Search vulnerabilities

Expected end of text, found ',' (at char 22), (line:1, col:23)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,758

CVE-2023-3383

SourceCodester Game Result Matrix System GET Parameter athlete-profile.php sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Game Result Matrix System 1.0. This affects an unknown part of the file /dipam/athlete-profile.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232239.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Game Result Matrix System Project
Products
Game Result Matrix System
CVE-2023-3382

SourceCodester Game Result Matrix System GET Parameter save-delegates.php cross site scripting

A vulnerability, which was classified as problematic, has been found in SourceCodester Game Result Matrix System 1.0. Affected by this issue is some unknown functionality of the file /dipam/save-delegates.php of the component GET Parameter Handler. The manipulation of the argument del_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-232238 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Game Result Matrix System Project
Products
Game Result Matrix System
CVE-2023-3380

Wavlink WN579X3 Ping Test adm.cgi injection

A vulnerability classified as critical has been found in Wavlink WN579X3 up to 20230615. Affected is an unknown function of the file /cgi-bin/adm.cgi of the component Ping Test. The manipulation of the argument pingIp leads to injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-232236. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.7 Medium EPSS 3.9% KEV · Not listed
Vendors
Wavlink
Products
Wn579x3 Wn579x3 Firmware
CVE-2023-3366

MultiParcels Shipping For WooCommerce < 1.15.2 - Arbitrary Shipment Deletion via CSRF

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.2 does not have CRSF check when deleting a shipment, allowing attackers to make any logged in user, delete arbitrary shipment via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Multiparcels
Products
Multiparcels Shipping For Woocommerce
CVE-2023-3365

MultiParcels Shipping For WooCommerce < 1.14.14 - Subscriber+ Arbitrary Shipment Deletion

The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.14 does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Multiparcels
Products
Multiparcels Shipping For Woocommerce
CVE-2023-3363

Insertion of Sensitive Information into Log File in GitLab

An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1, resulted in the Sidekiq log including webhook tokens when the log format was set to `default`.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2023-3361

S3 credentials included when exporting elyra notebook

A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster (ds pipeline server) and saves them in plain text in the generated output instead of an ID for a Kubernetes secret.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Opendatahub Redhat
Products
Open Data Hub Dashboard Openshift Data Science
CVE-2023-3356

Subscribers Text Counter < 1.7.1 - Settings Update via CSRF to Stored XSS

The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Kreci
Products
Subscribers Text Counter
CVE-2023-3350

Cryptographic Issues on IBERMATICA RPS

A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attacker could retrieve the SQL query sent to the application in plaint text. This log file contains the password hashes coded with AES-CBC-128 bits algorithm, which can be decrypted with a .NET function, obtaining the username's password in plain text.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Ayesa
Products
Ibermatica Rps
CVE-2023-3349

Information exposure on IBERMATICA RPS

Information exposure vulnerability in IBERMATICA RPS 2019, which exploitation could allow an unauthenticated user to retrieve sensitive information, such as usernames, IP addresses or SQL queries sent to the application. By accessing the URL /RPS2019Service/status.html, the application enables the logging mechanism by generating the log file, which can be downloaded.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Ayesa
Products
Ibermatica Rps
CVE-2023-3348

Directory traversal vulnerability in Cloudflare Wrangler

The Wrangler command line tool  (<=wrangler@3.1.0 or <=wrangler@2.20.1) was affected by a directory traversal vulnerability when running a local development server for Pages (wrangler pages dev command). This vulnerability enabled an attacker in the same network as the victim to connect to the local development server and access the victim's files present outside of the directory for the development server.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Cloudflare
Products
Wrangler
CVE-2023-3340

SourceCodester Online School Fees System GET Parameter ajx.php sql injection

A vulnerability was found in SourceCodester Online School Fees System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file ajx.php of the component GET Parameter Handler. The manipulation of the argument name_startsWith leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-232016.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Online School Fees System Project
Products
Online School Fees System
CVE-2023-3339

code-projects Agro-School Management System exam-delete.php sql injection

A vulnerability has been found in code-projects Agro-School Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file exam-delete.php. The manipulation of the argument test_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232015.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Agro-school Management System Project
Products
Agro-school Management System
CVE-2023-3337

PuneethReddyHC Online Shopping System Advanced Admin Registration reg.php improper authentication

A vulnerability was found in PuneethReddyHC Online Shopping System Advanced 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/reg.php of the component Admin Registration. The manipulation leads to improper authentication. The attack can be launched remotely. The identifier VDB-232009 was assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Online Shopping System Advanced Project
Products
Online Shopping System Advanced
CVE-2023-3336

TN-5900 Series User Enumeration Vulnerability

TN-5900 Series version 3.3 and prior versions is vulnearble to user enumeration vulnerability. The vulnerability may allow a remote attacker to determine whether a user is valid during password recovery through the web login page and enable a brute force attack with valid users.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Moxa
Products
Tn-5900 Tn-5900 Firmware
CVE-2023-3335

Information Exposure Vulnerability in Hitachi Ops Center Administrator

Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator on Linux allows local users  to gain sensitive information.This issue affects Hitachi Ops Center Administrator: before 10.9.3-00.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hitachi Linux
Products
Ops Center Administrator Linux Kernel
CVE-2023-3329

CVE-2023-3329

SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the webserver using the HMI's upload file feature. This could create size zero files anywhere on the webserver, potentially overwriting system files and creating a denial-of-service condition.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Spidercontrol
Products
Scadawebserver
CVE-2023-3328

Custom Field For WP Job Manager < 1.2 - Admin+ Stored XSS

The Custom Field For WP Job Manager WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Custom Field For Wp Job Manager Project
Products
Custom Field For Wp Job Manager
CVE-2023-3324

Insecure deserialization in zenon internal DLLs

A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing them to run on the zenon installed hosts. This issue affects ABB Ability™ zenon: from 11 build through 11 build 106404.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Zenon