in Warpgate Project Warpgate

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux.

8.8
2023-11-23 CVE-2023-49213 Ironmansoftware Command Injection vulnerability in Ironmansoftware Powershell Universal

The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP requests if a param block is used, due to invalid sanitization of input strings.

8.8
2023-11-23 CVE-2023-41788 Artica Unrestricted Upload of File with Dangerous Type vulnerability in Artica Pandora FMS

Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs.

8.8
2023-11-23 CVE-2023-41807 Artica Unspecified vulnerability in Artica Pandora FMS

Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation.

8.8
2023-11-23 CVE-2023-41812 Artica Unrestricted Upload of File with Dangerous Type vulnerability in Artica Pandora FMS

Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs.

8.8
2023-11-22 CVE-2023-48107 Zlib NG Out-of-bounds Write vulnerability in Zlib-Ng Minizip-Ng 4.0.2

Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_has_slash function in the mz_os.c file.

8.8
2023-11-22 CVE-2023-49102 Nzbget Unspecified vulnerability in Nzbget 21.1

NZBGet 21.1 allows authenticated remote code execution because the unarchive programs (7za and unrar) preserve executable file permissions.

8.8
2023-11-22 CVE-2023-47824 Wpwax Cross-Site Request Forgery (CSRF) vulnerability in Wpwax Legal Pages

Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <= 1.3.8 versions.

8.8
2023-11-22 CVE-2023-47825 Wpvnteam Cross-Site Request Forgery (CSRF) vulnerability in Wpvnteam WP Extra

Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra plugin <= 6.4 versions.

8.8
2023-11-22 CVE-2023-39925 Peepso Cross-Site Request Forgery (CSRF) vulnerability in Peepso

Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Download Community by PeepSo plugin <= 6.1.6.0 versions.

8.8
2023-11-22 CVE-2023-47775 Gvectors Cross-Site Request Forgery (CSRF) vulnerability in Gvectors Wpdiscuz

Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team Comments — wpDiscuz plugin <= 7.6.11 versions.

8.8
2023-11-22 CVE-2023-47781 Thrivethemes Cross-Site Request Forgery (CSRF) vulnerability in Thrivethemes Thrive Themes Builder 3.24.2

Cross-Site Request Forgery (CSRF) vulnerability in Thrive Themes Thrive Theme Builder < 3.24.2 versions.

8.8
2023-11-22 CVE-2023-47785 Kreaturamedia Cross-Site Request Forgery (CSRF) vulnerability in Kreaturamedia Layerslider 7.7.9

Cross-Site Request Forgery (CSRF) vulnerability in LayerSlider plugin <= 7.7.9 versions.

8.8
2023-11-22 CVE-2023-47791 Leadster Cross-Site Request Forgery (CSRF) vulnerability in Leadster

Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <= 1.1.2 versions.

8.8
2023-11-22 CVE-2023-47792 Infiniteuploads Cross-Site Request Forgery (CSRF) vulnerability in Infiniteuploads BIG File Uploads

Cross-Site Request Forgery (CSRF) vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin <= 2.1.1 versions.

8.8
2023-11-22 CVE-2023-47819 Dangngocbinh Cross-Site Request Forgery (CSRF) vulnerability in Dangngocbinh Easy Call NOW BY Thikshare 1.0/1.1.0

Cross-Site Request Forgery (CSRF) vulnerability in Dang Ngoc Binh Easy Call Now by ThikShare plugin <= 1.1.0 versions.

8.8
2023-11-22 CVE-2023-25986 Paygreen Cross-Site Request Forgery (CSRF) vulnerability in Paygreen - Ancienne

Cross-Site Request Forgery (CSRF) vulnerability in WattIsIt PayGreen – Ancienne version plugin <= 4.10.2 versions.

8.8
2023-11-22 CVE-2023-25987 Urosevic Cross-Site Request Forgery (CSRF) vulnerability in Urosevic MY Youtube Channel

Cross-Site Request Forgery (CSRF) vulnerability in Aleksandar Uroševic My YouTube Channel plugin <= 3.23.3 versions.

8.8
2023-11-22 CVE-2023-47250 M Privacy Incorrect Default Permissions vulnerability in M-Privacy Mprivacy-Tools, Rsbac-Policy-Tgpro and Tightgatevnc

In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attackers (with access to a VNC session) to access the X11 desktops of other users by specifying their DISPLAY ID.

8.8
2023-11-22 CVE-2023-47758 Mondula Cross-Site Request Forgery (CSRF) vulnerability in Mondula Multi Step Form

Cross-Site Request Forgery (CSRF) vulnerability in Mondula GmbH Multi Step Form plugin <= 1.7.11 versions.

8.8
2023-11-22 CVE-2023-47765 Codebard Cross-Site Request Forgery (CSRF) vulnerability in Codebard Codebard'S Patron Button and Widgets for Patreon

Cross-Site Request Forgery (CSRF) vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.9 versions.

8.8
2023-11-22 CVE-2023-48106 Zlib NG Out-of-bounds Write vulnerability in Zlib-Ng Minizip-Ng 4.0.2

Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_resolve function in the mz_os.c file.

8.8
2023-11-22 CVE-2023-47315 H MDM Use of Hard-coded Credentials vulnerability in H-Mdm Headwind MDM 5.22.1

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret.

8.8
2023-11-22 CVE-2023-6156 Checkmk Unspecified vulnerability in Checkmk 2.0.0/2.1.0/2.2.0

Improper neutralization of livestatus command delimiters in the availability timeline in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command execution for authorized users.

8.8
2023-11-22 CVE-2023-6157 Checkmk Unspecified vulnerability in Checkmk 2.0.0/2.1.0/2.2.0

Improper neutralization of livestatus command delimiters in ajax_search in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command execution for authorized users.

8.8
2023-11-22 CVE-2023-2440 Userproplugin Cross-Site Request Forgery (CSRF) vulnerability in Userproplugin Userpro

The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1.

8.8
2023-11-22 CVE-2023-2497 Userproplugin Cross-Site Request Forgery (CSRF) vulnerability in Userproplugin Userpro

The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0.

8.8
2023-11-22 CVE-2023-47350 Swiftyedit Cross-Site Request Forgery (CSRF) vulnerability in Swiftyedit 1.0.0/1.1.0/1.1.2

Cross-Site Request Forgery (CSRF) vulnerability in SwiftyEdit Content Management System prior to v1.2.0, allows remote attackers to escalate privileges via the user password update functionality.

8.8
2023-11-22 CVE-2023-5465 Gopiplus SQL Injection vulnerability in Gopiplus Popup With Fancybox

The Popup with fancybox plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

8.8
2023-11-22 CVE-2023-5466 Gopiplus SQL Injection vulnerability in Gopiplus WP Anything Slider

The Wp anything slider plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

8.8
2023-11-22 CVE-2023-6009 Userproplugin Unspecified vulnerability in Userproplugin Userpro

The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userpro_update_user_profile' function.

8.8
2023-11-22 CVE-2023-26542 Exeebit Cross-Site Request Forgery (CSRF) vulnerability in Exeebit PHPinfo() WP

Cross-Site Request Forgery (CSRF) vulnerability in Exeebit phpinfo() WP plugin <= 4.0 versions.

8.8
2023-11-22 CVE-2023-26532 Accesspressthemes Unspecified vulnerability in Accesspressthemes Social Auto Poster

Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes Social Auto Poster plugin <= 2.1.4 versions.

8.8
2023-11-22 CVE-2023-26535 Wppool Cross-Site Request Forgery (CSRF) vulnerability in Wppool Sheets to WP Table Live Sync

Cross-Site Request Forgery (CSRF) vulnerability in WPPOOL Sheets To WP Table Live Sync plugin <= 2.12.15 versions.

8.8
2023-11-22 CVE-2023-27442 Techsoupeurope Unspecified vulnerability in Techsoupeurope Leyka

Cross-Site Request Forgery (CSRF) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.29.2 versions.

8.8
2023-11-22 CVE-2023-27444 Perfops Unspecified vulnerability in Perfops Decalog

Cross-Site Request Forgery (CSRF) vulnerability in Pierre Lannoy / PerfOps One DecaLog plugin <= 3.7.0 versions.

