Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-26270 | 1 Ibm | 1 Guardium Cloud Key Manager | 2023-08-29 | N/A | 9.8 CRITICAL |
| IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to execute arbitrary code on the system, caused by an angular template injection flaw. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 248119. | |||||
| CVE-2023-4556 | 1 Online Graduate Tracer System Project | 1 Online Graduate Tracer System | 2023-08-29 | N/A | 9.8 CRITICAL |
| A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. Affected by this issue is the function mysqli_query of the file sexit.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-238154 is the identifier assigned to this vulnerability. | |||||
| CVE-2022-43904 | 1 Ibm | 1 Security Guardium | 2023-08-29 | N/A | 7.5 HIGH |
| IBM Security Guardium 11.3 and 11.4 could disclose sensitive information to an attacker due to improper restriction of excessive authentication attempts. IBM X-Force ID: 240895. | |||||
| CVE-2022-43907 | 1 Ibm | 1 Security Guardium | 2023-08-29 | N/A | 8.8 HIGH |
| IBM Security Guardium 11.4 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 240901. | |||||
| CVE-2023-23473 | 1 Ibm | 1 Infosphere Information Server | 2023-08-29 | N/A | 8.8 HIGH |
| IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 245400. | |||||
| CVE-2023-24959 | 1 Ibm | 1 Infosphere Information Server | 2023-08-29 | N/A | 7.5 HIGH |
| IBM InfoSphere Information Systems 11.7 could expose information about the host system and environment configuration. IBM X-Force ID: 246332. | |||||
| CVE-2023-30435 | 1 Ibm | 1 Security Guardium | 2023-08-29 | N/A | 5.4 MEDIUM |
| IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 252291. | |||||
| CVE-2022-43909 | 1 Ibm | 1 Security Guardium | 2023-08-29 | N/A | 5.4 MEDIUM |
| IBM Security Guardium 11.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 240905. | |||||
| CVE-2023-33852 | 1 Ibm | 1 Security Guardium | 2023-08-29 | N/A | 5.4 MEDIUM |
| IBM Security Guardium 11.4 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 257614. | |||||
| CVE-2023-30437 | 1 Ibm | 1 Security Guardium | 2023-08-29 | N/A | 5.3 MEDIUM |
| IBM Security Guardium 11.3, 11.4, and 11.5 could allow an unauthorized user to enumerate usernames by sending a specially crafted HTTP request. IBM X-Force ID: 252293. | |||||
| CVE-2023-30436 | 1 Ibm | 1 Security Guardium | 2023-08-29 | N/A | 5.4 MEDIUM |
| IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 252292. | |||||
| CVE-2023-4558 | 1 Inventory Management System Project | 1 Inventory Management System | 2023-08-29 | N/A | 9.8 CRITICAL |
| A vulnerability classified as critical was found in SourceCodester Inventory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file staff_data.php. The manipulation of the argument columns[0][data] leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238159. | |||||
| CVE-2023-4557 | 1 Inventory Management System Project | 1 Inventory Management System | 2023-08-29 | N/A | 9.8 CRITICAL |
| A vulnerability classified as critical has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file app/ajax/search_purchase_paymen_report.php. The manipulation of the argument customer leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-238158 is the identifier assigned to this vulnerability. | |||||
| CVE-2023-38730 | 1 Ibm | 1 Storage Copy Data Management | 2023-08-29 | N/A | 7.5 HIGH |
| IBM Storage Copy Data Management 2.2.0.0 through 2.2.19.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 262268. | |||||
| CVE-2023-41104 | 1 Varnish-software | 2 Varnish Enterprise, Vmod Digest | 2023-08-28 | N/A | 6.5 MEDIUM |
| libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading to both authentication bypass and information disclosure; however, the exact attack surface will depend on the particular VCL (Varnish Configuration Language) configuration in use. | |||||
| CVE-2023-41100 | 1 Hcaptcha For Ext\ | 1 Form Project | 2023-08-28 | N/A | 5.3 MEDIUM |
| An issue was discovered in the hcaptcha (aka hCaptcha for EXT:form) extension before 2.1.2 for TYPO3. It fails to check that the required captcha field is submitted in the form data. allowing a remote user to bypass the CAPTCHA check. | |||||
