Search vulnerabilities

Expected end of text, found '‑' (at char 7), (line:1, col:8)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,959

CVE-2023-33239

Second Order Command-injection Vulnerability in the Key-generation Function

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from insufficient input validation in the key-generation function, which could potentially allow malicious users to execute remote code on affected devices.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Moxa
Products
Edr-810 Edr-g9010 Edr-g902 and 6 more
CVE-2023-33238

Command-injection Vulnerability in Certificate Management

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, which could potentially allow malicious users to execute remote code on affected devices.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Moxa
Products
Edr-810 Edr-g9010 Edr-g902 and 5 more
CVE-2023-33237

Authentication Bypass Without Administrator Privilege

TN-5900 Series firmware version v3.3 and prior is vulnerable to improper-authentication vulnerability. This vulnerability arises from inadequate authentication measures implemented in the web API handler, allowing low-privileged APIs to execute restricted actions that only high-privileged APIs are allowed This presents a potential risk of unauthorized exploitation by malicious actors.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Moxa
Products
Tn-5900 Tn-5900 Firmware
CVE-2023-33234

Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration

Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner.  Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Apache
Products
Airflow Cncf Kubernetes Apache-airflow-providers-cncf-kubernetes
CVE-2023-33229

SolarWinds Platform Incorrect Input Neutralization Vulnerability

The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject passive HTML.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Solarwinds
Products
Solarwinds Platform
CVE-2023-33228

SolarWinds Network Configuration Manager Sensitive Information Disclosure Vulnerability

The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to obtain sensitive information.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed
Vendors
Solarwinds
Products
Network Configuration Manager
CVE-2023-33227

Directory Traversal Remote Code Execution Vulnerability

The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability This vulnerability allows a low level user to perform the actions with SYSTEM privileges.

CVSS 3.1 · 8 High EPSS 2.2% KEV · Not listed
Vendors
Solarwinds
Products
Network Configuration Manager
CVE-2023-33226

Directory Traversal Remote Code Execution Vulnerability

The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM privileges.

CVSS 3.1 · 8 High EPSS 2.2% KEV · Not listed
Vendors
Solarwinds
Products
Network Configuration Manager
CVE-2023-33224

SolarWinds Platform Incorrect Behavior Order Vulnerability

The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges.

CVSS 3.1 · 7.2 High EPSS 2.8% KEV · Not listed
Vendors
Solarwinds
Products
Solarwinds Platform
CVE-2023-33222

Stack buffer overflow when reading DESFire card

When handling contactless cards, usage of a specific function to get additional information from the card which doesn't check the boundary on the data received while reading. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted device

CVSS 3.1 · 6.8 Medium EPSS 1.3% KEV · Not listed
Vendors
Idemia
Products
Morphowave Compact Morphowave Compact Firmware Morphowave Sp and 13 more
CVE-2023-33221

Heap Buffer Overflow when reading DESFire card

When reading DesFire keys, the function that reads the card isn't properly checking the boundaries when copying internally the data received. This allows a heap based buffer overflow that could lead to a potential Remote Code Execution on the targeted device. This is especially problematic if you use Default DESFire key.

CVSS 3.1 · 6.8 Medium EPSS 1.0% KEV · Not listed
Vendors
Idemia
Products
Morphowave Compact Morphowave Compact Firmware Morphowave Sp and 13 more
CVE-2023-33220

Stack Buffer Overflow when checking some attributes during retrofit

During the retrofit validation process, the firmware doesn't properly check the boundaries while copying some attributes to check. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted device

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Idemia
Products
Morphowave Compact Morphowave Compact Firmware Morphowave Sp and 13 more
CVE-2023-33219

Stack Buffer Overflow when checking retrofit package

The handler of the retrofit validation command doesn't properly check the boundaries when performing certain validation operations. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted device

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Idemia
Products
Morphowave Compact Morphowave Compact Firmware Morphowave Sp and 13 more
CVE-2023-33217

Missing integrity check on upgrade package

By abusing a design flaw in the firmware upgrade mechanism of the impacted terminal it's possible to cause a permanent denial of service for the terminal. the only way to recover the terminal is by sending back the terminal to the manufacturer

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Idemia
Products
Morphowave Compact Morphowave Compact Firmware Morphowave Sp and 13 more
CVE-2023-33213

WordPress wpView Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Display Custom Fields – wpView plugin <= 1.3.0 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gvectors
Products
Wpview
CVE-2023-33212

WordPress JetFormBuilder Plugin <= 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.0.6 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock
Products
Jetformbuilder
CVE-2023-33210

WordPress nuajik CDN Plugin <= 0.1.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nuajik plugin <= 0.1.0 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Nuajik
Products
Nuajik-cdn
CVE-2023-33208

WordPress Cookie Monster Plugin <= 1.51 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gsmith Cookie Monster plugin <= 1.51 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Cookie Monster Project
Products
Cookie Monster