8.8
2023-11-22 CVE-2023-27446 Fluenx Unspecified vulnerability in Fluenx Deepl PRO API Translation 1.7.5

Cross-Site Request Forgery (CSRF) vulnerability in Fluenx DeepL API translation plugin <= 2.1.4 versions.

8.8
2023-11-22 CVE-2023-27451 Connekthq Unspecified vulnerability in Connekthq Instant Images

Server-Side Request Forgery (SSRF) vulnerability in Darren Cooney Instant Images plugin <= 5.1.0.2 versions.

8.8
2023-11-22 CVE-2023-27453 LWS Cross-Site Request Forgery (CSRF) vulnerability in LWS Tools

Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.3.1 versions.

8.8
2023-11-22 CVE-2023-27457 Passionatebrains Cross-Site Request Forgery (CSRF) vulnerability in Passionatebrains ADD Expires Headers & Optimized Minify

Cross-Site Request Forgery (CSRF) vulnerability in Passionate Brains Add Expires Headers & Optimized Minify plugin <= 2.7 versions.

8.8
2023-11-22 CVE-2023-27458 Wpstream Cross-Site Request Forgery (CSRF) vulnerability in Wpstream

Cross-Site Request Forgery (CSRF) vulnerability in wpstream WpStream plugin <= 4.4.10 versions.

8.8
2023-11-22 CVE-2023-27461 Yoohooplugins Cross-Site Request Forgery (CSRF) vulnerability in Yoohooplugins When Last Login

Cross-Site Request Forgery (CSRF) vulnerability in Yoohoo Plugins When Last Login plugin <= 1.2.1 versions.

8.8
2023-11-22 CVE-2023-27633 Pixelgrade Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Customify

Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Customify – Intuitive Website Styling plugin <= 2.10.4 versions.

8.8
2023-11-22 CVE-2023-28747 Codeboxr Cross-Site Request Forgery (CSRF) vulnerability in Codeboxr CBX Currency Converter

Cross-Site Request Forgery (CSRF) vulnerability in codeboxr CBX Currency Converter plugin <= 3.0.3 versions.

8.8
2023-11-22 CVE-2023-28749 Cminds Unspecified vulnerability in Cminds CM on Demand Search and Replace

Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.

8.8
2023-11-22 CVE-2022-35638 IBM Cross-Site Request Forgery (CSRF) vulnerability in IBM Sterling B2B Integrator

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

8.8
2023-11-22 CVE-2021-37937 Elastic Unspecified vulnerability in Elastic Elasticsearch

An issue was found with how API keys are created with the Fleet-Server service account.

8.8
2023-11-22 CVE-2021-22142 Elastic Unspecified vulnerability in Elastic Kibana

Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports.

8.8
2023-11-22 CVE-2023-5299 Fujielectric Unspecified vulnerability in Fujielectric Tellus Lite V-Simulator 4.0.12.0/4.0.15.0

A user with a standard account in Fuji Electric Tellus Lite may overwrite files in the system.

8.8
2023-11-21 CVE-2023-20272 Cisco Unspecified vulnerability in Cisco Identity Services Engine 3.0.0/3.1

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of the application.

8.8
2023-11-21 CVE-2023-22516 Atlassian Unspecified vulnerability in Atlassian Bamboo

This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.0, and 9.3.0 of Bamboo Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Bamboo Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Bamboo Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7. JDK 1.8u121+ should be used in case Java 8 used to run Bamboo Data Center and Server.

8.8
2023-11-21 CVE-2023-22521 Atlassian Unspecified vulnerability in Atlassian Crowd

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.0, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Crowd Data Center and Server 3.4: Upgrade to a release greater than or equal to 5.1.6 Crowd Data Center and Server 5.2: Upgrade to a release greater than or equal to 5.2.1 See the release notes ([https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html]).

8.8
2023-11-21 CVE-2023-6207 Mozilla
Debian
Use After Free vulnerability in multiple products

Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.

8.8
2023-11-21 CVE-2023-6208 Mozilla
Debian
When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboard. *This bug only affects Firefox on X11.
8.8
2023-11-21 CVE-2023-6212 Mozilla
Debian
Out-of-bounds Write vulnerability in multiple products

Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4.

8.8
2023-11-21 CVE-2023-6213 Mozilla Out-of-bounds Write vulnerability in Mozilla Firefox

Memory safety bugs present in Firefox 119.

8.8
2023-11-21 CVE-2023-5776 Wpexpertplugins Cross-Site Request Forgery (CSRF) vulnerability in Wpexpertplugins Post Meta Data Manager

The Post Meta Data Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1.

8.8
2023-11-21 CVE-2023-4424 Zephyrproject Classic Buffer Overflow vulnerability in Zephyrproject Zephyr

An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.

8.8
2023-11-20 CVE-2023-38885 Os4Ed Cross-Site Request Forgery (CSRF) vulnerability in Os4Ed Opensis 9.0

OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app.

8.8
2023-11-20 CVE-2023-48293 Xwiki Cross-Site Request Forgery (CSRF) vulnerability in Xwiki

The XWiki Admin Tools Application provides tools to help the administration of XWiki.

8.8
2023-11-20 CVE-2023-4824 Bdaia Cross-Site Request Forgery (CSRF) vulnerability in Bdaia Woohoo Newspaper Magazine Theme

The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

8.8
2023-11-20 CVE-2023-48221 Wire Use of Externally-Controlled Format String vulnerability in Wire Audio, Video, and Signaling

wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire.

8.8
2023-11-20 CVE-2023-48240 Xwiki Server-Side Request Forgery (SSRF) vulnerability in Xwiki

XWiki Platform is a generic wiki platform.

8.8
2023-11-20 CVE-2023-48292 Xwiki Cross-Site Request Forgery (CSRF) vulnerability in Xwiki Admin Tools

The XWiki Admin Tools Application provides tools to help the administration of XWiki.

8.8
2023-11-20 CVE-2023-6196 Myaudiomerchant Cross-Site Request Forgery (CSRF) vulnerability in Myaudiomerchant Audio Merchant

The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4.

8.8
2023-11-22 CVE-2023-6265 Draytek Path Traversal vulnerability in Draytek Vigor2960 Firmware 1.5.1.4/1.5.1.5

** UNSUPPORTED WHEN ASSIGNED ** Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files.

8.1
2023-11-22 CVE-2023-43887 Struktur Classic Buffer Overflow vulnerability in Struktur Libde265 1.0.12

Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num_tile_columns and num_tile_row parameters in the function pic_parameter_set::dump.

8.1
2023-11-22 CVE-2023-6263 Networkoptix Authentication Bypass by Spoofing vulnerability in Networkoptix Nxcloud

An issue was discovered by IPVM team in Network Optix NxCloud before 23.1.0.40440. It was possible to add a fake VMS server to NxCloud by using the exact identification of a legitimate VMS server.

8.1
2023-11-22 CVE-2023-2437 Userproplugin Improper Authentication vulnerability in Userproplugin Userpro

The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1.

8.1
2023-11-24 CVE-2023-26279 IBM Improper Encoding or Escaping of Output vulnerability in IBM Qradar Wincollect 10.0/10.0.1/10.1.6

IBM QRadar WinCollect Agent 10.0 through 10.1.7 could allow a local user to perform unauthorized actions due to improper encoding.

7.8
2023-11-23 CVE-2023-5972 Linux
Fedoraproject
NULL Pointer Dereference vulnerability in multiple products

A null pointer dereference flaw was found in the nft_inner.c functionality of netfilter in the Linux kernel.

7.8
2023-11-23 CVE-2023-39253 Dell Unspecified vulnerability in Dell OS Recovery Tool 2.2.4013/2.3.7012.0/2.3.7515.0

Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability.

7.8
2023-11-23 CVE-2023-43086 Dell Unspecified vulnerability in Dell Command|Configure

Dell Command | Configure, versions prior to 4.11.0, contains an improper access control vulnerability.

7.8
2023-11-23 CVE-2023-44289 Dell Unspecified vulnerability in Dell Command|Configure

Dell Command | Configure versions prior to 4.11.0, contain an improper access control vulnerability.

7.8
2023-11-23 CVE-2023-44290 Dell Unspecified vulnerability in Dell Command|Monitor

Dell Command | Monitor versions prior to 10.10.0, contain an improper access control vulnerability.

