CVE-2023-0914

Improper Authorization in pixelfed/pixelfed

Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pixelfed

Products

Pixelfed

CVE-2023-0913

SourceCodester Auto Dealer Management System sql injection

A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. This vulnerability affects unknown code of the file /adms/admin/?page=vehicles/sell_vehicle. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221482 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.7 Medium EPSS 1.6% KEV · Not listed

Vendors

Auto Dealer Management System Project

Products

Auto Dealer Management System

CVE-2023-0912

SourceCodester Auto Dealer Management System sql injection

A vulnerability classified as critical has been found in SourceCodester Auto Dealer Management System 1.0. This affects an unknown part of the file /adms/admin/?page=vehicles/view_transaction. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221481 was assigned to this vulnerability.

CVSS 3.1 · 4.7 Medium EPSS 1.6% KEV · Not listed

Vendors

Auto Dealer Management System Project

Products

Auto Dealer Management System

CVE-2023-0910

SourceCodester Online Pizza Ordering System GET Parameter view_prod.php sql injection

A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file view_prod.php of the component GET Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-221476.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Online Pizza Ordering System Project

Products

Online Pizza Ordering System

CVE-2023-0909

cxasm notepad-- Directory Comparison denial of service

A vulnerability, which was classified as problematic, was found in cxasm notepad-- 1.22. This affects an unknown part of the component Directory Comparison Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The associated identifier of this vulnerability is VDB-221475.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Notepad-- Project

Products

Notepad--

CVE-2023-0908

Xoslab Easy File Locker xlkfs.sys MessageNotifyCallback denial of service

A vulnerability, which was classified as problematic, was found in Xoslab Easy File Locker 2.2.0.184. This affects the function MessageNotifyCallback in the library xlkfs.sys. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-221457 was assigned to this vulnerability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xoslab

Products

Easy File Locker

CVE-2023-0907

Filseclab Twister Antivirus IoControlCode ffsmon.sys 0x220017 denial of service

A vulnerability, which was classified as problematic, has been found in Filseclab Twister Antivirus 8.17. Affected by this issue is the function 0x220017 in the library ffsmon.sys of the component IoControlCode Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221456.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Filseclab

Products

Twister Antivirus

CVE-2023-0906

SourceCodester Online Pizza Ordering System POST Parameter ajax.php delete_category missing authentication

A vulnerability classified as critical was found in SourceCodester Online Pizza Ordering System 1.0. Affected by this vulnerability is the function delete_category of the file ajax.php of the component POST Parameter Handler. The manipulation leads to missing authentication. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-221455.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Online Pizza Ordering System Project

Products

Online Pizza Ordering System

CVE-2023-0905

SourceCodester Employee Task Management System changePasswordForEmployee.php improper authentication

A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file changePasswordForEmployee.php. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221454 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS 3.2% KEV · Not listed

Vendors

Employee Task Management System Project

Products

Employee Task Management System

CVE-2023-0904

SourceCodester Employee Task Management System task-details.php sql injection

A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file task-details.php. The manipulation of the argument task_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221453 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Employee Task Management System Project

Products

Employee Task Management System

CVE-2023-0902

SourceCodester Simple Food Ordering System process_order.php cross site scripting

A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221451.

CVSS 3.1 · 3.5 Low EPSS 2.7% KEV · Not listed

Vendors

Simple Food Ordering System Project

Products

Simple Food Ordering System

CVE-2023-0883

SourceCodester Online Pizza Ordering System index.php sql injection

A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file /php-opos/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221350 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Online Pizza Ordering System Project

Products

Online Pizza Ordering System

CVE-2023-0872

ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users

The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.

CVSS 3.1 · 8.2 High EPSS 3.3% KEV · Not listed

Vendors

Opennms

Products

Horizon Meridian

CVE-2023-0869

Cross-site scripting in outage/list.htm

Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Opennms

Products

Horizon Meridian

CVE-2023-0868

Stealing Cookies using Reflected XSS via graph results

Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Opennms

Products

Horizon Meridian

CVE-2023-0867

Multiple stored and reflected Cross-site Scripting in webapp

Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Opennms

Products

Horizon Meridian

CVE-2023-0850

Netgear WNDR3700v2 Web Interface denial of service

A vulnerability was found in Netgear WNDR3700v2 1.0.1.14 and classified as problematic. This issue affects some unknown processing of the component Web Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221153 was assigned to this vulnerability.

CVSS 3.1 · 2.7 Low EPSS 1.0% KEV · Not listed

Vendors

Netgear

Products

Wndr3700 Wndr3700 Firmware

CVE-2023-0849

Netgear WNDR3700v2 Web Interface command injection

A vulnerability has been found in Netgear WNDR3700v2 1.0.1.14 and classified as critical. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221152.

CVSS 3.1 · 4.7 Medium EPSS 2.8% KEV · Not listed

Vendors

Netgear

Products

Wndr3700 Wndr3700 Firmware

CVE-2023-0848

Netgear WNDR3700v2 Web Management Interface denial of service

A vulnerability was found in Netgear WNDR3700v2 1.0.1.14. It has been rated as problematic. This issue affects some unknown processing of the component Web Management Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221147.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Wndr3700 Wndr3700 Firmware

CVE-2023-0846

Unauthenticated, stored XSS in display of alarm reduction-key

Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Opennms

Products

Horizon Meridian