Search vulnerabilities

Expected end of text, found ':' (at char 31), (line:1, col:32)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,826

CVE-2023-4102

Multiple vulnerabilities in IDM Sistemas QSige

QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Qsige
Products
Qsige
CVE-2023-4101

Multiple vulnerabilities in IDM Sistemas QSige

The QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Qsige
Products
Qsige
CVE-2023-4100

Multiple vulnerabilities in IDM Sistemas QSige

Allows an attacker to perform XSS attacks stored on certain resources. Exploiting this vulnerability can lead to a DoS condition, among other actions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qsige
Products
Qsige
CVE-2023-4099

Multiple vulnerabilities in IDM Sistemas QSige

The QSige Monitor application does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Qsige
Products
Qsige
CVE-2023-4098

Multiple vulnerabilities in IDM Sistemas QSige

It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Qsige
Products
Qsige
CVE-2023-4097

Multiple vulnerabilities in IDM Sistemas QSige

The file upload functionality is not implemented correctly and allows uploading of any type of file. As a prerequisite, it is necessary for the attacker to log into the application with a valid username.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Qsige
Products
Qsige
CVE-2023-4096

Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea

Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force attack on the emailed PIN number in order to change the password of a legitimate user.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Fujitsu
Products
Arconte Aurea
CVE-2023-4095

User enumeration vulnerability in Fujitsu Arconte Áurea

User enumeration vulnerability in Arconte Áurea 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to obtain a list of registered users in the application, obtaining the necessary information to perform more complex attacks on the platform.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fujitsu
Products
Arconte Aurea
CVE-2023-4094

Weak authentication vulnerability in Fujitsu Arconte Áurea

ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate account and cause a denial of service. In addition, a resource has been identified that could allow circumventing the attempt limit set in the login form.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fujitsu
Products
Arconte Aurea
CVE-2023-4093

Reflected and persistent XSS vulnerability in Fujitsu Arconte Áurea

Reflected and persistent XSS vulnerability in Arconte Áurea, in its 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to inject malicious JavaScript code, compromise the victim's browser and take control of it, redirect the user to malicious domains or access information being viewed by the legitimate user.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fujitsu
Products
Arconte Aurea
CVE-2023-4092

SQL injection vulnerability in Fujitsu Arconte Áurea

SQL injection vulnerability in Arconte Áurea, in its 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to read sensitive data from the database, modify data (insert/update/delete), perform database administration operations and, in some cases, execute commands on the operating system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Fujitsu
Products
Arconte Aurea
CVE-2023-4090

Cross-Site Scripting (XSS) vulnerability on WideStand CMS of Acilia

Cross-site Scripting (XSS) reflected vulnerability on WideStand until 5.3.5 version, which generates one of the meta tags directly using the content of the queried URL, which would allow an attacker to inject HTML/Javascript code into the response.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Acilia
Products
Widestand
CVE-2023-4088

Malicious Code Execution Vulnerability in FA Engineering Software Products

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Mitsubishielectric
Products
Gx Works3
CVE-2023-4057

Mozilla: Memory safety bugs fixed in Firefox ESR 115.1, and Thunderbird 115.1

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 5 more
CVE-2023-4054

Mozilla: Lack of warning when opening appref-ms files

When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 102.14, Firefox ESR < 115.1, Thunderbird < 102.14, and Thunderbird < 115.1.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft Mozilla
Products
Windows Firefox
CVE-2023-4052

Mozilla: File deletion and privilege escalation through Firefox uninstaller

The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account. This could be combined with creation of a junction (a form of symbolic link) to allow arbitrary file deletion controlled by the non-privileged user. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Firefox Esr
CVE-2023-4043

Parsson DoS when parsing numbers from untrusted sources

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse Redhat
Products
Parsson Camel Quarkus Camel Spring Boot and 3 more
CVE-2023-4041

Second Stage Gecko Bootloader GBL Parser Buffer Overrun Vulnerability

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass.This issue affects "Standalone" and "Application" versions of Gecko Bootloader.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Gecko Bootloader
CVE-2023-4037

SQL injection in Setelsa Security ConacWin

Blind SQL injection vulnerability in the Conacwin 3.7.1.2 web interface, the exploitation of which could allow a local attacker to obtain sensitive data stored in the database by sending a specially crafted SQL query to the xml parameter.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Setelsa-security
Products
Conacwin