7.8
2023-11-23 CVE-2023-41139 Autodesk Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Autodesk products

A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer.

7.8
2023-11-23 CVE-2023-41140 Autodesk Out-of-bounds Write vulnerability in Autodesk products

A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow.

7.8
2023-11-22 CVE-2023-29069 Autodesk Uncontrolled Search Path Element vulnerability in Autodesk Desktop Connector

A maliciously crafted DLL file can be forced to install onto a non-default location, and attacker can overwrite parts of the product with malicious DLLs.

7.8
2023-11-22 CVE-2023-46814 Videolan Uncontrolled Search Path Element vulnerability in Videolan VLC Media Player

A binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on Windows.

7.8
2023-11-22 CVE-2021-37942 Elastic Unspecified vulnerability in Elastic APM Java Agent

A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent.

7.8
2023-11-22 CVE-2023-35127 Fujielectric Out-of-bounds Write vulnerability in Fujielectric Tellus Lite V-Simulator 4.0.12.0/4.0.15.0

Stack-based buffer overflow may occur when Fuji Electric Tellus Lite V-Simulator parses a specially-crafted input file.

7.8
2023-11-22 CVE-2023-40152 Fujielectric Out-of-bounds Write vulnerability in Fujielectric Tellus Lite V-Simulator 4.0.12.0/4.0.15.0

When Fuji Electric Tellus Lite V-Simulator parses a specially-crafted input file an out of bounds write may occur.

7.8
2023-11-21 CVE-2021-38405 Siemens Out-of-bounds Write vulnerability in Siemens Jt2Go and Teamcenter Visualization

The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition while parsing specially crafted PDF files.

7.8
2023-11-21 CVE-2023-20274 Cisco Unspecified vulnerability in Cisco Appdynamics

A vulnerability in the installer script of Cisco AppDynamics PHP Agent could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient permissions that are set by the PHP Agent Installer on the PHP Agent install directory.

7.8
2023-11-21 CVE-2021-27502 TI Integer Overflow or Wraparound vulnerability in TI products

Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution.

7.8
2023-11-21 CVE-2021-27504 Amazon
TI
Integer Overflow or Wraparound vulnerability in multiple products

Texas Instruments devices running FREERTOS, malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'malloc' for FreeRTOS, resulting in code execution.

7.8
2023-11-21 CVE-2023-6235 Duetdisplay Uncontrolled Search Path Element vulnerability in Duetdisplay Duet Display 2.5.9.1

An uncontrolled search path element vulnerability has been found in the Duet Display product, affecting version 2.5.9.1.

7.8
2023-11-20 CVE-2023-48192 Totolink Code Injection vulnerability in Totolink A3700R Firmware 9.1.2U.6134B20201202

An issue in TOTOlink A3700R v.9.1.2u.6134_B20201202 allows a local attacker to execute arbitrary code via the setTracerouteCfg function.

7.8
2023-11-20 CVE-2023-47172 Withsecure Unspecified vulnerability in Withsecure products

Certain WithSecure products allow Local Privilege Escalation.

7.8
2023-11-20 CVE-2021-22636 TI Integer Overflow or Wraparound vulnerability in TI products

Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMem_allocUnprotected' and result in code execution.

7.8
2023-11-20 CVE-2021-27429 TI Integer Overflow or Wraparound vulnerability in TI products

Texas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values.

7.8
2023-11-20 CVE-2023-43612 Openatom Improper Preservation of Permissions vulnerability in Openatom Openharmony

in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary file read and write through improper preservation of permissions.

7.8
2023-11-20 CVE-2023-5593 Zyxel Out-of-bounds Write vulnerability in Zyxel Secuextender SSL VPN 4.0.4.0

The out-of-bounds write vulnerability in the Windows-based SecuExtender SSL VPN Client software version 4.0.4.0 could allow an authenticated local user to gain a privilege escalation by sending a crafted CREATE message.

7.8
2023-11-20 CVE-2023-6045 Openatom Type Confusion vulnerability in Openatom Openharmony

in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through type confusion.

7.8
2023-11-24 CVE-2023-49298 Openzfs Authorization Bypass Through User-Controlled Key vulnerability in Openzfs

OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms.

7.5
2023-11-24 CVE-2023-6276 Tongda2000 SQL Injection vulnerability in Tongda2000 Tongda Office Anywhere 2017

A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9.

7.5
2023-11-24 CVE-2023-48796 Apache Unspecified vulnerability in Apache Dolphinscheduler 3.0.0/3.0.1

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file ``` management:   endpoints:     web:       exposure:         include: health,metrics,prometheus ``` This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue.

7.5
2023-11-24 CVE-2023-44303 Robware Insufficiently Protected Credentials vulnerability in Robware Rvtools

RVTools, Version 3.9.2 and above, contain a sensitive data exposure vulnerability in the password encryption utility (RVToolsPasswordEncryption.exe) and main application (RVTools.exe).

7.5
2023-11-23 CVE-2023-47244 Omnisend Unspecified vulnerability in Omnisend Email Marketing for Woocommerce

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend.This issue affects Email Marketing for WooCommerce by Omnisend: from n/a through 1.13.8.

7.5
2023-11-23 CVE-2023-47529 Themeisle Unspecified vulnerability in Themeisle Cloud Templates & Patterns Collection

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeIsle Cloud Templates & Patterns collection.This issue affects Cloud Templates & Patterns collection: from n/a through 1.2.2.

7.5
2023-11-23 CVE-2022-44010 Clickhouse Out-of-bounds Write vulnerability in Clickhouse

An issue was discovered in ClickHouse before 22.9.1.2603.

7.5
2023-11-23 CVE-2023-41787 Artica Uncontrolled Search Path Element vulnerability in Artica Pandora FMS

Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths.

7.5
2023-11-23 CVE-2023-41806 Artica Unspecified vulnerability in Artica Pandora FMS

Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation.

7.5
2023-11-23 CVE-2023-41808 Artica Unspecified vulnerability in Artica Pandora FMS

Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation.

7.5
2023-11-23 CVE-2023-6118 Neutron Path Traversal vulnerability in Neutron products

Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal.This issue affects IP Camera: before b1130.1.0.1.

7.5
2023-11-23 CVE-2023-28813 Hikvision Unspecified vulnerability in Hikvision Localservicecomponents 1.0.0.78

An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, which could cause affected computers to download malicious files.

7.5
2023-11-23 CVE-2023-30581 Nodejs Unspecified vulnerability in Nodejs Node.Js

The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition.

7.5
2023-11-23 CVE-2023-47668 Liquidweb Information Exposure vulnerability in Liquidweb Restrict Content

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.

7.5
2023-11-22 CVE-2023-48105 Bytecodealliance Out-of-bounds Write vulnerability in Bytecodealliance Webassembly Micro Runtime 1.2.3

An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of service via the wasm_loader_prepare_bytecode function in core/iwasm/interpreter/wasm_loader.c.

7.5
2023-11-22 CVE-2023-6252 Hyphensolutions Path Traversal vulnerability in Hyphensolutions Chameleon Power 1.0

Path traversal vulnerability in Chalemelon Power framework, affecting the getImage parameter.

7.5
2023-11-22 CVE-2023-3104 Unitree Missing Authentication for Critical Function vulnerability in Unitree A1 Firmware

Lack of authentication vulnerability.

7.5
2023-11-22 CVE-2023-5983 Botanikyazilim Privacy Violation vulnerability in Botanikyazilim Pharmacy Automation

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Botanik Software Pharmacy Automation allows Retrieve Embedded Sensitive Data.This issue affects Pharmacy Automation: before 2.1.133.0.

7.5
2023-11-22 CVE-2023-46673 Elastic Improper Handling of Exceptional Conditions vulnerability in Elastic Elasticsearch

It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.

7.5
2023-11-22 CVE-2023-6117 M Files Unspecified vulnerability in M-Files Server

A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server before 23.11.13156.0 which allows attackers to execute DoS attacks.

7.5
2023-11-22 CVE-2023-47016 Radare Out-of-bounds Write vulnerability in Radare Radare2

radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.

7.5
2023-11-21 CVE-2023-49103 Owncloud Unspecified vulnerability in Owncloud Graph API 0.2.0/0.3.0

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1.

