Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-43710 | 1 Gxsoftware | 1 Xperiencentral | 2023-08-04 | N/A | 8.8 HIGH |
| Interactive Forms (IAF) in GX Software XperienCentral versions 10.31.0 until 10.33.0 was vulnerable to cross site request forgery (CSRF) because the unique token could be deduced using the names of all input fields. | |||||
| CVE-2021-31680 | 1 Ultralytics | 1 Yolov5 | 2023-08-04 | N/A | 7.8 HIGH |
| Deserialization of Untrusted Data vulnerability in yolo 5 allows attackers to execute arbitrary code via crafted yaml file. | |||||
| CVE-2021-31681 | 1 Ultralytics | 1 Yolov3 | 2023-08-04 | N/A | 7.8 HIGH |
| Deserialization of Untrusted Data vulnerability in yolo 3 allows attackers to execute arbitrary code via crafted yaml file. | |||||
| CVE-2023-37647 | 1 Sem-cms | 1 Semcms | 2023-08-04 | N/A | 9.8 CRITICAL |
| SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php. | |||||
| CVE-2022-43713 | 1 Gxsoftware | 1 Xperiencentral | 2023-08-04 | N/A | 7.5 HIGH |
| Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form validation could be bypassed. | |||||
| CVE-2023-33534 | 1 Sztozed | 2 Zlt S10g, Zlt S10g Firmware | 2023-08-04 | N/A | 8.8 HIGH |
| A Cross-Site Request Forgery (CSRF) in Guanzhou Tozed Kangwei Intelligent Technology ZLTS10G software version S10G_3.11.6 allows attackers to takeover user accounts via sending a crafted POST request to /goform/goform_set_cmd_process. | |||||
| CVE-2022-43711 | 1 Gxsoftware | 1 Xperiencentral | 2023-08-04 | N/A | 6.1 MEDIUM |
| Interactive Forms (IAF) in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scripting attacks (XSS) because the CSP header uses eval() in the script-src. | |||||
| CVE-2023-3242 | 1 Br-automation | 1 Automation Runtime | 2023-08-04 | N/A | 5.9 MEDIUM |
| Allocation of Resources Without Limits or Throttling, Improper Initialization vulnerability in B&R Industrial Automation B&R Automation Runtime allows Flooding, Leveraging Race Conditions.This issue affects B&R Automation Runtime: <G4.93. | |||||
| CVE-2023-30949 | 1 Palantir | 1 Slate | 2023-08-04 | N/A | 5.3 MEDIUM |
| A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks. | |||||
| CVE-2023-30367 | 1 Mremoteng | 1 Mremoteng | 2023-08-04 | N/A | 7.5 HIGH |
| Multi-Remote Next Generation Connection Manager (mRemoteNG) is free software that enables users to store and manage multi-protocol connection configurations to remotely connect to systems. mRemoteNG configuration files can be stored in an encrypted state on disk. mRemoteNG version <= v1.76.20 and <= 1.77.3-dev loads configuration files in plain text into memory (after decrypting them if necessary) at application start-up, even if no connection has been established yet. This allows attackers to access contents of configuration files in plain text through a memory dump and thus compromise user credentials when no custom password encryption key has been set. This also bypasses the connection configuration file encryption setting by dumping already decrypted configurations from memory. | |||||
| CVE-2023-36090 | 1 Dlink | 2 Dir-885l, Dir-885l Firmware | 2023-08-04 | N/A | 9.8 CRITICAL |
| ** UNSUPPORTED WHEN ASSIGNED ** Authentication Bypass vulnerability in D-Link DIR-885L FW102b01 allows remote attackers to gain escalated privileges via phpcgi. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | |||||
| CVE-2023-36089 | 1 Dlink | 2 Dir-645, Dir-645 Firmware | 2023-08-04 | N/A | 9.8 CRITICAL |
| ** UNSUPPORTED WHEN ASSIGNED ** Authentication Bypass vulnerability in D-Link DIR-645 firmware version 1.03 allows remote attackers to gain escalated privileges via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | |||||
| CVE-2023-36092 | 1 Dlink | 2 Dir-859, Dir-859 Firmware | 2023-08-04 | N/A | 9.8 CRITICAL |
| ** UNSUPPORTED WHEN ASSIGNED ** Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | |||||
| CVE-2023-36091 | 1 Dlink | 2 Dir-895l, Dir-895l Firmware | 2023-08-04 | N/A | 9.8 CRITICAL |
| ** UNSUPPORTED WHEN ASSIGNED ** Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | |||||
