CVE-2023-2823

SourceCodester Class Scheduling System GET Parameter edit_subject.php sql injection

A vulnerability was found in SourceCodester Class Scheduling System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/edit_subject.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229597 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Class Scheduling System Project

Products

Class Scheduling System

CVE-2023-2818

ITM Windows Agent Insecure Filesystem Permissions

An insecure filesystem permission in the Insider Threat Management Agent for Windows enables local unprivileged users to disrupt agent monitoring. All versions prior to 7.14.3 are affected. Agents for MacOS and Linux and Cloud are unaffected.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Proofpoint

Products

Insider Threat Management

CVE-2023-2816

Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Consul

CVE-2023-2815

SourceCodester Online Jewelry Store POST Parameter supplier.php sql injection

A vulnerability classified as critical was found in SourceCodester Online Jewelry Store 1.0. Affected by this vulnerability is an unknown functionality of the file supplier.php of the component POST Parameter Handler. The manipulation of the argument suppid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229429 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Online Jewelry Store Project

Products

Online Jewelry Store

CVE-2023-2814

SourceCodester Class Scheduling System POST Parameter save_teacher.php cross site scripting

A vulnerability classified as problematic has been found in SourceCodester Class Scheduling System 1.0. Affected is an unknown function of the file /admin/save_teacher.php of the component POST Parameter Handler. The manipulation of the argument Academic_Rank leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229428.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Class Scheduling System Project

Products

Class Scheduling System

CVE-2023-2813

Multiple Themes - Reflected XSS

All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2, BunnyPressLite WordPress theme before 2.1, Cafe Bistro WordPress theme before 1.1.4, College WordPress theme before 1.5.1, Connections Reloaded WordPress theme through 3.1, Counterpoint WordPress theme through 1.8.1, Digitally WordPress theme through 1.0.8, Directory WordPress theme before 3.0.2, Drop WordPress theme before 1.22, Everse WordPress theme before 1.2.4, Fashionable Store WordPress theme through 1.3.4, Fullbase WordPress theme before 1.2.1, Ilex WordPress theme before 1.4.2, Js O3 Lite WordPress theme through 1.5.8.2, Js Paper WordPress theme through 2.5.7, Kata WordPress theme before 1.2.9, Kata App WordPress theme through 1.0.5, Kata Business WordPress theme through 1.0.2, Looki Lite WordPress theme before 1.3.0, moseter WordPress theme through 1.3.1, Nokke WordPress theme before 1.2.4, Nothing Personal WordPress theme through 1.0.7, Offset Writing WordPress theme through 1.2, Opor Ayam WordPress theme through 18, Pinzolo WordPress theme before 1.2.10, Plato WordPress theme before 1.1.9, Polka Dots WordPress theme through 1.2, Purity Of Soul WordPress theme through 1.9, Restaurant PT WordPress theme before 1.1.3, Saul WordPress theme before 1.1.0, Sean Lite WordPress theme before 1.4.6, Tantyyellow WordPress theme through 1.0.0.5, TIJAJI WordPress theme through 1.43, Tiki Time WordPress theme through 1.3, Tuaug4 WordPress theme through 1.4, Tydskrif WordPress theme through 1.1.3, UltraLight WordPress theme through 1.2, Venice Lite WordPress theme before 1.5.5, Viala WordPress theme through 1.3.1, viburno WordPress theme before 1.3.2, Wedding Bride WordPress theme before 1.0.2, Wlow WordPress theme before 1.2.7 suffer from the same issue about the search box reflecting the results causing XSS which allows an unauthenticated attacker to exploit against users if they click a malicious link.

CVSS 3.1 · 6.1 Medium EPSS 1.0% KEV · Not listed

Vendors

Ajaydsouza Archimidismertzanos Arthousewebdesign and 22 more

Products

Connections Reloaded Atlast Business Fashionable Store and 43 more

CVE-2023-2809

Use of Cleartext credentials in Sage 200 Spain

Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database credentials from the DLL application. This vulnerability could be linked to known techniques to obtain remote execution of MS SQL commands and escalate privileges on Windows systems because the credentials are stored in plaintext.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Sage

Products

Sage 200 Spain

CVE-2023-2803

Ultimate Addons for Contact Form 7 < 3.1.29 - Reflected XSS

The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Themefic

Products

Ultimate Addons For Contact Form 7

CVE-2023-2802

Ultimate Addons for Contact Form 7 < 3.1.29 - Admin+ Stored XSS

The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Themefic

Products

Ultimate Addons For Contact Form 7

CVE-2023-2798

Denial of service in HtmlUnit

Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. This effect may support a denial of service attack.This issue affects htmlunit before 2.70.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Htmlunit Redhat

Products

Htmlunit Migration Toolkit Applications Migration Toolkit Runtimes

CVE-2023-2790

TOTOLINK N200RE Telnet Service custom.conf password in configuration file

A vulnerability classified as problematic has been found in TOTOLINK N200RE 9.3.5u.6255_B20211224. Affected is an unknown function of the file /squashfs-root/etc_ro/custom.conf of the component Telnet Service. The manipulation leads to password in configuration file. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-229374 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

N200re N200re Firmware

CVE-2023-2789

GNU cflow parser.c parse_variable_declaration denial of service

A vulnerability was found in GNU cflow 1.7. It has been rated as problematic. This issue affects the function func_body/parse_variable_declaration of the file parser.c. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier VDB-229373 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS 1.2% KEV · Not listed

Vendors

Gnu

Products

Cflow

CVE-2023-2775

code-projects Bus Dispatch and Information System adminHome.php sql injection

A vulnerability was found in code-projects Bus Dispatch and Information System 1.0. It has been classified as critical. This affects an unknown part of the file adminHome.php. The manipulation of the argument reach_city leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229281 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bus Dispatch And Information System Project

Products

Bus Dispatch And Information System

CVE-2023-2773

code-projects Bus Dispatch and Information System view_admin.php sql injection

A vulnerability has been found in code-projects Bus Dispatch and Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file view_admin.php. The manipulation of the argument adminid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229279.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bus Dispatch And Information System Project

Products

Bus Dispatch And Information System

CVE-2023-2771

SourceCodester Online Exam System data sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Online Exam System 1.0. This issue affects some unknown processing of the file /jurusanmatkul/data. The manipulation of the argument columns[1][data] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229277 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Online Exam System Project

Products

Online Exam System

CVE-2023-2770

SourceCodester Online Exam System data sql injection

A vulnerability classified as critical was found in SourceCodester Online Exam System 1.0. This vulnerability affects unknown code of the file /kelasdosen/data. The manipulation of the argument columns[1][data] leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229276.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Online Exam System Project

Products

Online Exam System

CVE-2023-2769

SourceCodester Service Provider Management System sql injection

A vulnerability classified as critical has been found in SourceCodester Service Provider Management System 1.0. This affects an unknown part of the file /classes/Master.php?f=delete_service. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229275.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Service Provider Management System

CVE-2023-2763

Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023

Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted DWG or DXF file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

3ds

Products

3dexperience Solidworks

CVE-2023-2762

Use-After-Free vulnerability in SLDPRT file reading procedure affecting SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023

A Use-After-Free vulnerability in SLDPRT file reading procedure exists in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted SLDPRT file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

3ds

Products

3dexperience Solidworks

CVE-2023-2761

User Activity Log < 1.6.3 - Admin+ SQL Injection

The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Solwininfotech

Products

User Activity Log