7.5
2023-11-21 CVE-2023-45886 F5
Ipinfusion
The BGP daemon (bgpd) in IP Infusion ZebOS through 7.10.6 allow remote attackers to cause a denial of service by sending crafted BGP update messages containing a malformed attribute.
7.5
2023-11-20 CVE-2023-48051 Carglglz Inadequate Encryption Strength vulnerability in Carglglz Upydev 0.4.3

An issue in /upydev/keygen.py in upydev v0.4.3 allows attackers to decrypt sensitive information via weak encryption padding.

7.5
2023-11-20 CVE-2023-48310 NC3 Improper Input Validation vulnerability in NC3 Testing Platform

TestingPlatform is a testing platform for Internet Security Standards.

7.5
2023-11-20 CVE-2023-48109 Tenda Out-of-bounds Write vulnerability in Tenda Ax1803 Firmware 1.0.0.1

Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the deviceId parameter in the function saveParentControlInfo .

7.5
2023-11-20 CVE-2023-48110 Tenda Out-of-bounds Write vulnerability in Tenda Ax1803 Firmware 1.0.0.1

Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the urls parameter in the function saveParentControlInfo .

7.5
2023-11-20 CVE-2023-48111 Tenda Out-of-bounds Write vulnerability in Tenda Ax1803 Firmware 1.0.0.1

Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the function saveParentControlInfo .

7.5
2023-11-20 CVE-2023-38879 Os4Ed Path Traversal vulnerability in Os4Ed Opensis 9.0

The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of 'DownloadWindow.php'.

7.5
2023-11-20 CVE-2023-38884 Os4Ed Authorization Bypass Through User-Controlled Key vulnerability in Os4Ed Opensis 9.0

An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting '/assets/studentfiles/<studentId>-<filename>'

7.5
2023-11-20 CVE-2023-48241 Xwiki Unspecified vulnerability in Xwiki

XWiki Platform is a generic wiki platform.

7.5
2023-11-22 CVE-2023-48646 Zohocorp Unspecified vulnerability in Zohocorp Manageengine Recoverymanager Plus 5.3/5.4/6.0

Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings.

7.2
2023-11-22 CVE-2023-2841 Zorem SQL Injection vulnerability in Zorem Advanced Local Pickup for Woocommerce

The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up to, and including, 1.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

7.2
2023-11-22 CVE-2021-22150 Elastic Code Injection vulnerability in Elastic Kibana

It was discovered that a user with Fleet admin permissions could upload a malicious package.

7.2
2023-11-24 CVE-2023-6293 Sequelizejs Unspecified vulnerability in Sequelizejs Sequelize-Typescript

Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6.

7.1
2023-11-22 CVE-2023-5921 Decesoftware Improper Enforcement of Behavioral Workflow vulnerability in Decesoftware Geodi

Improper Enforcement of Behavioral Workflow vulnerability in DECE Software Geodi allows Functionality Bypass.This issue affects Geodi: before 8.0.0.27396.

7.1
2023-11-22 CVE-2023-48161 Giflib Project Out-of-bounds Write vulnerability in Giflib Project Giflib 5.2.1

Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c

7.1
2023-11-21 CVE-2023-48239 Nextcloud Unspecified vulnerability in Nextcloud Server

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.

7.1
2023-11-21 CVE-2023-21417 Axis Path Traversal vulnerability in Axis OS

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversal attacks that allows for file/folder deletion.

7.1
2023-11-21 CVE-2023-21418 Axis Path Traversal vulnerability in Axis products

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks that allows for file deletion.

7.1
2023-11-20 CVE-2023-48090 Gpac Memory Leak vulnerability in Gpac 2.3Devrev617G671976Fccmaster

GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extract_attributes media_tools/m3u8.c:329.

7.1
2023-11-20 CVE-2023-3116 Openatom Incorrect Default Permissions vulnerability in Openatom Openharmony

in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information or rewrite sensitive file through incorrect default permissions.

7.1

182 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2023-11-21 CVE-2023-5553 Axis Unspecified vulnerability in Axis OS and Axis OS 2022

During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection.

6.8
2023-11-22 CVE-2023-6160 Lifterlms Path Traversal vulnerability in Lifterlms

The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 7.4.2 via the maybe_serve_export function.

6.7
2023-11-21 CVE-2023-6238 Linux
Fedoraproject
Classic Buffer Overflow vulnerability in multiple products

A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel.

6.7
2023-11-26 CVE-2023-6298 Itextpdf Unspecified vulnerability in Itextpdf Itext 8.0.2

A vulnerability classified as problematic was found in Apryse iText 8.0.2.

6.5
2023-11-26 CVE-2023-6299 Itextpdf Memory Leak vulnerability in Itextpdf Itext 8.0.1

A vulnerability, which was classified as problematic, has been found in Apryse iText 8.0.1.

6.5
2023-11-24 CVE-2023-6277 Libtiff
Fedoraproject
Resource Exhaustion vulnerability in multiple products

An out-of-memory flaw was found in libtiff.

6.5
2023-11-24 CVE-2023-48707 Codeigniter Cleartext Storage of Sensitive Information vulnerability in Codeigniter Shield 1.0.0

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4.

6.5
2023-11-24 CVE-2023-48708 Codeigniter Information Exposure Through Log Files vulnerability in Codeigniter Shield 1.0.0

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4.

6.5
2023-11-24 CVE-2023-33706 Sysaid Authorization Bypass Through User-Controlled Key vulnerability in Sysaid

SysAid before 23.2.15 allows Indirect Object Reference (IDOR) attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modified srID parameter to ShowMessage.jsp.

6.5
2023-11-23 CVE-2022-44011 Clickhouse Out-of-bounds Write vulnerability in Clickhouse

An issue was discovered in ClickHouse before 22.9.1.2603.

6.5
2023-11-23 CVE-2023-41786 Artica Exposure of Resource to Wrong Sphere vulnerability in Artica Pandora FMS

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery.

6.5
2023-11-23 CVE-2023-4593 Seattlelab Path Traversal vulnerability in Seattlelab Slmail 5.5.0.4433

Path traversal vulnerability whose exploitation could allow an authenticated remote user to bypass SecurityManager's intended restrictions and list a parent directory via any filename, such as a multiple ..%2F value affecting the 'dodoc' parameter in the /MailAdmin_dll.htm file.

6.5
2023-11-23 CVE-2023-4595 Seattlelab File and Directory Information Exposure vulnerability in Seattlelab Slmail 5.5.0.4433

An information exposure vulnerability has been found, the exploitation of which could allow a remote user to retrieve sensitive information stored on the server such as credential files, configuration files, application files, etc., simply by appending any of the following parameters to the end of the URL: %00 %0a, %20, %2a, %a0, %aa, %c0 and %ca.

6.5
2023-11-23 CVE-2023-28811 Hikvision Classic Buffer Overflow vulnerability in Hikvision products

There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models.

6.5
2023-11-23 CVE-2023-23978 Switchwp Unspecified vulnerability in Switchwp WP Client Reports

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SwitchWP WP Client Reports plugin <= 1.0.16 versions.

6.5
2023-11-23 CVE-2023-40002 Booster Unspecified vulnerability in Booster for Woocommerce

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce plugin <= 7.1.1 versions.

6.5
2023-11-22 CVE-2022-36777 IBM Unspecified vulnerability in IBM Cloud PAK for Security and Qradar Suite

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.16.0could allow an authenticated user to obtain sensitive version information that could aid in further attacks against the system.

6.5
2023-11-22 CVE-2023-47014 Remyandrade Cross-Site Request Forgery (CSRF) vulnerability in Remyandrade Sticky Notes APP 1.0

A Cross-Site Request Forgery (CSRF) vulnerability in Sourcecodester Sticky Notes App Using PHP with Source Code v.1.0 allows a local attacker to obtain sensitive information via a crafted payload to add-note.php.

6.5
2023-11-22 CVE-2023-47251 M Privacy Path Traversal vulnerability in M-Privacy Mprivacy-Tools and Tightgatevnc

In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, a Directory Traversal in the print function of the VNC service allows authenticated attackers (with access to a VNC session) to automatically transfer malicious PDF documents by moving them into the .spool directory, and then sending a signal to the VNC service, which automatically transfers them to the connected VNC client's filesystem.

