CVE-2023-0627

Docker Desktop 4.11.x allows --no-windows-containers flag bypass

Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation (LPE).This issue affects Docker Desktop: 4.11.X.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Desktop

CVE-2023-0626

Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route

Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route. This issue affects Docker Desktop: before 4.12.0.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Desktop

CVE-2023-0625

Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog

Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog. This issue affects Docker Desktop: before 4.12.0.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Desktop

CVE-2023-0618

TRENDnet TEW-652BRP Web Service cfg_op.ccp memory corruption

A vulnerability was found in TRENDnet TEW-652BRP 3.04B01. It has been declared as critical. This vulnerability affects unknown code of the file cfg_op.ccp of the component Web Service. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-219958 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Trendnet

Products

Tew-652brp Tew-652brp Firmware

CVE-2023-0617

TRENDNet TEW-811DRU httpd guestnetwork.asp buffer overflow

A vulnerability was found in TRENDNet TEW-811DRU 1.0.10.0. It has been classified as critical. This affects an unknown part of the file /wireless/guestnetwork.asp of the component httpd. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219957 was assigned to this vulnerability.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed

Vendors

Trendnet

Products

Tew-811dru Tew-811dru Firmware

CVE-2023-0613

TRENDnet TEW-811DRU httpd security.asp memory corruption

A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /wireless/security.asp of the component httpd. The manipulation leads to memory corruption. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219937 was assigned to this vulnerability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Trendnet

Products

Tew-811dru Tew-811dru Firmware

CVE-2023-0612

TRENDnet TEW-811DRU httpd basic.asp buffer overflow

A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. Affected is an unknown function of the file /wireless/basic.asp of the component httpd. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219936.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Trendnet

Products

Tew-811dru Tew-811dru Firmware

CVE-2023-0604

WP Food Manager < 1.0.4 - Admin+ Stored XSS

The WP Food Manager WordPress plugin before 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wpfoodmanager

Products

Wp Food Manager

CVE-2023-0602

Twittee Text Tweet <= 1.0.8 - Reflected XSS

The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Johnniejodelljr

Products

Twittee Text Tweet

CVE-2023-0571

SourceCodester Canteen Management System Add Customer createcustomer.php cross site scripting

A vulnerability has been found in SourceCodester Canteen Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file createcustomer.php of the component Add Customer. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-219730 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Canteen Management System Project

Products

Canteen Management System

CVE-2023-0570

SourceCodester Online Tours & Travels Management System payment_operation.php sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file user\operations\payment_operation.php. The manipulation of the argument booking_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219729 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Online Tours \& Travels Management System Project

Products

Online Tours \& Travels Management System

CVE-2023-0563

PHPGurukul Bank Locker Management System Assign Locker add-locker-form.php cross site scripting

A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-form.php of the component Assign Locker. The manipulation of the argument ahname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219717 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS 37.6% KEV · Not listed

Vendors

Phpgurukul

Products

Bank Locker Management System

CVE-2023-0561

SourceCodester Online Tours & Travels Management System s.php sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file /user/s.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-219702 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Online Tours \& Travels Management System Project

Products

Online Tours \& Travels Management System

CVE-2023-0560

SourceCodester Online Tours & Travels Management System practice_pdf.php sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. This issue affects some unknown processing of the file admin/practice_pdf.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219701 was assigned to this vulnerability.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Online Tours \& Travels Management System Project

Products

Online Tours \& Travels Management System

CVE-2023-0551

REST API TO MiniProgram <= 4.6.1 - Subscriber+ Attachment Deletion

The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Minapper

Products

Rest Api To Miniprogram

CVE-2023-0534

SourceCodester Online Tours & Travels Management System expense_report.php sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file admin/expense_report.php. The manipulation of the argument to_date leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219603.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Online Tours \& Travels Management System Project

Products

Online Tours \& Travels Management System

CVE-2023-0531

SourceCodester Online Tours & Travels Management System booking_report.php sql injection

A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file admin/booking_report.php. The manipulation of the argument to_date leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219600.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Online Tours \& Travels Management System Project

Products

Online Tours \& Travels Management System

CVE-2023-0530

SourceCodester Online Tours & Travels Management System approve_user.php sql injection

A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/approve_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219599.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Online Tours \& Travels Management System Project

Products

Online Tours \& Travels Management System

CVE-2023-0528

SourceCodester Online Tours & Travels Management System abc.php sql injection

A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. This affects an unknown part of the file admin/abc.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219597 was assigned to this vulnerability.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Online Tours \& Travels Management System Project

Products

Online Tours \& Travels Management System

CVE-2023-0527

PHPGurukul Online Security Guards Hiring System search-request.php cross site scripting

A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file search-request.php. The manipulation of the argument searchdata with the input "><script>alert(document.domain)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219596.

CVSS 3.1 · 3.5 Low EPSS 6.3% KEV · Not listed

Vendors

Online Security Guards Hiring System Project

Products

Online Security Guards Hiring System