CVE-2023-30607

icingaweb2-module-jira template and field configuration are susceptible to CSRF

icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms perform the deletion action before user input is validated, including the cross site request forgery token. This issue is fixed in version 1.3.2. There are no known workarounds.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Icinga

Products

Icinga Web Jira Integration

CVE-2023-30601

Apache Cassandra: Privilege escalation when enabling FQL/Audit logs

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROUND The vulnerability requires nodetool/JMX access to be exploitable, disable access for any non-trusted users. MITIGATION Upgrade to 4.0.10 or 4.1.2 and leave the new FQL/Auditlog configuration property allow_nodetool_archive_command as false.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Cassandra

CVE-2023-30591

NodeBB Pre-Authentication Denial-of-Service

Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively.

CVSS 3.1 · 7.5 High EPSS 58.7% KEV · Not listed

Vendors

Nodebb

Products

Nodebb

CVE-2023-30576

Apache Guacamole: Use-after-free in handling of RDP audio input buffer

Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Depending on timing, this may allow an attacker to execute arbitrary code with the privileges of the guacd process.

CVSS 3.1 · 6.8 Medium EPSS 1.1% KEV · Not listed

Vendors

Apache

Products

Guacamole

CVE-2023-30575

Apache Guacamole: Incorrect calculation of Guacamole protocol element lengths

Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole instructions during the handshake through specially-crafted data.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Apache

Products

Guacamole

CVE-2023-30565

CQI Data Sniffing

An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Bd

Products

Guardrails Cqi Reporter

CVE-2023-30564

Stored Cross-Site Scripting on Device Import Functionality

Alaris Systems Manager does not perform input validation during the Device Import Function.

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Bd

Products

Alaris Systems Manager

CVE-2023-30563

Stored Cross-Site Scripting on User Import Functionality

A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Bd

Products

Alaris Systems Manager

CVE-2023-30562

Lack of Dataset Integrity Checking

A GRE dataset file within Systems Manager can be tampered with and distributed to PCUs.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed

Vendors

Bd

Products

Alaris Guardrails Editor

CVE-2023-30561

Lack of Cryptographic Security of IUI Bus

The data flowing between the PCU and its modules is insecure. A threat actor with physical access could potentially read or modify data by attaching a specially crafted device while an infusion is running.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Bd

Products

Alaris 8015 Pcu Alaris 8015 Pcu Firmware

CVE-2023-30560

PCU Configuration Lacks Authentication

The configuration from the PCU can be modified without authentication using physical connection to the PCU.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Bd Becton Dickinson And Co

Products

Alaris 8015 Pcu Alaris 8015 Pcu Firmware Bd Alarisa Point Of Care Unit Model 8015

CVE-2023-30559

Wireless Card Firmware Improperly Signed

The firmware update package for the wireless card is not properly signed and can be modified.

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Bd

Products

Alaris 8015 Pcu Alaris 8015 Pcu Firmware

CVE-2023-30500

WordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerability

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPForms WPForms Lite (wpforms-lite), WPForms WPForms Pro (wpforms) plugins <= 1.8.1.2 versions.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wpforms

Products

Contact Form Wpforms

CVE-2023-30499

WordPress FV Flowplayer Video Player Plugin <= 7.5.32.7212 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.32.7212 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Foliovision

Products

Fv Flowplayer Video Player

CVE-2023-30498

WordPress Vimeotheque Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodeFlavors Vimeotheque: Vimeo WordPress Plugin <= 2.2.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Codeflavors

Products

Vimeotheque

CVE-2023-30496

WordPress Bus Ticket Booking with Seat Reservation Plugin <= 5.2.5 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MagePeople Team WpBusTicketly plugin <= 5.2.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mage-people

Products

Bus Ticket Booking With Seat Reservation

CVE-2023-30494

WordPress ImageRecycle pdf & image compression Plugin <= 3.1.10 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ImageRecycle ImageRecycle pdf & image compression plugin <= 3.1.10 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Imagerecycle

Products

Imagerecycle Pdf \& Image Compression

CVE-2023-30493

WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.2.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themefic

Products

Ultimate Addons For Contact Form 7

CVE-2023-30491

WordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Codebard

Products

Codebard\'s Patron Button And Widgets For Patreon

CVE-2023-30489

WordPress Email Subscription Popup Plugin <= 1.2.16 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Email Subscription Popup plugin <= 1.2.16 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

I13websolution

Products

Email Subscription Popup