6.5
2023-11-22 CVE-2023-47467 Jeecg Path Traversal vulnerability in Jeecg Jeecg-Boot 3.6.0

Directory Traversal vulnerability in jeecg-boot v.3.6.0 allows a remote privileged attacker to obtain sensitive information via the file directory structure.

6.5
2023-11-22 CVE-2023-47312 H MDM Cleartext Storage of Sensitive Information vulnerability in H-Mdm Headwind MDM 5.22.1

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries.

6.5
2023-11-22 CVE-2023-6007 Userproplugin Missing Authorization vulnerability in Userproplugin Userpro

The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.1.1.

6.5
2023-11-22 CVE-2023-2446 Userproplugin Unspecified vulnerability in Userproplugin Userpro

The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1.

6.5
2023-11-21 CVE-2023-48700 Nautobot Cleartext Storage of Sensitive Information vulnerability in Nautobot Nautobot-Plugin-Device-Onboarding

The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location.

6.5
2023-11-21 CVE-2023-6204 Mozilla
Debian
Out-of-bounds Read vulnerability in multiple products

On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element.

6.5
2023-11-21 CVE-2023-6205 Mozilla
Debian
Use After Free vulnerability in multiple products

It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash.

6.5
2023-11-21 CVE-2023-6209 Mozilla
Debian
Path Traversal vulnerability in multiple products

Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host.

6.5
2023-11-21 CVE-2023-6210 Mozilla Unspecified vulnerability in Mozilla Firefox

When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed to load blockable content such as iframes from insecure http: URLs This vulnerability affects Firefox < 120.

6.5
2023-11-21 CVE-2023-6211 Mozilla Improper Restriction of Rendered UI Layers or Frames vulnerability in Mozilla Firefox

If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked the user into clicking to grant an HTTPS-only exception if they could get the user to participate in a clicking game.

6.5
2023-11-21 CVE-2023-21416 Axis Unspecified vulnerability in Axis OS

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-Service attack allowing for an attacker to block access to the overlay configuration page in the web interface of the Axis device.

6.5
2023-11-20 CVE-2023-6199 Bookstackapp Server-Side Request Forgery (SSRF) vulnerability in Bookstackapp Bookstack 23.10.2

Book Stack version 23.10.2 allows filtering local files on the server.

6.5
2023-11-20 CVE-2023-6062 Tenable Out-of-bounds Write vulnerability in Tenable Nessus

An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus Rules variables to overwrite arbitrary files on the remote host, which could lead to a denial of service condition.

6.5
2023-11-20 CVE-2023-6178 Tenable Out-of-bounds Write vulnerability in Tenable Nessus

An arbitrary file write vulnerability exists where an authenticated attacker with privileges on the managing application could alter Nessus Rules variables to overwrite arbitrary files on the remote host, which could lead to a denial of service condition.

6.5
2023-11-20 CVE-2023-36013 Microsoft Exposure of Resource to Wrong Sphere vulnerability in Microsoft Powershell

PowerShell Information Disclosure Vulnerability

6.5
2023-11-26 CVE-2023-6297 Phpgurukul Cross-site Scripting vulnerability in PHPgurukul Nipah Virus Testing Management System 1.0

A vulnerability classified as problematic has been found in PHPGurukul Nipah Virus Testing Management System 1.0.

6.1
2023-11-26 CVE-2023-6296 Oscommerce Cross-site Scripting vulnerability in Oscommerce 4.0

A vulnerability was found in osCommerce 4.

6.1
2023-11-24 CVE-2023-6275 Totvs Cross-site Scripting vulnerability in Totvs Fluig

A vulnerability was found in TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1.

6.1
2023-11-23 CVE-2023-49215 Usedesk Cross-site Scripting vulnerability in Usedesk

Usedesk before 1.7.57 allows filter reflected XSS.

6.1
2023-11-23 CVE-2023-41789 Artica Cross-site Scripting vulnerability in Artica Pandora FMS

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).

6.1
2023-11-23 CVE-2023-41792 Artica Cross-Site Request Forgery (CSRF) vulnerability in Artica Pandora FMS

Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).

6.1
2023-11-23 CVE-2023-41810 Artica Cross-site Scripting vulnerability in Artica Pandora FMS

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).

6.1
2023-11-23 CVE-2023-41811 Artica Cross-site Scripting vulnerability in Artica Pandora FMS

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).

6.1
2023-11-23 CVE-2023-4406 KC Group E Commerce Software Project Cross-site Scripting vulnerability in KC Group E-Commerce Software Project KC Group E-Commerce Software

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Reflected XSS.This issue affects E-Commerce Software: through 20231123.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

6.1
2023-11-23 CVE-2023-47790 Popozure Cross-site Scripting vulnerability in Popozure Pz-Linkcard

Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in Poporon Pz-LinkCard plugin <= 2.4.8 versions.

6.1
2023-11-22 CVE-2023-47766 Ifeelweb Cross-site Scripting vulnerability in Ifeelweb Post Status Notifier Lite 1.10.1

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timo Reith Post Status Notifier Lite plugin <= 1.11.0 versions.

6.1
2023-11-22 CVE-2023-47767 FLA Shop Cross-site Scripting vulnerability in Fla-Shop Interactive World MAP

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fla-shop.Com Interactive World Map plugin <= 3.2.0 versions.

6.1
2023-11-22 CVE-2023-47768 Diywebmastery Cross-site Scripting vulnerability in Diywebmastery Footer Putter

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Footer Putter plugin <= 1.17 versions.

6.1
2023-11-22 CVE-2023-47773 Yasglobal Cross-site Scripting vulnerability in Yasglobal Permalinks Customizer 2.8.2

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 versions.

6.1
2023-11-22 CVE-2023-49146 Getgrav Cross-site Scripting vulnerability in Getgrav Dom-Sanitizer

DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions.

6.1
2023-11-22 CVE-2023-30496 Mage People Cross-site Scripting vulnerability in Mage-People BUS Ticket Booking With Seat Reservation

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MagePeople Team WpBusTicketly plugin <= 5.2.5 versions.

6.1
2023-11-22 CVE-2023-47755 Aazztech Cross-site Scripting vulnerability in Aazztech Woocommerce Product Carousel Slider

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AazzTech WooCommerce Product Carousel Slider plugin <= 3.3.5 versions.

6.1
2023-11-22 CVE-2023-2438 Userproplugin Cross-Site Request Forgery (CSRF) vulnerability in Userproplugin Userpro

The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0.

6.1
2023-11-22 CVE-2023-47380 Admidio Cross-site Scripting vulnerability in Admidio 4.2.12

Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS).

6.1
2023-11-22 CVE-2023-2447 Userproplugin Cross-Site Request Forgery (CSRF) vulnerability in Userproplugin Userpro

The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1.

6.1
2023-11-21 CVE-2023-48701 Statamic Cross-site Scripting vulnerability in Statamic

Statamic CMS is a Laravel and Git powered content management system (CMS).

6.1
2023-11-21 CVE-2023-49104 Owncloud Open Redirect vulnerability in Owncloud Oauth2

An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled.

6.1
2023-11-21 CVE-2023-49061 Mozilla Open Redirect vulnerability in Mozilla Firefox

An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information.

6.1
2023-11-20 CVE-2023-47311 Spaceapplications Improper Restriction of Rendered UI Layers or Frames vulnerability in Spaceapplications Yacms 5.8.6

An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking.

6.1
2023-11-20 CVE-2023-47417 Paulrouget Cross-site Scripting vulnerability in Paulrouget Dzslides

Cross Site Scripting (XSS) vulnerability in the component /shells/embedder.html of DZSlides after v2011.07.25 allows attackers to execute arbitrary code via a crafted payload.

6.1
2023-11-20 CVE-2023-38881 Os4Ed Cross-site Scripting vulnerability in Os4Ed Opensis 9.0

A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into any of the 'calendar_id', 'school_date', 'month' or 'year' parameters in 'CalendarModal.php'.

6.1
2023-11-20 CVE-2023-38882 Os4Ed Cross-site Scripting vulnerability in Os4Ed Opensis 9.0

A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'include' parameter in 'ForExport.php'

6.1
2023-11-20 CVE-2023-38883 Os4Ed Cross-site Scripting vulnerability in Os4Ed Opensis 9.0

A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'ajax' parameter in 'ParentLookup.php'.

