CVE-2022-47191

Privilege Escalation via file upload vulnerability at Generex CS141

Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a file with modified permissions, allowing him to escalate privileges.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Generex

Products

Cs141 Cs141 Firmware

CVE-2022-47192

Admin password reset via file upload vulnerability in Generex CS141

Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a backup file containing a modified "users.json" to the web server of the device, allowing him to replace the administrator password.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Generex

Products

Cs141 Cs141 Firmware

CVE-2023-1753

Weak Password Requirements in thorsten/phpmyfaq

Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Phpmyfaq

Products

Phpmyfaq

CVE-2023-1754

Improper Neutralization of Input During Web Page Generation in thorsten/phpmyfaq

Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Phpmyfaq

Products

Phpmyfaq

CVE-2023-1755

Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq

Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Phpmyfaq

Products

Phpmyfaq

CVE-2025-21161

Substance3D - Designer | Out-of-bounds Write (CWE-787)

Substance3D - Designer versions 14.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Substance 3d Designer

CVE-2023-28647

App pin of the iOS app can be bypassed in Nextcloud iOS

Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain access to a users files. It is recommended that the Nextcloud iOS app is upgraded to 4.7.0. There are no known workarounds for this vulnerability.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Nextcloud

CVE-2023-28646

App lockout in nextcloud Android app can be bypassed via thirdparty apps

Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a thirdparty app. This allows to see meta information like sharer, sharees and activity of files. It is recommended that the Nextcloud Android app is upgraded to 3.24.1. There are no known workarounds for this vulnerability.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Nextcloud

CVE-2023-26482

Scope of workflow operations is not validated in nextcloud server

Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defined scripts, in order to generate PDFs, invoking webhooks or running scripts on the server. Due to this combination depending on the available apps the issue can result in a RCE at the end. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. Users unable to upgrade should disable app `workflow_scripts` and `workflow_pdf_converter` as a mitigation.

CVSS 3.1 · 9.1 Critical EPSS 4.2% KEV · Not listed

Vendors

Nextcloud

Products

Nextcloud Server

CVE-2023-28643

Potential share collision for recipients when caching is enabled in nextcloud server

Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will replace the first one instead of being renamed to `{name} (2)`. It is recommended that the Nextcloud Server is upgraded to 25.0.3 or 24.0.9. Users unable to upgrade should avoid sharing 2 folders with the same name to the same user.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Nextcloud Server

CVE-2023-28644

Reference fetch can saturate the server bandwidth for 10 seconds in nextcloud server

Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server performances and/or can lead to a denial of service. This issue has been addressed and it is recommended that the Nextcloud Server is upgraded to 25.0.3. There are no known workarounds for this vulnerability.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Nextcloud Server

CVE-2023-28833

Unrestricted filenames for logo or favicon as admin in the theming settings in nextcloud server

Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a file name which was not restricted and could overwrite files in the appdata directory. Administrators may have access to overwrite these files by other means but this method could be exploited by tricking an admin into uploading a maliciously named file. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. Users unable to upgrade should avoid ingesting logo files from untrusted sources.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Nextcloud Server

CVE-2023-28835

Insecure randomness for default password in nextcloud

Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when creating a share was using a weak complexity random number generator, so when the sharer did not change it the password could be guessable to an attacker willing to brute force it. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. This issue only affects users who do not have a password policy enabled, so enabling a password policy is an effective mitigation for users unable to upgrade.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Nextcloud Server

CVE-2023-1735

SourceCodester Young Entrepreneur E-Negosyo System passwordrecover.php sql injection

A vulnerability classified as critical was found in SourceCodester Young Entrepreneur E-Negosyo System 1.0. Affected by this vulnerability is an unknown functionality of the file passwordrecover.php. The manipulation of the argument phonenumber leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-224623.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Young Entrepreneur E-negosyo System Project

Products

Young Entrepreneur E-negosyo System

CVE-2023-28846

Denial of Service in unpoly-rails

Unpoly is a JavaScript framework for server-side web applications. There is a possible Denial of Service (DoS) vulnerability in the `unpoly-rails` gem that implements the Unpoly server protocol for Rails applications. This issues affects Rails applications that operate as an upstream of a load balancer's that uses passive health checks. The `unpoly-rails` gem echoes the request URL as an `X-Up-Location` response header. By making a request with exceedingly long URLs (paths or query string), an attacker can cause unpoly-rails to write a exceedingly large response header. If the response header is too large to be parsed by a load balancer downstream of the Rails application, it may cause the load balancer to remove the upstream from a load balancing group. This causes that application instance to become unavailable until a configured timeout is reached or until an active healthcheck succeeds. This issue has been fixed and released as version 2.7.2.2 which is available via RubyGems and GitHub. Users unable to upgrade may: Configure your load balancer to use active health checks, e.g. by periodically requesting a route with a known response that indicates healthiness; Configure your load balancer so the maximum size of response headers is at least twice the maximum size of a URL; or instead of changing your server configuration you may also configure your Rails application to delete redundant `X-Up-Location` headers set by unpoly-rails.

CVSS 3.1 · 5.9 Medium EPSS 1.0% KEV · Not listed

Vendors

Unpoly

Products

Unpoly-rails

CVE-2023-1759

Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Phpmyfaq

Products

Phpmyfaq

CVE-2023-1760

Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Phpmyfaq

Products

Phpmyfaq

CVE-2023-1761

Cross-site Scripting in thorsten/phpmyfaq

Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpmyfaq

Products

Phpmyfaq

CVE-2023-1772

DataGear Diagram Type cross site scripting

A vulnerability was found in DataGear up to 4.5.1. It has been classified as problematic. This affects an unknown part of the component Diagram Type Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224673 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Datagear

Products

Datagear

CVE-2023-1773

Rockoa Configuration File webmainConfig.php code injection

A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of the component Configuration File Handler. The manipulation leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-224674 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS 1.6% KEV · Not listed

Vendors

Rockoa

Products

Rockoa