Search vulnerabilities

Expected end of text, found 'én' (at char 17), (line:1, col:18)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,898

CVE-2023-0908

Xoslab Easy File Locker xlkfs.sys MessageNotifyCallback denial of service

A vulnerability, which was classified as problematic, was found in Xoslab Easy File Locker 2.2.0.184. This affects the function MessageNotifyCallback in the library xlkfs.sys. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-221457 was assigned to this vulnerability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Xoslab
Products
Easy File Locker
CVE-2023-0907

Filseclab Twister Antivirus IoControlCode ffsmon.sys 0x220017 denial of service

A vulnerability, which was classified as problematic, has been found in Filseclab Twister Antivirus 8.17. Affected by this issue is the function 0x220017 in the library ffsmon.sys of the component IoControlCode Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221456.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Filseclab
Products
Twister Antivirus
CVE-2023-0906

SourceCodester Online Pizza Ordering System POST Parameter ajax.php delete_category missing authentication

A vulnerability classified as critical was found in SourceCodester Online Pizza Ordering System 1.0. Affected by this vulnerability is the function delete_category of the file ajax.php of the component POST Parameter Handler. The manipulation leads to missing authentication. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-221455.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Online Pizza Ordering System Project
Products
Online Pizza Ordering System
CVE-2023-0905

SourceCodester Employee Task Management System changePasswordForEmployee.php improper authentication

A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file changePasswordForEmployee.php. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221454 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS 3.2% KEV · Not listed
Vendors
Employee Task Management System Project
Products
Employee Task Management System
CVE-2023-0904

SourceCodester Employee Task Management System task-details.php sql injection

A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file task-details.php. The manipulation of the argument task_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221453 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Employee Task Management System Project
Products
Employee Task Management System
CVE-2023-0902

SourceCodester Simple Food Ordering System process_order.php cross site scripting

A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221451.

CVSS 3.1 · 3.5 Low EPSS 2.7% KEV · Not listed
Vendors
Simple Food Ordering System Project
Products
Simple Food Ordering System
CVE-2023-0883

SourceCodester Online Pizza Ordering System index.php sql injection

A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file /php-opos/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221350 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Online Pizza Ordering System Project
Products
Online Pizza Ordering System
CVE-2023-0872

ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users

The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.

CVSS 3.1 · 8.2 High EPSS 3.3% KEV · Not listed
Vendors
Opennms
Products
Horizon Meridian
CVE-2023-0869

Cross-site scripting in outage/list.htm

Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Opennms
Products
Horizon Meridian
CVE-2023-0868

Stealing Cookies using Reflected XSS via graph results

Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Opennms
Products
Horizon Meridian
CVE-2023-0867

Multiple stored and reflected Cross-site Scripting in webapp

Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Opennms
Products
Horizon Meridian
CVE-2023-0850

Netgear WNDR3700v2 Web Interface denial of service

A vulnerability was found in Netgear WNDR3700v2 1.0.1.14 and classified as problematic. This issue affects some unknown processing of the component Web Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221153 was assigned to this vulnerability.

CVSS 3.1 · 2.7 Low EPSS 1.0% KEV · Not listed
Vendors
Netgear
Products
Wndr3700 Wndr3700 Firmware
CVE-2023-0849

Netgear WNDR3700v2 Web Interface command injection

A vulnerability has been found in Netgear WNDR3700v2 1.0.1.14 and classified as critical. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221152.

CVSS 3.1 · 4.7 Medium EPSS 2.8% KEV · Not listed
Vendors
Netgear
Products
Wndr3700 Wndr3700 Firmware
CVE-2023-0848

Netgear WNDR3700v2 Web Management Interface denial of service

A vulnerability was found in Netgear WNDR3700v2 1.0.1.14. It has been rated as problematic. This issue affects some unknown processing of the component Web Management Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221147.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Netgear
Products
Wndr3700 Wndr3700 Firmware
CVE-2023-0846

Unauthenticated, stored XSS in display of alarm reduction-key

Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Opennms
Products
Horizon Meridian
CVE-2023-0829

Cross-Site Scripting (XSS) vulnerability in Plesk

Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additional user), can fully compromise the server if an administrator visits a certain page in Plesk related to the malicious subscription.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Plesk
Products
Plesk
CVE-2023-0828

Stored Cross Site Scripting in syslog section

Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers users server. This issue affects Pandora FMS v767 version and prior versions on all platforms.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Pandorafms
Products
Pandora Fms
CVE-2023-0813

Network-observability-console-plugin-container: setting loki authtoken configuration to disable or host mode leads to authentication longer being enforced

A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Network Observ Optr Network Observability
CVE-2023-0808

Deye/Revolt/Bosswerk Inverter Access Point Setting hard-coded password

A vulnerability was found in Deye/Revolt/Bosswerk Inverter MW3_15U_5406_1.47/MW3_15U_5406_1.471. It has been rated as problematic. This issue affects some unknown processing of the component Access Point Setting Handler. The manipulation with the input 12345678 leads to use of hard-coded password. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version MW3_16U_5406_1.53 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-220769 was assigned to this vulnerability.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Bosswerk Deyeinverter Revolt-power
Products
Inverter Inverter Firmware Inverter and 3 more
CVE-2023-0783

EcShop PHP File template.php unrestricted upload

A vulnerability was found in EcShop 4.1.5. It has been classified as critical. This affects an unknown part of the file /ecshop/admin/template.php of the component PHP File Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220641 was assigned to this vulnerability.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Shopex
Products
Ecshop