6.1
2023-11-20 CVE-2023-5140 Computy Cross-site Scripting vulnerability in Computy Bonus for WOO

The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

6.1
2023-11-20 CVE-2023-5609 S Sols Cross-site Scripting vulnerability in S-Sols Seraphinite Accelerator

The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

6.1
2023-11-20 CVE-2023-47175 Luxsoft Cross-site Scripting vulnerability in Luxsoft Luxcal web Calendar

Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the product.

6.1
2023-11-22 CVE-2023-6253 Fortra Insecure Storage of Sensitive Information vulnerability in Fortra Digital Guardian Agent

A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the software by extracting the uninstaller key from the memory of the uninstaller file.

6.0
2023-11-22 CVE-2023-43082 Dell Improper Certificate Validation vulnerability in Dell products

Dell Unity prior to 5.3 contains a 'man in the middle' vulnerability in the vmadapter component.

5.9
2023-11-22 CVE-2023-3103 Unitree Authentication Bypass by Spoofing vulnerability in Unitree A1 Firmware

Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle (MITM) attack on the robot's camera video stream.

5.9
2023-11-20 CVE-2023-48223 Nearform Unspecified vulnerability in Nearform Fast-Jwt

fast-jwt provides fast JSON Web Token (JWT) implementation.

5.9
2023-11-23 CVE-2023-33202 Bouncycastle Resource Exhaustion vulnerability in Bouncycastle Bouncy Castle for Java and Fips Java API

Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class.

5.5
2023-11-23 CVE-2023-43123 Apache Unspecified vulnerability in Apache Storm

On unix-like systems, the temporary directory is shared between all user.

5.5
2023-11-22 CVE-2023-25682 IBM Information Exposure Through Log Files vulnerability in IBM Sterling B2B Integrator

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 stores potentially sensitive information in log files that could be read by a local user.

5.5
2023-11-22 CVE-2023-20240 Cisco Out-of-bounds Read vulnerability in Cisco Anyconnect Secure Mobility Client and Secure Client

Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system.

5.5
2023-11-22 CVE-2023-20241 Cisco Out-of-bounds Read vulnerability in Cisco Anyconnect Secure Mobility Client and Secure Client

Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. These vulnerabilities are due to an out-of-bounds memory read from Cisco Secure Client Software.

5.5
2023-11-20 CVE-2023-48039 Gpac Memory Leak vulnerability in Gpac 2.3Devrev617G671976Fccmaster

GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leak in gf_mpd_parse_string media_tools/mpd.c:75.

5.5
2023-11-20 CVE-2023-42774 Openatom Incorrect Default Permissions vulnerability in Openatom Openharmony

in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information through incorrect default permissions.

5.5
2023-11-20 CVE-2023-46100 Openatom Use of Uninitialized Resource vulnerability in Openatom Openharmony

in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource.

5.5
2023-11-20 CVE-2023-46705 Openatom Type Confusion vulnerability in Openatom Openharmony

in OpenHarmony v3.2.2 and prior versions allow a local attacker causes system information leak through type confusion.

5.5
2023-11-20 CVE-2023-47217 Openatom Classic Buffer Overflow vulnerability in Openatom Openharmony

in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through buffer overflow.

5.5
2023-11-23 CVE-2023-49216 Usedesk Cross-site Scripting vulnerability in Usedesk

Usedesk before 1.7.57 allows profile stored XSS.

5.4
2023-11-23 CVE-2023-41791 Artica Cross-site Scripting vulnerability in Artica Pandora FMS

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).

5.4
2023-11-23 CVE-2023-4594 Seattlelab Cross-site Scripting vulnerability in Seattlelab Slmail 5.5.0.4433

Stored XSS vulnerability.

5.4
2023-11-23 CVE-2023-47834 Quizandsurveymaster Cross-site Scripting vulnerability in Quizandsurveymaster Quiz and Survey Master

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versions.

5.4
2023-11-23 CVE-2023-47835 ARI Soft Cross-site Scripting vulnerability in Ari-Soft ARI Stream Quiz

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder plugin <= 1.2.32 versions.

5.4
2023-11-23 CVE-2023-47839 Implecode Cross-site Scripting vulnerability in Implecode Ecommerce Product Catalog

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.26 versions.

5.4
2023-11-22 CVE-2023-47809 Themepoints Cross-site Scripting vulnerability in Themepoints Accordion

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion plugin <= 2.6 versions.

5.4
2023-11-22 CVE-2023-47810 Asdqwedev Cross-site Scripting vulnerability in Asdqwedev Ajax Domain Checker

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asdqwe Dev Ajax Domain Checker plugin <= 1.3.0 versions.

5.4
2023-11-22 CVE-2023-47811 Sureshkumarmukhiya Cross-site Scripting vulnerability in Sureshkumarmukhiya Anywhere Flash Embed 1.0.5

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh KUMAR Mukhiya Anywhere Flash Embed plugin <= 1.0.5 versions.

5.4
2023-11-22 CVE-2023-47812 Bamboo MCR Cross-site Scripting vulnerability in Bamboo MCR Bamboo Columns

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bamboo Mcr Bamboo Columns plugin <= 1.6.1 versions.

5.4
2023-11-22 CVE-2023-47813 Grandslambert Cross-site Scripting vulnerability in Grandslambert Better RSS Widget

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grandslambert Better RSS Widget plugin <= 2.8.1 versions.

5.4
2023-11-22 CVE-2023-47814 Bmicalculator Cross-site Scripting vulnerability in Bmicalculator BMI Calculator

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Waterloo Plugins BMI Calculator Plugin plugin <= 1.0.3 versions.

5.4
2023-11-22 CVE-2023-47815 Venutius Cross-site Scripting vulnerability in Venutius BP Profile Shortcodes Extra 2.5.2

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra plugin <= 2.5.2 versions.

5.4
2023-11-22 CVE-2023-47816 Wpcharitable Cross-site Scripting vulnerability in Wpcharitable Charitable

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donations & Fundraising Team Donation Forms by Charitable plugin <= 1.7.0.13 versions.

5.4
2023-11-22 CVE-2023-47817 Mmrs151 Cross-site Scripting vulnerability in Mmrs151 Daily Prayer Time 2023.10.13

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.10.13 versions.

5.4
2023-11-22 CVE-2023-47821 Jannisthuemmig Cross-site Scripting vulnerability in Jannisthuemmig Email Encoder

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jannis Thuemmig Email Encoder plugin <= 2.1.8 versions.

5.4
2023-11-22 CVE-2023-47831 Assortedchips Cross-site Scripting vulnerability in Assortedchips Drawit 1.1.3

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in assorted[chips] DrawIt (draw.Io) plugin <= 1.1.3 versions.

5.4
2023-11-22 CVE-2023-47786 Layerslider Cross-site Scripting vulnerability in Layerslider

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LayerSlider plugin <= 7.7.9 versions.

5.4
2023-11-22 CVE-2023-47808 Christinauechi Cross-site Scripting vulnerability in Christinauechi ADD Widgets to Page

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christina Uechi Add Widgets to Page plugin <= 1.3.2 versions.

5.4
2023-11-22 CVE-2023-47313 H MDM Path Traversal vulnerability in H-Mdm Headwind MDM 5.22.1

Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal.

5.4
2023-11-22 CVE-2023-47314 H MDM Cross-site Scripting vulnerability in H-Mdm Headwind MDM 5.22.1

Headwind MDM Web panel 5.22.1 is vulnerable to cross-site scripting (XSS).

5.4
2023-11-22 CVE-2023-47316 H MDM Authorization Bypass Through User-Controlled Key vulnerability in H-Mdm Headwind MDM 5.22.1

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control.

5.4
2023-11-22 CVE-2023-48705 Networktocode Cross-site Scripting vulnerability in Networktocode Nautobot

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application All users of Nautobot versions earlier than 1.6.6 or 2.0.5 are potentially affected by a cross-site scripting vulnerability.

5.4
2023-11-22 CVE-2023-5048 WEB Dorado Cross-site Scripting vulnerability in Web-Dorado WP Form Builder

The WDContactFormBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Contact_Form_Builder' shortcode in versions up to, and including, 1.0.72 due to insufficient input sanitization and output escaping on 'id' user supplied attribute.

