Search vulnerabilities

Expected end of text, found '/' (at char 47), (line:1, col:48)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2023-39989

WordPress Header Footer Code Manager Plugin <= 1.1.34 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in 99robots Header Footer Code Manager plugin <= 1.1.34 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Draftpress
Products
Header Footer Code Manager
CVE-2023-39988

WordPress WxSync Plugin <= 2.7.23 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in 标准云(std.Cloud) WxSync plugin <= 2.7.23 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Tencent
Products
Wxsync
CVE-2023-39987

WordPress wSecure Lite Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ajay Lulia wSecure Lite plugin <= 2.5 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomlaserviceprovider
Products
Wsecure
CVE-2023-39986

Out-of-bounds Read Vulnerability in Hitachi EH-VIEW (Designer)

** UNSUPPORTED WHEN ASSIGNED ** Out-of-bounds Read vulnerability in Hitachi EH-VIEW (Designer) allows local attackers to potentially disclose information on affected EH-VIEW installations. User interaction is required to exploit the vulnerabilities in that the user must open a malicious file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Hitachi
Products
Eh-view
CVE-2023-39985

Out-of-bounds Write Vulnerability in Hitachi EH-VIEW (Designer)

** UNSUPPORTED WHEN ASSIGNED ** Out-of-bounds Write vulnerability in Hitachi EH-VIEW (Designer) allows local attackers to potentially execute arbitray code on affected EH-VIEW installations. User interaction is required to exploit the vulnerabilities in that the user must open a malicious file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Hitachi
Products
Eh-view
CVE-2023-39984

Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability in Hitachi EH-VIEW (KeypadDesigner)

** UNSUPPORTED WHEN ASSIGNED ** Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Hitachi EH-VIEW (KeypadDesigner) allows local attackers to potentially disclose information and execute arbitray code on affected EH-VIEW installations. User interaction is required to exploit the vulnerabilities in that the user must open a malicious file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Hitachi
Products
Eh-view
CVE-2023-39983

MXsecurity Register Database Pollution

A vulnerability that poses a potential risk of polluting the MXsecurity sqlite database and the nsm-web UI has been identified in MXsecurity versions prior to v1.0.1. This vulnerability might allow an unauthenticated remote attacker to register or add devices via the nsm-web application.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Moxa
Products
Mxsecurity
CVE-2023-39982

MXsecurity Hardcoded Credential

A vulnerability has been identified in MXsecurity versions prior to v1.0.1. The vulnerability may put the confidentiality and integrity of SSH communications at risk on the affected device. This vulnerability is attributed to a hard-coded SSH host key, which might facilitate man-in-the-middle attacks and enable the decryption of SSH traffic.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Moxa
Products
Mxsecurity
CVE-2023-39981

MXsecurity Device Information Disclosure

A vulnerability that allows for unauthorized access has been discovered in MXsecurity versions prior to v1.0.1. This vulnerability arises from inadequate authentication measures, potentially leading to the disclosure of device information by a remote attacker.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Moxa
Products
Mxsecurity
CVE-2023-39980

MXsecurity Authenticated Information Disclosure Due to SQL Injection

A vulnerability that allows the unauthorized disclosure of authenticated information has been identified in MXsecurity versions prior to v1.0.1. This vulnerability arises when special elements are not neutralized correctly, allowing remote attackers to alter SQL commands.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Moxa
Products
Mxsecurity
CVE-2023-39979

MXsecurity Authentication Bypass

There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenticator has insufficient random values.  

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Moxa
Products
Mxsecurity
CVE-2023-39974

Extension - acymailing.com - Exposure of Sensitive Information in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3

Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers in a specific list.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Acymailing
Products
Acymailing
CVE-2023-39973

Extension - acymailing.com - Improper Access Control in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3

Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows the unauthorized removal of attachments from campaigns.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Acymailing
Products
Acymailing
CVE-2023-39972

Extension - acymailing.com - Improper Access Control in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3

Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized users to create new mailing lists.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Acymailing
Products
Acymailing
CVE-2023-39971

Extension - acymailing.com - XSS in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3

Improper Neutralization of Input During Web Page Generation vulnerability in AcyMailing Enterprise component for Joomla allows XSS. This issue affects AcyMailing Enterprise component for Joomla: 6.7.0-8.6.3.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Acymailing
Products
Acymailing
CVE-2023-39970

Extension - acymailing.com - RCE in AcyMailing component for Joomla 6.7.0-8.5.0

Unrestricted Upload of File with Dangerous Type vulnerability in AcyMailing component for Joomla. It allows remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Acyba
Products
Acymailing Starter
CVE-2023-39969

uthenticode signature validation bypass vulnerability

uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Version 1.0.9 of uthenticode hashed the entire file rather than hashing sections by virtual address, in violation of the Authenticode specification. As a result, an attacker could modify code within a binary without changing its Authenticode hash, making it appear valid from uthenticode's perspective. Versions of uthenticode prior to 1.0.9 are not vulnerable to this attack, nor are versions in the 2.x series. By design, uthenticode does not perform full-chain validation. However, the malleability of signature verification introduced in 1.0.9 was an unintended oversight. The 2.x series addresses the vulnerability. Versions prior to 1.0.9 are also not vulnerable, but users are encouraged to upgrade rather than downgrade. There are no workarounds to this vulnerability.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Trailofbits
Products
Uthenticode
CVE-2023-39967

Full read and controlled SSRF through URL parameter when testing a request inside wiremock-studio

WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock’s instance. There are 3 identified potential attack vectors: via “TestRequester” functionality, webhooks and the proxy mode. As we can control HTTP Method, HTTP Headers, HTTP Data, it allows sending requests with the default level of credentials for the WireMock instance. The vendor has discontinued the affected Wiremock studio product and there will be no fix. Users are advised to find alternatives.

CVSS 3.1 · 10 Critical EPSS 1.0% KEV · Not listed
Vendors
Wiremock
Products
Studio Wiremock
CVE-2023-39966

1Panel arbitrary file write vulnerability exists in the background

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Fit2cloud
Products
1panel