Search vulnerabilities

Expected end of text, found '‑' (at char 7), (line:1, col:8)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,868

CVE-2023-0960

SeaCMS Picture Management config.ftp.php deserialization

A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /data/config.ftp.php of the component Picture Management. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-221630 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Seacms
Products
Seacms
CVE-2023-0938

SourceCodester Music Gallery Site GET Request music_list.php sql injection

A vulnerability classified as critical has been found in SourceCodester Music Gallery Site 1.0. This affects an unknown part of the file music_list.php of the component GET Request Handler. The manipulation of the argument cid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221553 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Music Gallery Site Project
Products
Music Gallery Site
CVE-2023-0925

Software AG webMethods OneData Deserialization Vulnerability

Version 10.11 of webMethods OneData runs an embedded instance of Azul Zulu Java 11.0.15 which hosts a Java RMI registry (listening on TCP port 2099 by default) and two RMI interfaces (listening on a single, dynamically assigned TCP high port). Port 2099 serves as a Java Remote Method Invocation (RMI) registry which allows for remotely loading and processing data via RMI interfaces. An unauthenticated attacker with network connectivity to the RMI registry and RMI interface ports can abuse this functionality to instruct the webMethods OneData application to load a malicious serialized Java object as a parameter to one of the available Java methods presented by the RMI interface. Once deserialized on the vulnerable server, the malicious code runs as whichever operating system account is used to run the software, which in most cases is the local System account on Windows.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Azul Microsoft Softwareag
Products
Zulu Windows Webmethods
CVE-2023-0923

Odh-notebook-controller-container: missing authorization allows for file contents disclosure

A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Data Science
CVE-2023-0916

SourceCodester Auto Dealer Management System Users.php access control

A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /adms/classes/Users.php. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221491.

CVSS 3.1 · 6.3 Medium EPSS 3.1% KEV · Not listed
Vendors
Auto Dealer Management System Project
Products
Auto Dealer Management System
CVE-2023-0914

Improper Authorization in pixelfed/pixelfed

Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pixelfed
Products
Pixelfed
CVE-2023-0913

SourceCodester Auto Dealer Management System sql injection

A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. This vulnerability affects unknown code of the file /adms/admin/?page=vehicles/sell_vehicle. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221482 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.7 Medium EPSS 1.6% KEV · Not listed
Vendors
Auto Dealer Management System Project
Products
Auto Dealer Management System
CVE-2023-0912

SourceCodester Auto Dealer Management System sql injection

A vulnerability classified as critical has been found in SourceCodester Auto Dealer Management System 1.0. This affects an unknown part of the file /adms/admin/?page=vehicles/view_transaction. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221481 was assigned to this vulnerability.

CVSS 3.1 · 4.7 Medium EPSS 1.6% KEV · Not listed
Vendors
Auto Dealer Management System Project
Products
Auto Dealer Management System
CVE-2023-0910

SourceCodester Online Pizza Ordering System GET Parameter view_prod.php sql injection

A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file view_prod.php of the component GET Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-221476.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Online Pizza Ordering System Project
Products
Online Pizza Ordering System
CVE-2023-0909

cxasm notepad-- Directory Comparison denial of service

A vulnerability, which was classified as problematic, was found in cxasm notepad-- 1.22. This affects an unknown part of the component Directory Comparison Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The associated identifier of this vulnerability is VDB-221475.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Notepad-- Project
Products
Notepad--
CVE-2023-0908

Xoslab Easy File Locker xlkfs.sys MessageNotifyCallback denial of service

A vulnerability, which was classified as problematic, was found in Xoslab Easy File Locker 2.2.0.184. This affects the function MessageNotifyCallback in the library xlkfs.sys. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-221457 was assigned to this vulnerability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Xoslab
Products
Easy File Locker
CVE-2023-0907

Filseclab Twister Antivirus IoControlCode ffsmon.sys 0x220017 denial of service

A vulnerability, which was classified as problematic, has been found in Filseclab Twister Antivirus 8.17. Affected by this issue is the function 0x220017 in the library ffsmon.sys of the component IoControlCode Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221456.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Filseclab
Products
Twister Antivirus
CVE-2023-0906

SourceCodester Online Pizza Ordering System POST Parameter ajax.php delete_category missing authentication

A vulnerability classified as critical was found in SourceCodester Online Pizza Ordering System 1.0. Affected by this vulnerability is the function delete_category of the file ajax.php of the component POST Parameter Handler. The manipulation leads to missing authentication. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-221455.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Online Pizza Ordering System Project
Products
Online Pizza Ordering System
CVE-2023-0905

SourceCodester Employee Task Management System changePasswordForEmployee.php improper authentication

A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file changePasswordForEmployee.php. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221454 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS 3.2% KEV · Not listed
Vendors
Employee Task Management System Project
Products
Employee Task Management System
CVE-2023-0904

SourceCodester Employee Task Management System task-details.php sql injection

A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file task-details.php. The manipulation of the argument task_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221453 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Employee Task Management System Project
Products
Employee Task Management System
CVE-2023-0902

SourceCodester Simple Food Ordering System process_order.php cross site scripting

A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221451.

CVSS 3.1 · 3.5 Low EPSS 2.7% KEV · Not listed
Vendors
Simple Food Ordering System Project
Products
Simple Food Ordering System
CVE-2023-0883

SourceCodester Online Pizza Ordering System index.php sql injection

A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file /php-opos/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221350 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Online Pizza Ordering System Project
Products
Online Pizza Ordering System
CVE-2023-0872

ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users

The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.

CVSS 3.1 · 8.2 High EPSS 3.3% KEV · Not listed
Vendors
Opennms
Products
Horizon Meridian
CVE-2023-0869

Cross-site scripting in outage/list.htm

Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Opennms
Products
Horizon Meridian
CVE-2023-0868

Stealing Cookies using Reflected XSS via graph results

Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Opennms
Products
Horizon Meridian