CVE-2023-0872

ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users

The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.

CVSS 3.1 · 8.2 High EPSS 3.3% KEV · Not listed

Vendors

Opennms

Products

Horizon Meridian

CVE-2023-0869

Cross-site scripting in outage/list.htm

Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Opennms

Products

Horizon Meridian

CVE-2023-0868

Stealing Cookies using Reflected XSS via graph results

Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Opennms

Products

Horizon Meridian

CVE-2023-0867

Multiple stored and reflected Cross-site Scripting in webapp

Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Opennms

Products

Horizon Meridian

CVE-2023-0850

Netgear WNDR3700v2 Web Interface denial of service

A vulnerability was found in Netgear WNDR3700v2 1.0.1.14 and classified as problematic. This issue affects some unknown processing of the component Web Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221153 was assigned to this vulnerability.

CVSS 3.1 · 2.7 Low EPSS 1.0% KEV · Not listed

Vendors

Netgear

Products

Wndr3700 Wndr3700 Firmware

CVE-2023-0849

Netgear WNDR3700v2 Web Interface command injection

A vulnerability has been found in Netgear WNDR3700v2 1.0.1.14 and classified as critical. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221152.

CVSS 3.1 · 4.7 Medium EPSS 2.8% KEV · Not listed

Vendors

Netgear

Products

Wndr3700 Wndr3700 Firmware

CVE-2023-0848

Netgear WNDR3700v2 Web Management Interface denial of service

A vulnerability was found in Netgear WNDR3700v2 1.0.1.14. It has been rated as problematic. This issue affects some unknown processing of the component Web Management Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221147.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Wndr3700 Wndr3700 Firmware

CVE-2023-0846

Unauthenticated, stored XSS in display of alarm reduction-key

Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Opennms

Products

Horizon Meridian

CVE-2023-0829

Cross-Site Scripting (XSS) vulnerability in Plesk

Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additional user), can fully compromise the server if an administrator visits a certain page in Plesk related to the malicious subscription.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Plesk

Products

Plesk

CVE-2023-0828

Stored Cross Site Scripting in syslog section

Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers users server. This issue affects Pandora FMS v767 version and prior versions on all platforms.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Pandorafms

Products

Pandora Fms

CVE-2023-0813

Network-observability-console-plugin-container: setting loki authtoken configuration to disable or host mode leads to authentication longer being enforced

A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Network Observ Optr Network Observability

CVE-2023-0808

Deye/Revolt/Bosswerk Inverter Access Point Setting hard-coded password

A vulnerability was found in Deye/Revolt/Bosswerk Inverter MW3_15U_5406_1.47/MW3_15U_5406_1.471. It has been rated as problematic. This issue affects some unknown processing of the component Access Point Setting Handler. The manipulation with the input 12345678 leads to use of hard-coded password. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version MW3_16U_5406_1.53 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-220769 was assigned to this vulnerability.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Bosswerk Deyeinverter Revolt-power

Products

Inverter Inverter Firmware Inverter and 3 more

CVE-2023-0783

EcShop PHP File template.php unrestricted upload

A vulnerability was found in EcShop 4.1.5. It has been classified as critical. This affects an unknown part of the file /ecshop/admin/template.php of the component PHP File Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220641 was assigned to this vulnerability.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Shopex

Products

Ecshop

CVE-2023-0781

SourceCodester Canteen Management System removeOrder.php query sql injection

A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects the function query of the file removeOrder.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220624.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Canteen Management System Project

Products

Canteen Management System

CVE-2023-0774

SourceCodester Medical Certificate Generator App action.php sql injection

A vulnerability has been found in SourceCodester Medical Certificate Generator App 1.0 and classified as critical. This vulnerability affects unknown code of the file action.php. The manipulation of the argument lastname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-220558 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Medical Certificate Generator App Project

Products

Medical Certificate Generator App

CVE-2023-0773

Unauthorized Access Control Vulnerability in Uniview IP Camera

The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device. Successful exploitation of this vulnerability could allow the attacker to gain complete control of the targeted device.

CVSS 3.1 · 9.1 Critical EPSS 1.2% KEV · Not listed

Vendors

Uniview

Products

Ip Camera Ipc322lb-sf28-a Ipc322lb-sf28-a Ipc322lb-sf28-a Firmware

CVE-2023-0770

Stack-based Buffer Overflow in gpac/gpac

Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Gpac

Products

Debian Linux Gpac

CVE-2023-0757

Phoenix Contact ProConOS prone to Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Phoenixcontact

Products

Multiprog Proconos Eclr

CVE-2023-0707

SourceCodester Medical Certificate Generator App function.php delete_record sql injection

A vulnerability was found in SourceCodester Medical Certificate Generator App 1.0. It has been rated as critical. Affected by this issue is the function delete_record of the file function.php. The manipulation of the argument id leads to sql injection. VDB-220346 is the identifier assigned to this vulnerability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Medical Certificate Generator App Project

Products

Medical Certificate Generator App

CVE-2023-0706

SourceCodester Medical Certificate Generator App manage_record.php sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Medical Certificate Generator App 1.0. Affected by this issue is some unknown functionality of the file manage_record.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-220340.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Medical Certificate Generator App Project

Products

Medical Certificate Generator App