| CVE-2020-36763 | 1 Duxcms Project | 1 Duxcms | 2023-08-04 | N/A | 5.4 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run arbitrary code via the content, time, copyfrom parameters when adding or editing a post. | |||||
| CVE-2023-34916 | 1 Cms Project | 1 Cms | 2023-08-04 | N/A | 6.1 MEDIUM |
| Fuge CMS v1.0 contains an Open Redirect vulnerability via /front/ProcessAct.java. | |||||
| CVE-2023-34917 | 1 Cms Project | 1 Cms | 2023-08-04 | N/A | 6.1 MEDIUM |
| Fuge CMS v1.0 contains an Open Redirect vulnerability in member/RegisterAct.java. | |||||
| CVE-2023-38306 | 1 Webmin | 1 Webmin | 2023-08-04 | N/A | 6.1 MEDIUM |
| An issue was discovered in Webmin 2.021. A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file upload functionality. Normally, the application restricts the upload of certain file types such as .svg, .php, etc., and displays an error message if a prohibited file type is detected. However, by following certain steps, an attacker can bypass these restrictions and inject malicious code. | |||||
| CVE-2023-38305 | 1 Webmin | 1 Webmin | 2023-08-04 | N/A | 6.1 MEDIUM |
| An issue was discovered in Webmin 2.021. The download functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a crafted download path containing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when the download link is accessed. | |||||
| CVE-2023-38310 | 1 Webmin | 1 Webmin | 2023-08-04 | N/A | 5.4 MEDIUM |
| An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the configuration settings of the system logs functionality. The vulnerability allows an attacker to store an XSS payload in the configuration settings of specific log files. This results in the execution of that payload whenever the affected log files are accessed. | |||||
| CVE-2023-38309 | 1 Webmin | 1 Webmin | 2023-08-04 | N/A | 6.1 MEDIUM |
| An issue was discovered in Webmin 2.021. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the package search functionality. The vulnerability allows an attacker to inject a malicious payload in the "Search for Package" field, which gets reflected back in the application's response, leading to the execution of arbitrary JavaScript code within the context of the victim's browser. | |||||
| CVE-2023-38308 | 1 Webmin | 1 Webmin | 2023-08-04 | N/A | 6.1 MEDIUM |
| An issue was discovered in Webmin 2.021. A Cross-Site Scripting (XSS) vulnerability was discovered in the HTTP Tunnel functionality when handling third-party domain URLs. By providing a crafted URL from a third-party domain, an attacker can inject malicious code. leading to the execution of arbitrary JavaScript code within the context of the victim's browser. | |||||
| CVE-2023-38307 | 1 Webmin | 1 Webmin | 2023-08-04 | N/A | 5.4 MEDIUM |
| An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality. The vulnerability occurs when an authenticated user adds a new user and inserts an XSS payload into the user's real name. | |||||
| CVE-2023-38311 | 1 Webmin | 1 Webmin | 2023-08-04 | N/A | 5.4 MEDIUM |
| An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the System Logs Viewer functionality. The vulnerability allows an attacker to store a malicious payload in the configuration field, triggering the execution of the payload when saving the configuration or when accessing the System Logs Viewer page. | |||||
| CVE-2022-39987 | 1 Raspap | 1 Raspap | 2023-08-04 | N/A | 8.8 HIGH |
| A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the "entity" POST parameters in /ajax/networking/get_wgkey.php. | |||||
| CVE-2023-33560 | 1 Phpjabbers | 1 Time Slots Booking Calendar | 2023-08-04 | N/A | 6.1 MEDIUM |
| There is a Cross Site Scripting (XSS) vulnerability in "cid" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3. | |||||
| CVE-2023-38304 | 1 Webmin | 1 Webmin | 2023-08-04 | N/A | 5.4 MEDIUM |
| An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality, allowing an attacker to store a malicious payload in the Group Name field when creating a new group. | |||||
| CVE-2023-38303 | 1 Webmin | 1 Webmin | 2023-08-04 | N/A | 5.4 MEDIUM |
| An issue was discovered in Webmin 2.021. One can exploit a stored Cross-Site Scripting (XSS) attack to achieve Remote Command Execution (RCE) through the Users and Group's real name parameter. | |||||
