CVE-2023-4754

Out-of-bounds Write in gpac/gpac

Out-of-bounds Write in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2023-4753

OpenHarmony v3.2.1 and prior version has a system call function usage error

OpenHarmony v3.2.1 and prior version has a system call function usage error. Local attackers can crash kernel by the error input.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Openatom

Products

Openharmony

CVE-2023-4749

SourceCodester Inventory Management System index.php file inclusion

A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page leads to file inclusion. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-238638 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Inventory Management System

CVE-2023-4748

Yongyou UFIDA-NC PrintTemplateFileServlet.java path traversal

A vulnerability, which was classified as critical, has been found in Yongyou UFIDA-NC up to 20230807. This issue affects some unknown processing of the file PrintTemplateFileServlet.java. The manipulation of the argument filePath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238637 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Yonyou

Products

Ufida-nc

CVE-2023-4747

DedeCMS tags.php sql injection

A vulnerability classified as critical was found in DedeCMS 5.7.110. This vulnerability affects unknown code of the file /uploads/tags.php. The manipulation of the argument tag_alias leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238636.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dedecms

Products

Dedecms

CVE-2023-4746

TOTOLINK N200RE V5 Validity_check format string

A vulnerability classified as critical has been found in TOTOLINK N200RE V5 9.3.5u.6437_B20230519. This affects the function Validity_check. The manipulation leads to format string. It is possible to initiate the attack remotely. The root-cause of the vulnerability is a format string issue. But the impact is to bypass the validation which leads to to OS command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238635.

CVSS 3.1 · 8.8 High EPSS 3.7% KEV · Not listed

Vendors

Totolink

Products

N200re-v5 N200re-v5 Firmware

CVE-2023-4745

Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform importexport.php sql injection

A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230822. It has been rated as critical. Affected by this issue is some unknown functionality of the file /importexport.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-238634 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Byzoro

Products

Smart S45f Smart S45f Firmware

CVE-2023-4744

Tenda AC8 formSetDeviceName stack-based overflow

A vulnerability was found in Tenda AC8 16.03.34.06_cn_TDC01. It has been declared as critical. Affected by this vulnerability is the function formSetDeviceName. The manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238633 was assigned to this vulnerability.

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed

Vendors

Tenda

Products

Ac8 Ac8 Firmware

CVE-2023-4742

IBOS OA export&uid=X sql injection

A vulnerability was found in IBOS OA 4.5.5 and classified as critical. This issue affects some unknown processing of the file ?r=dashboard/user/export&uid=X. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238631. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibos

Products

Ibos

CVE-2023-4741

IBOS OA Delete Logs del sql injection

A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects unknown code of the file ?r=diary/default/del of the component Delete Logs Handler. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-238630 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibos

Products

Ibos

CVE-2023-4722

Integer Overflow or Wraparound in gpac/gpac

Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2023-4721

Out-of-bounds Read in gpac/gpac

Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2023-4720

Floating Point Comparison with Incorrect Operator in gpac/gpac

Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2023-4714

PlayTube Redirect information disclosure

A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. The identifier VDB-238577 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.3 Medium EPSS 5.5% KEV · Not listed

Vendors

Playtube

Products

Playtube

CVE-2023-4713

IBOS OA addcomment addComment sql injection

A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects the function addComment of the file ?r=weibo/comment/addcomment. The manipulation of the argument touid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238576. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibos

Products

Ibos

CVE-2023-4712

Xintian Smart Table Integrated Management System AddUpdateRole.aspx sql injection

A vulnerability, which was classified as critical, was found in Xintian Smart Table Integrated Management System 5.6.9. This affects an unknown part of the file /SysManage/AddUpdateRole.aspx. The manipulation of the argument txtRoleName leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238575. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Suntront

Products

Smart Table Integrated Management System

CVE-2023-4711

D-Link DAR-8000-10 decodmail.php os command injection

A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230819. Affected by this issue is some unknown functionality of the file /log/decodmail.php. The manipulation of the argument file leads to os command injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-238574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5 Medium EPSS 6.8% KEV · Not listed

Vendors

Dlink

Products

Dar-8000-10 Dar-8000-10 Firmware

CVE-2023-4710

TOTVS RM Portal cross site scripting

A vulnerability classified as problematic was found in TOTVS RM 12.1. Affected by this vulnerability is an unknown functionality of the component Portal. The manipulation of the argument d leads to cross site scripting. The attack can be launched remotely. The identifier VDB-238573 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Totvs

Products

Rm

CVE-2023-4708

Infosoftbd Clcknshop GET Parameter all sql injection

A vulnerability was found in Infosoftbd Clcknshop 1.0.0. It has been rated as critical. This issue affects some unknown processing of the file /collection/all of the component GET Parameter Handler. The manipulation of the argument tag leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-238571. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS 31.2% KEV · Not listed

Vendors

Infosoftbd

Products

Clcknshop

CVE-2023-4707

Infosoftbd Clcknshop all cross site scripting

A vulnerability was found in Infosoftbd Clcknshop 1.0.0. It has been declared as problematic. This vulnerability affects unknown code of the file /collection/all. The manipulation of the argument q leads to cross site scripting. The attack can be initiated remotely. VDB-238570 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Infosoftbd

Products

Clcknshop