5.4
2023-11-22 CVE-2023-5096 Jonashjalmarsson Cross-site Scripting vulnerability in Jonashjalmarsson Html Filter and Csv-File Search

The HTML filter and csv-file search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'csvsearch' shortcode in versions up to, and including, 2.7 due to insufficient input sanitization and output escaping on user supplied attributes.

5.4
2023-11-22 CVE-2023-5128 TCD Theme Cross-site Scripting vulnerability in Tcd-Theme TCD Google Maps

The TCD Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'map' shortcode in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping on user supplied attributes.

5.4
2023-11-22 CVE-2023-5163 Weather Atlas Cross-site Scripting vulnerability in Weather-Atlas Weather Atlas

The Weather Atlas Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shortcode-weather-atlas' shortcode in versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes.

5.4
2023-11-22 CVE-2023-5234 Peachpay Cross-site Scripting vulnerability in Peachpay Related products for Woocommerce

The Related Products for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'woo-related' shortcode in versions up to, and including, 3.3.15 due to insufficient input sanitization and output escaping on user supplied attributes.

5.4
2023-11-22 CVE-2023-5338 Themeblvd Cross-site Scripting vulnerability in Themeblvd Theme Blvd Shortcodes

The Theme Blvd Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping on user supplied attributes.

5.4
2023-11-22 CVE-2023-5469 Stevenhenty Cross-site Scripting vulnerability in Stevenhenty Drop Shadow Boxes

The Drop Shadow Boxes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dropshadowbox' shortcode in versions up to, and including, 1.7.13 due to insufficient input sanitization and output escaping on user supplied attributes.

5.4
2023-11-22 CVE-2023-5662 Wpsimplesponsorships Cross-site Scripting vulnerability in Wpsimplesponsorships Sponsors

The Sponsors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sponsors' shortcode in all versions up to, and including, 3.5.0 due to insufficient input sanitization and output escaping on user supplied attributes.

5.4
2023-11-22 CVE-2023-5664 Ggnome Cross-site Scripting vulnerability in Ggnome Garden Gnome Package

The Garden Gnome Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ggpkg' shortcode in all versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping on user supplied attributes.

5.4
2023-11-22 CVE-2023-5667 Themepoints Cross-site Scripting vulnerability in Themepoints TAB Ultimate

The Tab Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes.

5.4
2023-11-22 CVE-2023-5704 Wpchill Cross-site Scripting vulnerability in Wpchill CPO Shortcodes

The CPO Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping on user supplied attributes.

5.4
2023-11-22 CVE-2023-5706 Vektor INC Cross-site Scripting vulnerability in Vektor-Inc VK Blocks

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk-blocks/ancestor-page-list' block in all versions up to, and including, 1.63.0.1 due to insufficient input sanitization and output escaping on user supplied attributes.

5.4
2023-11-22 CVE-2023-5708 WP Post Columns Project Cross-site Scripting vulnerability in WP Post Columns Project WP Post Columns

The WP Post Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'column' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes.

5.4
2023-11-22 CVE-2023-5742 Dwuser Cross-site Scripting vulnerability in Dwuser Easyrotator for Wordpress

The EasyRotator for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyrotator' shortcode in all versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping on user supplied attributes.

5.4
2023-11-22 CVE-2023-6011 Dece Cross-site Scripting vulnerability in Dece Geodi

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DECE Software Geodi allows Stored XSS.This issue affects Geodi: before 8.0.0.27396.

5.4
2023-11-21 CVE-2023-48301 Nextcloud Cross-site Scripting vulnerability in Nextcloud Server

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.

5.4
2023-11-21 CVE-2023-48302 Nextcloud Cross-site Scripting vulnerability in Nextcloud Server

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.

5.4
2023-11-21 CVE-2023-20265 Cisco Cross-site Scripting vulnerability in Cisco products

A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device.

5.4
2023-11-21 CVE-2023-48124 Nayemhowlader Cross-site Scripting vulnerability in Nayemhowlader SUP Online Shopping 1.0

Cross Site Scripting in SUP Online Shopping v.1.0 allows a remote attacker to execute arbitrary code via the Name, Email and Address parameters in the Register New Account component.

5.4
2023-11-21 CVE-2023-6206 Mozilla
Debian
Improper Restriction of Rendered UI Layers or Frames vulnerability in multiple products

The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts.

5.4
2023-11-21 CVE-2023-28802 Zscaler Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector

An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics.

5.4
2023-11-21 CVE-2023-5598 Dassault Cross-site Scripting vulnerability in Dassault products

Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allow an attacker to execute arbitrary script code.

5.4
2023-11-21 CVE-2023-5599 Dassault Cross-site Scripting vulnerability in Dassault products

A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.

5.4
2023-11-21 CVE-2023-46935 Eyoucms Cross-site Scripting vulnerability in Eyoucms 1.6.4

eyoucms v1.6.4 is vulnerable Cross Site Scripting (XSS), which can lead to stealing sensitive information of logged-in users.

5.4
2023-11-21 CVE-2023-6142 Armanidrisi Cross-site Scripting vulnerability in Armanidrisi DEV Blog 1.0

Dev blog v1.0 allows to exploit an XSS through an unrestricted file upload, together with a bad entropy of filenames.

5.4
2023-11-20 CVE-2023-46470 Spaceapplications Cross-site Scripting vulnerability in Spaceapplications Yacms 5.8.6

Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via crafted telecommand in the timeline view of the ArchiveBrowser.

5.4
2023-11-20 CVE-2023-46471 Spaceapplications Cross-site Scripting vulnerability in Spaceapplications Yacms 5.8.6

Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via the text variable scriptContainer of the ScriptViewer.

5.4
2023-11-20 CVE-2023-48300 Epiph Cross-site Scripting vulnerability in Epiph Embed Privacy

The `Embed Privacy` plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored Cross-Site Scripting via `embed_privacy_opt_out` shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes.

5.4
2023-11-20 CVE-2023-4799 Wpembedfb Cross-site Scripting vulnerability in Wpembedfb Magic Embeds

The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

5.4
2023-11-20 CVE-2023-5509 Premio Incorrect Authorization vulnerability in Premio Mystickymenu

The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions.

5.4
2023-11-20 CVE-2023-5610 S Sols Open Redirect vulnerability in S-Sols Seraphinite Accelerator

The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user to, leading to an arbitrary redirect

5.4
2023-11-20 CVE-2023-5651 Thimpress Incorrect Permission Assignment for Critical Resource vulnerability in Thimpress WP Hotel Booking

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated users, such as subscriber to delete arbitrary posts

5.4
2023-11-20 CVE-2023-5799 Thimpress Incorrect Authorization vulnerability in Thimpress WP Hotel Booking

The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete posts that do no belong to them

5.4
2023-11-20 CVE-2023-47772 Themepunch Unspecified vulnerability in Themepunch Slider Revolution 3.0.95/4.1.4/4.2.2

Contributor+ Stored Cross-Site Scripting (XSS) vulnerability in Slider Revolution <= 6.6.14.

5.4
2023-11-20 CVE-2023-6197 Myaudiomerchant Cross-Site Request Forgery (CSRF) vulnerability in Myaudiomerchant Audio Merchant

The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4.

5.4
2023-11-22 CVE-2023-6264 Devolutions Information Exposure vulnerability in Devolutions Server

Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configured Devolutions Gateways endpoints.

5.3
2023-11-22 CVE-2023-2448 Userproplugin Missing Authorization vulnerability in Userproplugin Userpro

The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userpro_shortcode_template' function in versions up to, and including, 5.1.4.

5.3
2023-11-22 CVE-2023-6189 M Files Unspecified vulnerability in M-Files Server

Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API methods.

5.3
2023-11-22 CVE-2023-41145 Autodesk Unspecified vulnerability in Autodesk Customer Portal

Autodesk users who no longer have an active license for an account can still access cases for that account.

5.3
2023-11-22 CVE-2023-47392 Mercedes Benz Unspecified vulnerability in Mercedes-Benz Mercedes ME

An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the carts of other users via sending a crafted add order request.