| CVE-2023-33564 | 1 Phpjabbers | 1 Time Slots Booking Calendar | 2023-08-04 | N/A | 6.1 MEDIUM |
| There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3. | |||||
| CVE-2023-33563 | 1 Phpjabbers | 1 Time Slots Booking Calendar | 2023-08-04 | N/A | 8.8 HIGH |
| In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts. | |||||
| CVE-2023-38989 | 1 Jeesite | 1 Jeesite | 2023-08-04 | N/A | 4.3 MEDIUM |
| An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information. | |||||
| CVE-2023-35792 | 1 Vound-software | 1 Intella Connect | 2023-08-04 | N/A | 6.1 MEDIUM |
| Vound Intella Connect 2.6.0.3 is vulnerable to stored Cross-site Scripting (XSS). | |||||
| CVE-2023-35791 | 1 Vound-software | 1 Intella Connect | 2023-08-04 | N/A | 6.1 MEDIUM |
| Vound Intella Connect 2.6.0.3 has an Open Redirect vulnerability. | |||||
| CVE-2023-36211 | 1 Cubiclesoft | 1 Barebones Cms | 2023-08-04 | N/A | 5.4 MEDIUM |
| The Barebones CMS v2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with certain features on the admin panel. | |||||
| CVE-2023-36984 | 1 Lavalite | 1 Lavalite | 2023-08-04 | N/A | 7.5 HIGH |
| LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. | |||||
| CVE-2023-36983 | 1 Lavalite | 1 Lavalite | 2023-08-04 | N/A | 7.5 HIGH |
| LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. | |||||
| CVE-2023-3130 | 1 Kaizencoders | 1 Short Url | 2023-08-03 | N/A | 4.8 MEDIUM |
| The Short URL WordPress plugin before 1.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2023-37213 | 1 Synel | 2 Synergy\/a, Synergy\/a Firmware | 2023-08-03 | N/A | 9.8 CRITICAL |
| Synel SYnergy Fingerprint Terminals - CWE-78: 'OS Command Injection' | |||||
| CVE-2023-3134 | 1 Incsub | 1 Forminator | 2023-08-03 | N/A | 6.1 MEDIUM |
| The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks. | |||||
| CVE-2023-32227 | 1 Synel | 2 Synergy\/a, Synergy\/a Firmware | 2023-08-03 | N/A | 9.8 CRITICAL |
| Synel SYnergy Fingerprint Terminals - CWE-798: Use of Hard-coded Credentials | |||||
| CVE-2023-32226 | 1 Sysaid | 1 Sysaid On-premises | 2023-08-03 | N/A | 6.5 MEDIUM |
| Sysaid - CWE-552: Files or Directories Accessible to External Parties - Authenticated users may exfiltrate files from the server via an unspecified method. | |||||
| CVE-2023-32225 | 1 Sysaid | 1 Sysaid On-premises | 2023-08-03 | N/A | 7.2 HIGH |
| Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method. | |||||
| CVE-2023-4005 | 1 Fossbilling | 1 Fossbilling | 2023-08-03 | N/A | 9.8 CRITICAL |
| Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5. | |||||
| CVE-2023-4006 | 1 Phpmyfaq | 1 Phpmyfaq | 2023-08-03 | N/A | 9.8 CRITICAL |
| Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16. | |||||
| CVE-2023-0602 | 1 Johnniejodelljr | 1 Twittee Text Tweet | 2023-08-03 | N/A | 6.1 MEDIUM |
| The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen. | |||||
| CVE-2023-3345 | 1 Masteriyo | 1 Masteriyo | 2023-08-03 | N/A | 6.5 MEDIUM |
| The LMS by Masteriyo WordPress plugin before 1.6.8 does not properly safeguards sensitive user information, like other user's email addresses, making it possible for any students to leak them via some of the plugin's REST API endpoints. | |||||
| CVE-2022-43831 | 1 Ibm | 1 Spectrum Scale Container Native Storage Access | 2023-08-03 | N/A | 7.8 HIGH |
| IBM Storage Scale Container Native Storage Access 5.1.2.1 through 5.1.6.1 could allow a local user to obtain escalated privileges on a host without proper security context settings configured. IBM X-Force ID: 238941. | |||||
| CVE-2020-21662 | 1 Yunyecms | 1 Yunyecms | 2023-08-03 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in yunyecms 2.0.2 allows remote attackers to run arbitrary SQL commands via XFF. | |||||
| CVE-2021-31651 | 1 Neofr | 1 Neofrag | 2023-08-03 | N/A | 4.8 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in neofarg-cms 0.2.3 allows remoate attacker to run arbitrary code via the copyright field in copyright settings. | |||||
| CVE-2023-3507 | 1 Woocommerce | 1 Woocommerce Pre-orders | 2023-08-03 | N/A | 6.5 MEDIUM |
| The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admins cancel arbitrary pre-orders via a CSRF attack | |||||