| CVE-2023-32119 | 1 Wpo365 | 1 Mail Integration For Office 365 \/ Outlook | 2023-08-28 | N/A | 6.1 MEDIUM |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPO365 | Mail Integration for Office 365 / Outlook plugin <= 1.9.0 versions. | |||||
| CVE-2023-41098 | 1 Misp | 1 Misp | 2023-08-28 | N/A | 6.1 MEDIUM |
| An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard edit. | |||||
| CVE-2020-21699 | 1 Alibaba | 1 Tengine | 2023-08-28 | N/A | 7.5 HIGH |
| The web server Tengine 2.2.2 developed in the Nginx version from 0.5.6 thru 1.13.2 is vulnerable to an integer overflow vulnerability in the nginx range filter module, resulting in the leakage of potentially sensitive information triggered by specially crafted requests. | |||||
| CVE-2023-3699 | 1 Asustor | 1 Data Master | 2023-08-28 | N/A | 5.5 MEDIUM |
| An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configuration. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below. | |||||
| CVE-2023-4404 | 1 Wpcharitable | 1 Charitable | 2023-08-28 | N/A | 9.8 CRITICAL |
| The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This makes it possible for unauthenticated attackers to specify their user role by supplying the 'role' parameter during a registration. | |||||
| CVE-2022-48545 | 1 Xpdfreader | 1 Xpdf | 2023-08-28 | N/A | 5.5 MEDIUM |
| An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02. | |||||
| CVE-2023-4475 | 1 Asustor | 1 Data Master | 2023-08-28 | N/A | 5.5 MEDIUM |
| An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master (ADM) allows an attacker to exploit the file renaming feature to move files to unintended directories. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below. | |||||
| CVE-2020-24113 | 1 Yealink | 2 W60b, W60b Firmware | 2023-08-28 | N/A | 9.1 CRITICAL |
| Directory Traversal vulnerability in Contacts File Upload Interface in Yealink W60B version 77.83.0.85, allows attackers to gain sensitive information and cause a denial of service (DoS). | |||||
| CVE-2022-48538 | 1 Cacti | 1 Cacti | 2023-08-28 | N/A | 5.3 MEDIUM |
| In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a zero as the password. | |||||
| CVE-2023-4427 | 1 Google | 1 Chrome | 2023-08-28 | N/A | 8.1 HIGH |
| Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2023-33850 | 4 Hp, Ibm, Linux and 1 more | 6 Hp-ux, Aix, Cics Tx and 3 more | 2023-08-28 | N/A | 7.5 HIGH |
| IBM GSKit-Crypto could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 257132. | |||||
| CVE-2023-38666 | 1 Axiosys | 1 Bento4 | 2023-08-28 | N/A | 5.5 MEDIUM |
| Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4encrypt. | |||||
| CVE-2023-38667 | 1 Nasm | 1 Netwide Assembler | 2023-08-28 | N/A | 5.5 MEDIUM |
| Stack-based buffer over-read in function disasm in nasm 2.16 allows attackers to cause a denial of service. | |||||
| CVE-2023-38668 | 1 Nasm | 1 Netwide Assembler | 2023-08-28 | N/A | 5.5 MEDIUM |
| Stack-based buffer over-read in disasm in nasm 2.16 allows attackers to cause a denial of service (crash). | |||||
| CVE-2023-39810 | 2023-08-28 | N/A | N/A | ||
| An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal. | |||||
| CVE-2023-39562 | 2023-08-28 | N/A | N/A | ||
| GPAC v2.3-DEV-rev449-g5948e4f70-master was discovered to contain a heap-use-after-free via the gf_bs_align function at bitstream.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted file. | |||||
| CVE-2023-40590 | 2023-08-28 | N/A | N/A | ||
| GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user's `PATH`. This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren't affected by this. But probably people using GitPython usually run it from the CWD of a repo. An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands. There is no fix currently available for windows users, however there are a few mitigations. 1: Default to an absolute path for the git program on Windows, like `C:\\Program Files\\Git\\cmd\\git.EXE` (default git path installation). 2: Require users to set the `GIT_PYTHON_GIT_EXECUTABLE` environment variable on Windows systems. 3: Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the `GIT_PYTHON_GIT_EXECUTABLE` env var to an absolute path. 4: Resolve the executable manually by only looking into the `PATH` environment variable. | |||||
