VYPR

CVEs

131,024 total · page 1455 of 2,621

AllCriticalHighKEV
  • CVE-2023-45912HigOct 18, 2023
    Wipotec
    Comscale
    risk 0.49cvss 7.5epss 0.01

    WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 fails to validate user sessions, allowing unauthenticated attackers to read files from the underlying operating system and obtain directory listings.

  • CVE-2023-46009HigOct 18, 2023
    Lcdf
    Gifsicle
    risk 0.51cvss 7.8epss 0.00

    gifsicle-1.94 was found to have a floating point exception (FPE) vulnerability via resize_stream at src/xform.c.

  • CVE-2023-45383HigOct 18, 2023
    Common-Services
    sonice_etiquetage
    risk 0.49cvss 7.5epss 0.01

    In the module "SoNice etiquetage" (sonice_etiquetage) up to version 2.5.9 from Common-Services for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the…

  • CVE-2023-43250HigOct 18, 2023
    XnSoft
    Nconvert
    risk 0.51cvss 7.8epss 0.01

    XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow. There is a User Mode Write AV via a crafted image file. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.

  • CVE-2023-45632HigOct 18, 2023
    Web Dorado
    Spidervplayer
    risk 0.46cvss 7.1epss 0.00

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado SpiderVPlayer plugin <= 1.5.22 versions.

  • CVE-2023-45602HigOct 18, 2023
    Shopfiles
    Ebook Store
    risk 0.46cvss 7.1epss 0.00

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Shopfiles Ltd Ebook Store plugin <= 5.785 versions.

  • CVE-2023-30781HigOct 18, 2023
    Themeblvd
    Tweeple
    risk 0.46cvss 7.1epss 0.00

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Theme Blvd Tweeple plugin <= 0.9.5 versions.

  • CVE-2023-46004HigOct 18, 2023
    Sourcecodester
    Best Courier Management System
    risk 0.47cvss 7.2epss 0.01

    Sourcecodester Best Courier Management System 1.0 is vulnerable to Arbitrary file upload in the update_user function.

  • CVE-2023-45071HigOct 18, 2023
    WordPress
    Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
    risk 0.46cvss 7.1epss 0.00

    Unauth. Stored Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.18 versions.

  • CVE-2023-45070HigOct 18, 2023
    WordPress
    Form Maker by 10Web
    risk 0.46cvss 7.1epss 0.00

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.18 versions.

  • CVE-2023-45065HigOct 18, 2023
    WordPress
    Bulk Noindex & Nofollow Toolkit
    risk 0.46cvss 7.1epss 0.00

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mad Fish Digital Bulk NoIndex & NoFollow Toolkit plugin <= 1.42 versions.

  • CVE-2023-45727HigKEVOct 18, 2023
    Proself
    Gateway Edition
    risk 0.61cvss 7.5epss 0.05

    Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted…

  • CVE-2023-5632HigOct 18, 2023
    Eclipse
    Mosquitto
    risk 0.00cvss 7.5epss 0.01

    In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type…

  • CVE-2023-45064HigOct 18, 2023
    Extend Wings
    OPcache Dashboard plugin
    risk 0.46cvss 7.1epss 0.00

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Daisuke Takahashi(Extend Wings) OPcache Dashboard plugin <= 0.3.1 versions.

  • CVE-2023-45062HigOct 18, 2023
    Thomas Scholl
    canvasio3D Light
    risk 0.46cvss 7.1epss 0.00

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Thomas Scholl canvasio3D Light plugin <= 2.4.6 versions.

  • CVE-2023-45054HigOct 18, 2023
    Awesome Togi
    Product Category Tree
    risk 0.46cvss 7.1epss 0.00

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AWESOME TOGI Product Category Tree plugin <= 2.5 versions.

  • CVE-2023-25476HigOct 18, 2023
    Ezoic
    Ampedsense
    risk 0.46cvss 7.1epss 0.00

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ezoic AmpedSense – AdSense Split Tester plugin <= 4.68 versions.

  • CVE-2023-42319HigOct 18, 2023
    Ethereum
    Go Ethereum
    risk 0.49cvss 7.5epss 0.01

    Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand…

  • CVE-2023-5538HigOct 18, 2023
    WordPress
    MpOperationLogs
    risk 0.47cvss 7.2epss 0.01

    The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…

  • CVE-2023-39331HigOct 18, 2023
    Node.js
    Node.js
    risk 0.49cvss 7.5epss 0.02

    A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined…

  • CVE-2023-38552HigOct 18, 2023
    Node.js
    Node.js
    risk 0.49cvss 7.5epss 0.01

    When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This…

  • CVE-2023-5626HigOct 18, 2023
    Pkp
    Ojs
    risk 0.00cvss 8.8epss 0.00

    Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.

  • CVE-2023-5552HigOct 18, 2023
    Sophos
    Firewall
    risk 0.46cvss 7.1epss 0.01

    A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the password type is set to “Specified by sender”.

