CVE-2023-3643

Boss Mini document file inclusion

A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. The manipulation of the argument path leads to file inclusion. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-233889 was assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS 75.4% KEV · Not listed

Vendors

Carel

Products

Boss Mini Boss Mini Firmware

CVE-2023-3642

GZ Scripts Vacation Rental Website HTTP POST Request cross site scripting

A vulnerability was found in GZ Scripts Vacation Rental Website 1.8 and classified as problematic. Affected by this issue is some unknown functionality of the file /VacationRentalWebsite/property/8/ad-has-principes/ of the component HTTP POST Request Handler. The manipulation of the argument username/title/comment leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-233888.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gzscripts

Products

Vacation Rental Website

CVE-2023-3641

khodakhah NodCMS POST Request blog-comment-4 cross site scripting

A vulnerability has been found in khodakhah NodCMS 3.4.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /en/blog-comment-4 of the component POST Request Handler. The manipulation of the argument comment_name/comment_content leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-233887.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nodcms

Products

Nodcms

CVE-2023-3635

Okio GzipSource unhandled exception Denial of Service

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

CVSS 3.1 · 5.9 Medium EPSS 1.3% KEV · Not listed

Vendors

Redhat Squareup

Products

Amq Streams Jboss Enterprise Bpms Platform Jboss Fuse and 3 more

CVE-2023-3633

Out of Bounds Memory Corruption Issue in CEVA Engine

An out-of-bounds write vulnerability in Bitdefender Engines on Windows causes the engine to crash. This issue affects Bitdefender Engines version 7.94791 and lower.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Bitdefender

Products

Engines

CVE-2023-3627

Cross-Site Request Forgery (CSRF) in salesagility/suitecrm-core

Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Salesagility

Products

Suitecrm

CVE-2023-3626

Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System UpLoadFloodPlanFile UpLoadFloodPlanFile.ashx unrestricted upload

A vulnerability, which was classified as critical, has been found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706. This issue affects some unknown processing of the file /Duty/AjaxHandle/UpLoadFloodPlanFile.ashx of the component UpLoadFloodPlanFile. The manipulation of the argument Filedata leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233579. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Istrong

Products

Mountain Flood Disaster Prevention Monitoring And Early Warning System

CVE-2023-3625

Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System Duty Write-UploadFile UploadFile.ashx unrestricted upload

A vulnerability classified as critical was found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706. This vulnerability affects unknown code of the file /Duty/AjaxHandle/Write/UploadFile.ashx of the component Duty Write-UploadFile. The manipulation of the argument Filedata leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-233578 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Istrong

Products

Mountain Flood Disaster Prevention Monitoring And Early Warning System

CVE-2023-3624

Nesote Inout Blockchain FiatExchanger POST Parameter update_marketboxslider sql injection

A vulnerability classified as critical has been found in Nesote Inout Blockchain FiatExchanger 3.0. This affects an unknown part of the file /index.php/coins/update_marketboxslider of the component POST Parameter Handler. The manipulation of the argument marketcurrency leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-233577 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nesote

Products

Inout Blockchain Fiatexchanger

CVE-2023-3623

Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System Duty Module UploadHandler.ashx unrestricted upload

A vulnerability was found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230704. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Duty/AjaxHandle/UploadHandler.ashx of the component Duty Module. The manipulation of the argument Filedata leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-233576. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Istrong

Products

Mountain Flood Disaster Prevention Monitoring And Early Warning System

CVE-2023-3622

Access Control Bypass Vulnerability in the SolarWinds Platform

Access Control Bypass Vulnerability in the SolarWinds Platform that allows an underprivileged user to read arbitrary resource

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Solarwinds Platform

CVE-2023-3621

IBOS OA Delete Packet delete createDeleteCommand sql injection

A vulnerability was found in IBOS OA 4.5.5. It has been classified as critical. Affected is the function createDeleteCommand of the file ?r=article/default/delete of the component Delete Packet. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-233574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibos

Products

Ibos

CVE-2023-3620

Cross-site Scripting (XSS) - Stored in amauric/tarteaucitron.js

Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Tarteaucitron

Products

Tarteaucitron

CVE-2023-3619

SourceCodester AC Repair and Services System HTTP POST Request sql injection

A vulnerability was found in SourceCodester AC Repair and Services System 1.0 and classified as critical. This issue affects some unknown processing of the file Master.php?f=save_service of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The identifier VDB-233573 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Ac Repair And Services System

CVE-2023-3615

Lack of server certificate validation in websockets connection

Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost

CVE-2023-3614

Denial of Service via specially crafted gif image

Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making the server unresponsive for an extended period of time by linking to specially crafted image file.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Server

CVE-2023-3613

Guest accounts invited and added to channels by Welcomebot plugin

Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Server

CVE-2023-3612

Unprotected WebView access in Govee Home App

Govee Home app has unprotected access to WebView component which can be opened by any app on the device. By sending an URL to a specially crafted site, the attacker can execute JavaScript in context of WebView or steal sensitive user data by displaying phishing content.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Govee

Products

Home

CVE-2023-3608

Ruijie BCR810W Tracert Page os command injection

A vulnerability was found in Ruijie BCR810W 2.5.10. It has been rated as critical. This issue affects some unknown processing of the component Tracert Page. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-233477 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.7 Medium EPSS 12.3% KEV · Not listed

Vendors

Ruijienetworks

Products

Bcr810w Bcr810w Firmware

CVE-2023-3607

kodbox WebConsole Plug-In webconsole.php.txt Execute os command injection

A vulnerability was found in kodbox 1.26. It has been declared as critical. This vulnerability affects the function Execute of the file webconsole.php.txt of the component WebConsole Plug-In. The manipulation leads to os command injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-233476. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.5 Medium EPSS 6.4% KEV · Not listed

Vendors

Kodcloud

Products

Kodbox