5.3
2023-11-22 CVE-2023-47393 Mercedes Benz Unspecified vulnerability in Mercedes-Benz Mercedes ME

An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the maintenance orders of other users and access sensitive user information via unspecified vectors.

5.3
2023-11-21 CVE-2023-48299 Pytorch Unspecified vulnerability in Pytorch Torchserve

TorchServe is a tool for serving and scaling PyTorch models in production.

5.3
2023-11-21 CVE-2023-47643 Salesagility Unspecified vulnerability in Salesagility Suitecrm 8.4.1

SuiteCRM is a Customer Relationship Management (CRM) software application.

5.3
2023-11-20 CVE-2023-48309 Nextauth JS Incorrect Authorization vulnerability in Nextauth.Js Next-Auth

NextAuth.js provides authentication for Next.js.

5.3
2023-11-20 CVE-2023-48218 Strapi Incorrect Authorization vulnerability in Strapi Protected Populate

The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information.

5.3
2023-11-20 CVE-2023-3379 Wago Incorrect Authorization vulnerability in Wago products

Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges.

5.3
2023-11-23 CVE-2021-39008 IBM Unspecified vulnerability in IBM Qradar Wincollect 10.0/10.0.1/10.1.6

IBM QRadar WinCollect Agent 10.0 through 10.1.7 could allow a privileged user to obtain sensitive information due to missing best practices.

4.9
2023-11-23 CVE-2023-47833 Slimndap Cross-site Scripting vulnerability in Slimndap Theater for Wordpress

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress plugin <= 0.18.3 versions.

4.8
2023-11-22 CVE-2023-47829 Codez Cross-site Scripting vulnerability in Codez Quick Call Button

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codez Quick Call Button plugin <= 1.2.9 versions.

4.8
2023-11-22 CVE-2023-47759 Premio Cross-site Scripting vulnerability in Premio Chaty

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Chaty plugin <= 3.1.2 versions.

4.8
2023-11-22 CVE-2023-4726 Davidvongries Cross-site Scripting vulnerability in Davidvongries Ultimate Dashboard

The Ultimate Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.7.7.

4.8
2023-11-22 CVE-2023-5715 Plerdy Cross-site Scripting vulnerability in Plerdy Heatmap

The Website Optimization – Plerdy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tracking code settings in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping.

4.8
2023-11-22 CVE-2023-6164 Mainwp Cross-site Scripting vulnerability in Mainwp

The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitization.

4.8
2023-11-21 CVE-2023-20208 Cisco Cross-site Scripting vulnerability in Cisco Identity Services Engine 3.0.0/3.1/3.2

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based management interface of an affected device.

4.8
2023-11-21 CVE-2023-6144 Armanidrisi Authorization Bypass Through User-Controlled Key vulnerability in Armanidrisi DEV Blog 1.0

Dev blog v1.0 allows to exploit an account takeover through the "user" cookie.

4.8
2023-11-20 CVE-2023-4808 Allurewebsolutions Cross-site Scripting vulnerability in Allurewebsolutions WP Post Popup

The WP Post Popup WordPress plugin through 3.7.3 does not sanitise and escape some of its inputs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

4.8
2023-11-20 CVE-2023-4970 Pubydoc Cross-site Scripting vulnerability in Pubydoc

The PubyDoc WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

4.8
2023-11-20 CVE-2023-5119 Incsub Cross-site Scripting vulnerability in Incsub Forminator

The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).

4.8
2023-11-20 CVE-2023-5343 AYS PRO Cross-site Scripting vulnerability in Ays-Pro Popup BOX

The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

4.8
2023-11-22 CVE-2023-48706 VIM Use After Free vulnerability in VIM

Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability.

4.7
2023-11-22 CVE-2023-20084 Cisco Unspecified vulnerability in Cisco Secure Endpoint and Secure Endpoint Private Cloud

A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpoint protection within a limited time window.

4.4
2023-11-21 CVE-2023-48305 Nextcloud Cleartext Storage of Sensitive Information vulnerability in Nextcloud Server

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.

4.4
2023-11-22 CVE-2023-4686 Gowebsolutions Unspecified vulnerability in Gowebsolutions WP Customer Reviews

The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the ajax_enabled_posts function.

4.3
2023-11-22 CVE-2023-5314 Wpvnteam Unspecified vulnerability in Wpvnteam WP Extra

The WP EXtra plugin for WordPress is vulnerable to unauthorized access to restricted functionality due to a missing capability check on the 'test-email' section of the register() function in versions up to, and including, 6.2.

4.3
2023-11-22 CVE-2023-5382 Funnelforms Cross-Site Request Forgery (CSRF) vulnerability in Funnelforms

The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.

4.3
2023-11-22 CVE-2023-5383 Funnelforms Cross-Site Request Forgery (CSRF) vulnerability in Funnelforms

The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.

4.3
2023-11-22 CVE-2023-5385 Funnelforms Missing Authorization vulnerability in Funnelforms

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_copy_posts function in versions up to, and including, 3.4.

4.3
2023-11-22 CVE-2023-5386 Funnelforms Missing Authorization vulnerability in Funnelforms

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts function in versions up to, and including, 3.4.

4.3
2023-11-22 CVE-2023-5387 Funnelforms Missing Authorization vulnerability in Funnelforms

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_trigger_dark_mode function in versions up to, and including, 3.4.

4.3
2023-11-22 CVE-2023-5411 Funnelforms Missing Authorization vulnerability in Funnelforms

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_save_post function in versions up to, and including, 3.4.

4.3
2023-11-22 CVE-2023-5415 Funnelforms Missing Authorization vulnerability in Funnelforms

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_add_category function in versions up to, and including, 3.4.

4.3
2023-11-22 CVE-2023-5416 Funnelforms Missing Authorization vulnerability in Funnelforms

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_category function in versions up to, and including, 3.4.

4.3
2023-11-22 CVE-2023-5417 Funnelforms Missing Authorization vulnerability in Funnelforms

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_update_category function in versions up to, and including, 3.4.

4.3
2023-11-22 CVE-2023-5419 Funnelforms Missing Authorization vulnerability in Funnelforms

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_test_mail function in versions up to, and including, 3.4.

4.3
2023-11-22 CVE-2023-5537 Joselazo Cross-Site Request Forgery (CSRF) vulnerability in Joselazo Delete Usermeta

The Delete Usermeta plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2.

4.3
2023-11-22 CVE-2023-6008 Userproplugin Cross-Site Request Forgery (CSRF) vulnerability in Userproplugin Userpro

The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1.

4.3
2023-11-22 CVE-2023-41146 Autodesk Unspecified vulnerability in Autodesk Customer Portal

Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on the same account.

4.3
2023-11-22 CVE-2021-22143 Elastic Information Exposure Through Log Files vulnerability in Elastic APM .Net Agent

The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error.

4.3
2023-11-22 CVE-2021-22151 Elastic Path Traversal vulnerability in Elastic Kibana

It was discovered that Kibana was not validating a user supplied path, which would load .pbf files.

4.3
2023-11-21 CVE-2023-48304 Nextcloud Authorization Bypass Through User-Controlled Key vulnerability in Nextcloud Server

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.

4.3

5 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2023-11-24 CVE-2023-48711 Cjvnjde Server-Side Request Forgery (SSRF) vulnerability in Cjvnjde Google Translate API Browser

google-translate-api-browser is an npm package which interfaces with the google translate web api.

3.7
2023-11-24 CVE-2023-6251 Checkmk Cross-Site Request Forgery (CSRF) vulnerability in Checkmk 2.0.0/2.1.0/2.2.0

Cross-site Request Forgery (CSRF) in Checkmk < 2.2.0p15, < 2.1.0p37, <= 2.0.0p39 allow an authenticated attacker to delete user-messages for individual users.

3.5
2023-11-21 CVE-2023-48226 Openreplay Code Injection vulnerability in Openreplay

OpenReplay is a self-hosted session replay suite.

3.5
2023-11-22 CVE-2023-43081 Dell Incorrect Default Permissions vulnerability in Dell Powerprotect Agent for File System

PowerProtect Agent for File System Version 19.14 and prior, contains an incorrect default permissions vulnerability in ddfscon component.

3.3
2023-11-21 CVE-2023-48303 Nextcloud Unspecified vulnerability in Nextcloud Server

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.

2.7