  • CVE-2023-45811HigOct 17, 2023
    Relative
    Synchrony
    risk 0.46cvss 8.1epss 0.00

    Synchrony deobfuscator is a javascript cleaner & deobfuscator. A `__proto__` pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A `__proto__` pollution vulnerability exists in the `LiteralMap` transformer…

  • CVE-2023-42507HigOct 17, 2023
    OnSinView2
    OnSinView2
    risk 0.51cvss 7.8epss 0.00

    Stack-based buffer overflow vulnerability exists in OnSinView2 versions 2.0.1 and earlier. If this vulnerability is exploited, information may be disclosed or arbitrary code may be executed by having a user open a specially crafted OnSinView2 project file.

  • CVE-2023-42506HigOct 17, 2023
    OnSinView2
    OnSinView2
    risk 0.51cvss 7.8epss 0.00

    Improper restriction of operations within the bounds of a memory buffer issue exists in OnSinView2 versions 2.0.1 and earlier. If this vulnerability is exploited, information may be disclosed or arbitrary code may be executed by having a user open a specially crafted OnSinView2…

  • CVE-2023-41715HigOct 17, 2023
    SonicWall
    Sonicos
    risk 0.57cvss 8.8epss 0.01

    SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileges inside the tunnel.

  • CVE-2023-41713HigOct 17, 2023
    SonicWall
    Sonicos
    risk 0.49cvss 7.5epss 0.01

    SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function.

  • CVE-2023-36321HigOct 17, 2023
    Covesa
    dlt-daemon
    risk 0.00cvss 7.5epss 0.01

    Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 was discovered to contain a buffer overflow via the component /shared/dlt_common.c.

  • CVE-2023-41631HigOct 17, 2023
    eSST
    Esst Monitoring
    risk 0.57cvss 8.8epss 0.01

    eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the file upload function.

  • CVE-2023-41629HigOct 17, 2023
    eSST
    Esst Monitoring
    risk 0.49cvss 7.5epss 0.01

    A lack of input sanitizing in the file download feature of eSST Monitoring v2.147.1 allows attackers to execute a path traversal.

  • CVE-2023-22108HigOct 17, 2023
    Oracle Corporation
    Weblogic Server
    risk 0.49cvss 7.5epss 0.01

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to…

  • CVE-2023-22102HigOct 17, 2023
    NetApp
    Oncommand Insight
    risk 0.54cvss 8.3epss 0.01

    Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL…

  • CVE-2023-22101HigOct 17, 2023
    Oracle Corporation
    Weblogic Server
    risk 0.53cvss 8.1epss 0.01

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to…

  • CVE-2023-22100HigOct 17, 2023
    Oracle Corporation
    VM Virtualbox
    risk 0.51cvss 7.9epss 0.00

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox…

  • CVE-2023-22099HigOct 17, 2023
    Oracle Corporation
    VM Virtualbox
    risk 0.53cvss 8.2epss 0.00

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox…

  • CVE-2023-22098HigOct 17, 2023
    Oracle Corporation
    VM Virtualbox
    risk 0.53cvss 8.2epss 0.01

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox…

  • CVE-2023-22094HigOct 17, 2023
    Oracle Corporation
    Mysql Installer
    risk 0.51cvss 7.9epss 0.00

    Vulnerability in the MySQL Installer product of Oracle MySQL (component: Installer: General). Supported versions that are affected are Prior to 1.6.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Installer executes…

  • CVE-2023-22087HigOct 17, 2023
    Oracle Corporation
    Hospitality Opera 5 Property Services
    risk 0.57cvss 8.8epss 0.01

    Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). The supported version that is affected is 5.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise…

  • CVE-2023-22086HigOct 17, 2023
    Oracle Corporation
    Weblogic Server
    risk 0.49cvss 7.5epss 0.01

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to…

  • CVE-2023-22085HigOct 17, 2023
    Oracle Corporation
    Hospitality Opera 5 Property Services
    risk 0.57cvss 8.8epss 0.01

    Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). The supported version that is affected is 5.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise…

  • CVE-2023-22019HigOct 17, 2023
    Oracle Corporation
    HTTP Server
    risk 0.49cvss 7.5epss 0.01

    Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP…

  • CVE-2023-37537HigOct 17, 2023
    HCLTech
    Appscan Presence
    risk 0.51cvss 7.8epss 0.00

    An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gain elevated privileges.

  • CVE-2023-45907HigOct 17, 2023
    Dreamer CMS
    Dreamer CMS
    risk 0.57cvss 8.8epss 0.00

    Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/delete.

  • CVE-2023-45906HigOct 17, 2023
    Dreamer CMS
    Dreamer CMS
    risk 0.57cvss 8.8epss 0.00

    Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/user/add.

  • CVE-2023-45905HigOct 17, 2023
    Dreamer
    CMS
    risk 0.57cvss 8.8epss 0.00

    Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/add.

  • CVE-2023-45904HigOct 17, 2023
    Dreamer CMS
    Dreamer CMS
    risk 0.57cvss 8.8epss 0.00

    Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /variable/update.

  • CVE-2023-45903HigOct 17, 2023
    Dreamer CMS
    Dreamer CMS
    risk 0.57cvss 8.8epss 0.00

    Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/label/delete.

  • CVE-2023-45902HigOct 17, 2023
    Dreamer CMS
    Dreamer CMS
    risk 0.57cvss 8.8epss 0.00

    Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/attachment/delete.

  • CVE-2023-45901HigOct 17, 2023
    Dreamer
    CMS
    risk 0.57cvss 8.8epss 0.00

    Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin\/category\/add.