| CVE-2023-1997 | 2023-08-28 | N/A | N/A | ||
| An OS Command Injection vulnerability exists in SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x. A specially crafted HTTP request can lead to arbitrary command execution. | |||||
| CVE-2018-25089 | 2023-08-28 | N/A | N/A | ||
| A vulnerability was found in glb Meetup Tag Extension 0.1 on MediaWiki. It has been rated as problematic. This issue affects some unknown processing of the component Link Attribute Handler. The manipulation leads to use of web link to untrusted target with window.opener access. Upgrading to version 0.2 is able to address this issue. The identifier of the patch is 850c726d6bbfe0bf270801fbb92a30babea4155c. It is recommended to upgrade the affected component. The identifier VDB-238157 was assigned to this vulnerability. | |||||
| CVE-2017-20186 | 2023-08-28 | N/A | N/A | ||
| ** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in nikooo777 ckSurf up to 1.19.2. It has been declared as problematic. This vulnerability affects the function SpecListMenuDead of the file csgo/addons/sourcemod/scripting/ckSurf/misc.sp of the component Spectator List Name Handler. The manipulation of the argument cleanName leads to denial of service. Upgrading to version 1.21.0 is able to address this issue. The name of the patch is fd6318d99083a06363091441a0614bd2f21068e6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-238156. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | |||||
| CVE-2023-38996 | 1 Douran | 1 Dsgate | 2023-08-28 | N/A | 6.7 MEDIUM |
| An issue in all versions of Douran DSGate allows a local authenticated privileged attacker to execute arbitrary code via the debug command. | |||||
| CVE-2023-39141 | 1 Ziahamza | 1 Webui-aria2 | 2023-08-28 | N/A | 7.5 HIGH |
| webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability. | |||||
| CVE-2023-39599 | 1 Cszcms | 1 Csz Cms | 2023-08-28 | N/A | 5.4 MEDIUM |
| Cross-Site Scripting (XSS) vulnerability in CSZ CMS v.1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Social Settings parameter. | |||||
| CVE-2022-48522 | 1 Perl | 1 Perl | 2023-08-28 | N/A | 9.8 CRITICAL |
| In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation. | |||||
| CVE-2022-48174 | 1 Busybox | 1 Busybox | 2023-08-28 | N/A | 9.8 CRITICAL |
| There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. | |||||
| CVE-2022-47022 | 1 Open-mpi | 1 Hwloc | 2023-08-28 | N/A | 9.8 CRITICAL |
| An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c. | |||||
| CVE-2022-38349 | 1 Freedesktop | 1 Poppler | 2023-08-28 | N/A | 6.5 MEDIUM |
| An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file. | |||||
| CVE-2022-44215 | 1 Southrivertech | 1 Titan Ftp Server | 2023-08-28 | N/A | 6.1 MEDIUM |
| There is an open redirect vulnerability in Titan FTP server 19.0 and below. Users are redirected to any target URL. | |||||
| CVE-2021-46310 | 1 Djvulibre Project | 1 Djvulibre | 2023-08-28 | N/A | 6.5 MEDIUM |
| An issue was discovered IW44Image.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero. | |||||
| CVE-2021-46312 | 1 Djvulibre Project | 1 Djvulibre | 2023-08-28 | N/A | 6.5 MEDIUM |
| An issue was discovered IW44EncodeCodec.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero. | |||||
| CVE-2021-40263 | 1 Freeimage Project | 1 Freeimage | 2023-08-28 | N/A | 8.8 HIGH |
| A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad function in PluginTIFF.cpp. | |||||
| CVE-2021-35309 | 1 Samsung | 1 Syncthru Web Service | 2023-08-28 | N/A | 7.5 HIGH |
| An issue discovered in Samsung SyncThru Web Service SPL 5.93 06-09-2014 allows attackers to gain escalated privileges via MITM attacks. | |||||
| CVE-2021-34193 | 1 Opensc Project | 1 Opensc | 2023-08-28 | N/A | 7.5 HIGH |
| Stack overflow vulnerability in OpenSC smart card middleware before 0.23 via crafted responses to APDUs. | |||||
| CVE-2020-26683 | 1 Artifex | 1 Mupdf | 2023-08-28 | N/A | 5.5 MEDIUM |
| A memory leak issue discovered in /pdf/pdf-font-add.c in Artifex Software MuPDF 1.17.0 allows attackers to obtain sensitive information. | |||||