CVE-2023-5160

Full name disclosure via team top membership with Show Full Name option disabled

Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint allowing a member to get the full name of another user even if the Show Full Name option was disabled

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost

CVE-2023-5159

A User Manager role with user edit permissions could manage/update bots

Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost

CVE-2023-5154

D-Link DAR-8000 changelogo.php unrestricted upload

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-8000 up to 20151231 and classified as critical. This vulnerability affects unknown code of the file /sysmanage/changelogo.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-240250 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVSS 3.1 · 6.3 Medium EPSS 15.3% KEV · Not listed

Vendors

Dlink

Products

Dar-8000 Dar-8000 Firmware

CVE-2023-5153

D-Link DAR-8000 querysql.php sql injection

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-8000 up to 20151231. This affects an unknown part of the file /Tool/querysql.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240249 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVSS 3.1 · 6.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Dlink

Products

Dar-7000 Dar-7000 Firmware

CVE-2023-5152

D-Link DAR-7000/DAR-8000 importexport.php sql injection

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected by this issue is some unknown functionality of the file /importexport.php. The manipulation of the argument sql leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240248. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVSS 3.1 · 6.3 Medium EPSS 8.5% KEV · Not listed

Vendors

Dlink

Products

Dar-7000 Firmware Dar-8000 Dar-8000 Firmware

CVE-2023-5151

D-Link DAR-8000 autheditpwd.php sql injection

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231. Affected by this vulnerability is an unknown functionality of the file /autheditpwd.php. The manipulation of the argument hid_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240247. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVSS 3.1 · 6.3 Medium EPSS 80.6% KEV · Not listed

Vendors

Dlink

Products

Dar-8000 Dar-8000 Firmware

CVE-2023-5149

D-Link DAR-7000 userattestation.php unrestricted upload

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been rated as critical. This issue affects some unknown processing of the file /useratte/userattestation.php. The manipulation of the argument web_img leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240245 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVSS 3.1 · 6.3 Medium EPSS 20.9% KEV · Not listed

Vendors

Dlink

Products

Dar-7000 Dar-7000 Firmware

CVE-2023-5148

D-Link DAR-7000/DAR-8000 uploadfile.php unrestricted upload

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231. It has been declared as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240244. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVSS 3.1 · 6.3 Medium EPSS 30.5% KEV · Not listed

Vendors

Dlink

Products

Dar-7000 Dar-7000 Firmware Dar-8000 and 1 more

CVE-2023-5147

D-Link DAR-7000 updateos.php unrestricted upload

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been classified as critical. This affects an unknown part of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240243. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVSS 3.1 · 6.3 Medium EPSS 26.4% KEV · Not listed

Vendors

Dlink

Products

Dar-7000 Dar-7000 Firmware

CVE-2023-5146

D-Link DAR-7000/DAR-8000 updatelib.php unrestricted upload

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231 and classified as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updatelib.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-240242 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVSS 3.1 · 6.3 Medium EPSS 32.4% KEV · Not listed

Vendors

Dlink

Products

Dar-7000 Dar-7000 Firmware Dar-8000 and 1 more

CVE-2023-5145

D-Link DAR-7000 licence.php unrestricted upload

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-7000 up to 20151231 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysmanage/licence.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240241 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

CVSS 3.1 · 6.3 Medium EPSS 34.2% KEV · Not listed

Vendors

Dlink

Products

Dar-7000 Dar-7000 Firmware Dar-8000 and 1 more

CVE-2023-5144

D-Link DAR-7000/DAR-8000 updateos.php unrestricted upload

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unknown function of the file /sysmanage/updateos.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240240. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.

CVSS 3.1 · 6.3 Medium EPSS 6.0% KEV · Not listed

Vendors

Dlink

Products

Dar-7000 Dar-7000 Firmware Dar-8000 and 1 more

CVE-2023-5142

H3C ER6300G2 Config File userLogin.asp path traversal

A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 up to 20230908. This vulnerability affects unknown code of the file /userLogin.asp of the component Config File Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-240238 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.7 Low EPSS 2.7% KEV · Not listed

Vendors

H3c

Products

Er2100n Er2100n Firmware Er2200g2 and 27 more

CVE-2023-5141

BSK Contact Form 7 Blacklist <= 1.0.1 - Reflected Cross-Site Scripting

The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the inserted_count parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Bannersky

Products

Bsk Contact Form 7 Blacklist

CVE-2023-5140

Bonus for Woo < 5.8.3 - Reflected Cross-Site Scripting

The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Computy

Products

Bonus For Woo

CVE-2023-5130

Delta Electronics WPLSoft Buffer-Overflow

A buffer overflow vulnerability exists in Delta Electronics WPLSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DVP file to achieve code execution.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Deltaww

Products

Wplsoft

CVE-2023-5119

Forminator and Forminator Pro < 1.27.0 - Admin+ Stored Cross-Site Scripting

The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Incsub

Products

Forminator

CVE-2023-5113

Certain HP Enterprise LaserJet, LaserJet Managed printers - Potential denial of service, potential Cross Site Scripting (XSS)

Certain HP Enterprise LaserJet and HP LaserJet Managed Printers are potentially vulnerable to denial of service due to WS-Print request and potential injections of Cross Site Scripting via jQuery-UI.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Hp

Products

Color Laserjet Enterprise 5700 49k98a Color Laserjet Enterprise 5700 6qn28a Color Laserjet Enterprise 6700 49l00a and 1130 more

CVE-2023-5112

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "specials_type_name[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2023-5111

Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "featured_type_name[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce