CVE-2023-0673

SourceCodester Online Eyewear Shop sql injection

A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is an unknown functionality of the file oews/?p=products/view_product.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The associated identifier of this vulnerability is VDB-220195.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Online Eyewear Shop

CVE-2023-0663

Calendar Event Management System Login Page sql injection

A vulnerability was found in Calendar Event Management System 2.3.0. It has been rated as critical. This issue affects some unknown processing of the component Login Page. The manipulation of the argument name/pwd leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-220175.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Calendar Event Management System Project

Products

Calendar Event Management System

CVE-2023-0658

Multilaser RE057/RE170 Backup File param.file.tgz information disclosure

A vulnerability, which was classified as critical, was found in Multilaser RE057 and RE170 2.1/2.2. This affects an unknown part of the file /param.file.tgz of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The identifier VDB-220053 was assigned to this vulnerability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Multilaser

Products

Re057 Re057 Firmware Re170 and 1 more

CVE-2023-0654

Spoofing User's Activity Loads in WARP Mobile Client (Android)

Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim's device, the attacker would be able to trick the user into believing that the app shown on the screen was the WARP client when in reality it was the attacker's app.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Cloudflare

Products

Warp

CVE-2023-0651

FastCMS Template Management unrestricted upload

A vulnerability was found in FastCMS 0.1.0. It has been classified as critical. Affected is an unknown function of the component Template Management. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Fastcms Project

Products

Fastcms

CVE-2023-0650

YAFNET Signature cross site scripting

A vulnerability was found in YAFNET up to 3.1.11 and classified as problematic. This issue affects some unknown processing of the component Signature Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.12 is able to address this issue. The identifier of the patch is a1442a2bacc3335461b44c250e81f8d99c60735f. It is recommended to upgrade the affected component. The identifier VDB-220037 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Yetanotherforum

Products

Yaf.net

CVE-2023-0648

dst-admin masterConsole command injection

A vulnerability, which was classified as critical, was found in dst-admin 1.5.0. This affects an unknown part of the file /home/masterConsole. The manipulation of the argument command leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-220035.

CVSS 3.1 · 6.3 Medium EPSS 3.1% KEV · Not listed

Vendors

Dst-admin Project

Products

Dst-admin

CVE-2023-0647

dst-admin kickPlayer command injection

A vulnerability, which was classified as critical, has been found in dst-admin 1.5.0. Affected by this issue is some unknown functionality of the file /home/kickPlayer. The manipulation of the argument userId leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-220034 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS 3.2% KEV · Not listed

Vendors

Dst-admin Project

Products

Dst-admin

CVE-2023-0641

PHPGurukul Employee Leaves Management System changepassword.php weak password

A vulnerability was found in PHPGurukul Employee Leaves Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file changepassword.php. The manipulation of the argument newpassword/confirmpassword leads to weak password requirements. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-220021 was assigned to this vulnerability.

CVSS 3.1 · 3.7 Low EPSS 1.0% KEV · Not listed

Vendors

Employee Leaves Management System Project

Products

Employee Leaves Management System

CVE-2023-0639

TRENDnet TEW-652BRP Web Management Interface get_set.ccp cross site scripting

A vulnerability was found in TRENDnet TEW-652BRP 3.04b01 and classified as problematic. This issue affects some unknown processing of the file get_set.ccp of the component Web Management Interface. The manipulation of the argument nextPage leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-220019.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Trendnet

Products

Tew-652brp Tew-652brp Firmware

CVE-2023-0638

TRENDnet TEW-811DRU Web Interface command injection

A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-220018 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.2 High EPSS 3.1% KEV · Not listed

Vendors

Trendnet

Products

Tew-811dru Tew-811dru Firmware

CVE-2023-0633

In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in LPE

In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in local privilege escalation (LPE).This issue affects Docker Desktop: before 4.12.0.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Desktop

CVE-2023-0627

Docker Desktop 4.11.x allows --no-windows-containers flag bypass

Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation (LPE).This issue affects Docker Desktop: 4.11.X.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Desktop

CVE-2023-0626

Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route

Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route. This issue affects Docker Desktop: before 4.12.0.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Desktop

CVE-2023-0625

Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog

Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog. This issue affects Docker Desktop: before 4.12.0.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Desktop

CVE-2023-0618

TRENDnet TEW-652BRP Web Service cfg_op.ccp memory corruption

A vulnerability was found in TRENDnet TEW-652BRP 3.04B01. It has been declared as critical. This vulnerability affects unknown code of the file cfg_op.ccp of the component Web Service. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-219958 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Trendnet

Products

Tew-652brp Tew-652brp Firmware

CVE-2023-0617

TRENDNet TEW-811DRU httpd guestnetwork.asp buffer overflow

A vulnerability was found in TRENDNet TEW-811DRU 1.0.10.0. It has been classified as critical. This affects an unknown part of the file /wireless/guestnetwork.asp of the component httpd. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219957 was assigned to this vulnerability.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed

Vendors

Trendnet

Products

Tew-811dru Tew-811dru Firmware

CVE-2023-0613

TRENDnet TEW-811DRU httpd security.asp memory corruption

A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /wireless/security.asp of the component httpd. The manipulation leads to memory corruption. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219937 was assigned to this vulnerability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Trendnet

Products

Tew-811dru Tew-811dru Firmware

CVE-2023-0612

TRENDnet TEW-811DRU httpd basic.asp buffer overflow

A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. Affected is an unknown function of the file /wireless/basic.asp of the component httpd. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219936.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Trendnet

Products

Tew-811dru Tew-811dru Firmware

CVE-2023-0604

WP Food Manager < 1.0.4 - Admin+ Stored XSS

The WP Food Manager WordPress plugin before 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wpfoodmanager

Products

Wp Food Manager