CVE-2023-1005

JP1016 Markdown-Electron code injection

A vulnerability was found in JP1016 Markdown-Electron and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to code injection. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-221738 is the identifier assigned to this vulnerability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Markdown-electron Project

Products

Markdown-electron

CVE-2023-1003

Typora WSH JScript code injection

A vulnerability, which was classified as critical, was found in Typora up to 1.5.5 on Windows. Affected is an unknown function of the component WSH JScript Handler. The manipulation leads to code injection. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.8 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221736.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft Typora

Products

Windows Typora

CVE-2023-1002

MuYuCMS index.php path traversal

A vulnerability, which was classified as problematic, has been found in MuYuCMS 2.2. This issue affects some unknown processing of the file index.php. The manipulation of the argument file_path leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221735.

CVSS 3.1 · 4.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Muyucms

Products

Muyucms

CVE-2023-0999

SourceCodester Sales Tracker Management System cross-site request forgery

A vulnerability classified as problematic was found in SourceCodester Sales Tracker Management System 1.0. This vulnerability affects unknown code of the file admin/?page=user/list. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221734 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sales Tracker Management System Project

Products

Sales Tracker Management System

CVE-2023-0998

SourceCodester Alphaware Simple E-Commerce System Payment summary.php access control

A vulnerability classified as critical has been found in SourceCodester Alphaware Simple E-Commerce System 1.0. This affects an unknown part of the file /alphaware/summary.php of the component Payment Handler. The manipulation of the argument amount leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221733 was assigned to this vulnerability.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Alphaware Simple E-commerce System Project

Products

Alphaware Simple E-commerce System

CVE-2023-0997

SourceCodester Moosikay E-Commerce System POST Parameter order.php sql injection

A vulnerability was found in SourceCodester Moosikay E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Moosikay/order.php of the component POST Parameter Handler. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221732.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Moosikay E-commerce System Project

Products

Moosikay E-commerce System

CVE-2023-0988

SourceCodester Online Pizza Ordering System cross-site request forgery

A vulnerability, which was classified as problematic, has been found in SourceCodester Online Pizza Ordering System 1.0. This issue affects some unknown processing of the file admin/ajax.php?action=save_user. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221681 was assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Online Pizza Ordering System Project

Products

Online Pizza Ordering System

CVE-2023-0986

SourceCodester Sales Tracker Management System Edit User sql injection

A vulnerability classified as critical has been found in SourceCodester Sales Tracker Management System 1.0. This affects an unknown part of the file admin/?page=user/manage_user of the component Edit User. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-221679.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sales Tracker Management System Project

Products

Sales Tracker Management System

CVE-2023-0982

SourceCodester Yoga Class Registration System Add Class Entry sql injection

A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Add Class Entry. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The identifier VDB-221677 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Yoga Class Registration System Project

Products

Yoga Class Registration System

CVE-2023-0981

SourceCodester Yoga Class Registration System Delete User sql injection

A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been classified as critical. Affected is an unknown function of the component Delete User. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-221676.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Yoga Class Registration System Project

Products

Yoga Class Registration System

CVE-2023-0980

SourceCodester Yoga Class Registration System Status Update update_status.php sql injection

A vulnerability was found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This issue affects some unknown processing of the file admin/registrations/update_status.php of the component Status Update Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-221675.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Yoga Class Registration System Project

Products

Yoga Class Registration System

CVE-2023-0966

SourceCodester Online Eyewear Shop cross site scripting

A vulnerability classified as problematic was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=orders/view_order. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221635.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Online Eyewear Shop

CVE-2023-0964

SourceCodester Sales Tracker Management System view_product.php sql injection

A vulnerability classified as critical has been found in SourceCodester Sales Tracker Management System 1.0. Affected is an unknown function of the file admin/products/view_product.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. VDB-221634 is the identifier assigned to this vulnerability.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Sales Tracker Management System Project

Products

Sales Tracker Management System

CVE-2023-0962

SourceCodester Music Gallery Site GET Request Master.php sql injection

A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been declared as critical. This vulnerability affects unknown code of the file Master.php of the component GET Request Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221632.

CVSS 3.1 · 6.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Music Gallery Site Project

Products

Music Gallery Site

CVE-2023-0961

SourceCodester Music Gallery Site GET Request view_music_details.php sql injection

A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been classified as critical. This affects an unknown part of the file view_music_details.php of the component GET Request Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221631.

CVSS 3.1 · 6.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Music Gallery Site Project

Products

Music Gallery Site

CVE-2023-0960

SeaCMS Picture Management config.ftp.php deserialization

A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /data/config.ftp.php of the component Picture Management. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-221630 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Seacms

Products

Seacms

CVE-2023-0938

SourceCodester Music Gallery Site GET Request music_list.php sql injection

A vulnerability classified as critical has been found in SourceCodester Music Gallery Site 1.0. This affects an unknown part of the file music_list.php of the component GET Request Handler. The manipulation of the argument cid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221553 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS 1.8% KEV · Not listed

Vendors

Music Gallery Site Project

Products

Music Gallery Site

CVE-2023-0925

Software AG webMethods OneData Deserialization Vulnerability

Version 10.11 of webMethods OneData runs an embedded instance of Azul Zulu Java 11.0.15 which hosts a Java RMI registry (listening on TCP port 2099 by default) and two RMI interfaces (listening on a single, dynamically assigned TCP high port). Port 2099 serves as a Java Remote Method Invocation (RMI) registry which allows for remotely loading and processing data via RMI interfaces. An unauthenticated attacker with network connectivity to the RMI registry and RMI interface ports can abuse this functionality to instruct the webMethods OneData application to load a malicious serialized Java object as a parameter to one of the available Java methods presented by the RMI interface. Once deserialized on the vulnerable server, the malicious code runs as whichever operating system account is used to run the software, which in most cases is the local System account on Windows.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Azul Microsoft Softwareag

Products

Zulu Windows Webmethods

CVE-2023-0923

Odh-notebook-controller-container: missing authorization allows for file contents disclosure

A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Data Science

CVE-2023-0916

SourceCodester Auto Dealer Management System Users.php access control

A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /adms/classes/Users.php. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221491.

CVSS 3.1 · 6.3 Medium EPSS 3.1% KEV · Not listed

Vendors

Auto Dealer Management System Project

Products

Auto Dealer Management System