| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-4751 | Hig | 0.51 | 7.8 | 0.01 | Sep 3, 2023 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331. | ||
| CVE-2023-39374 | Hig | 0.51 | 7.8 | 0.00 | Sep 3, 2023 | ForeScout NAC SecureConnector version 11.2 - CWE-427: Uncontrolled Search Path Element | ||
| CVE-2023-39373 | Hig | 0.48 | 7.4 | 0.00 | Sep 3, 2023 | A Hyundai model (2017) - CWE-294: Authentication Bypass by Capture-replay. | ||
| CVE-2023-39372 | Hig | 0.53 | 8.1 | 0.00 | Sep 3, 2023 | StarTrinity Softswitch version 2023-02-16 - Multiple CSRF (CWE-352) | ||
| CVE-2023-39371 | Hig | 0.57 | 8.8 | 0.00 | Sep 3, 2023 | StarTrinity Softswitch version 2023-02-16 - Open Redirect (CWE-601) | ||
| CVE-2023-39370 | Hig | 0.57 | 8.8 | 0.00 | Sep 3, 2023 | StarTrinity Softswitch version 2023-02-16 - Persistent XSS (CWE-79) | ||
| CVE-2023-39369 | Hig | 0.57 | 8.8 | 0.00 | Sep 3, 2023 | StarTrinity Softswitch version 2023-02-16 - Multiple Reflected XSS (CWE-79) | ||
| CVE-2023-37221 | Hig | 0.57 | 8.8 | 0.00 | Sep 3, 2023 | 7Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). | ||
| CVE-2023-37220 | Hig | 0.47 | 7.2 | 0.00 | Sep 3, 2023 | Synel Terminals - CWE-494: Download of Code Without Integrity Check | ||
| CVE-2023-4738 | Hig | 0.51 | 7.8 | 0.01 | Sep 2, 2023 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848. | ||
| CVE-2023-4736 | Hig | 0.51 | 7.8 | 0.01 | Sep 2, 2023 | Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833. | ||
| CVE-2023-4735 | Hig | 0.51 | 7.8 | 0.01 | Sep 2, 2023 | Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847. | ||
| CVE-2023-4734 | Hig | 0.51 | 7.8 | 0.01 | Sep 2, 2023 | Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. | ||
| CVE-2023-39982 | Hig | 0.49 | 7.5 | 0.00 | Sep 2, 2023 | A vulnerability has been identified in MXsecurity versions prior to v1.0.1. The vulnerability may put the confidentiality and integrity of SSH communications at risk on the affected device. This vulnerability is attributed to a hard-coded SSH host key, which might facilitate… | ||
| CVE-2023-39981 | Hig | 0.49 | 7.5 | 0.01 | Sep 2, 2023 | A vulnerability that allows for unauthorized access has been discovered in MXsecurity versions prior to v1.0.1. This vulnerability arises from inadequate authentication measures, potentially leading to the disclosure of device information by a remote attacker. | ||
| CVE-2023-39980 | Hig | 0.46 | 7.1 | 0.01 | Sep 2, 2023 | A vulnerability that allows the unauthorized disclosure of authenticated information has been identified in MXsecurity versions prior to v1.0.1. This vulnerability arises when special elements are not neutralized correctly, allowing remote attackers to alter SQL commands. | ||
| CVE-2023-3297 | Hig | 0.53 | 8.1 | 0.00 | Sep 1, 2023 | In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process. | ||
| CVE-2023-41049 | Hig | 0.42 | 7.5 | 0.00 | Sep 1, 2023 | @dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the `init` function allows arbitrary javascript to be executed using the `javascript:` prefix. This vulnerability has been patched on… | ||
| CVE-2023-41628 | Hig | 0.49 | 7.5 | 0.02 | Sep 1, 2023 | An issue in O-RAN Software Community E2 G-Release allows attackers to cause a Denial of Service (DoS) by incorrectly initiating the messaging procedure between the E2Node and E2Term components. | ||
| CVE-2023-41627 | Hig | 0.49 | 7.5 | 0.01 | Sep 1, 2023 | O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged routing tables to the device. | ||
| CVE-2023-40968 | Hig | 0.49 | 7.5 | 0.01 | Sep 1, 2023 | Buffer Overflow vulnerability in hzeller timg v.1.5.1 and before allows a remote attacker to cause a denial of service via the 0x61200000045c address. | ||
| CVE-2023-40771 | Hig | 0.49 | 7.5 | 0.01 | Sep 1, 2023 | SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function. | ||
| CVE-2023-36088 | Hig | 0.49 | 7.5 | 0.01 | Sep 1, 2023 | Server Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information. | ||
| CVE-2023-28366 | Hig | 0.00 | 7.5 | 0.01 | Sep 1, 2023 | The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc… | ||
| CVE-2023-37997 | Hig | 0.46 | 7.1 | 0.00 | Sep 1, 2023 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Dharmesh Patel Post List With Featured Image plugin <= 1.2 versions. | ||
| CVE-2023-37893 | Hig | 0.46 | 7.1 | 0.00 | Sep 1, 2023 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Chop-Chop Coming Soon Chop Chop plugin <= 2.2.4 versions. | ||
| CVE-2023-34011 | Hig | 0.46 | 7.1 | 0.00 | Sep 1, 2023 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ShopConstruct plugin <= 1.1.2 versions. | ||
| CVE-2023-40970 | Hig | 0.57 | 8.8 | 0.01 | Sep 1, 2023 | Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loan_rules.php. | ||
| CVE-2023-40239 | Hig | 0.49 | 7.5 | 0.01 | Sep 1, 2023 | Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e., '*' indicates that the full version specification varies across product model family, but firmware level P246 (or… | ||
| CVE-2022-46527 | Hig | 0.49 | 7.5 | 0.01 | Sep 1, 2023 | ELSYS ERS 1.5 Sound v2.3.8 was discovered to contain a buffer overflow via the NFC data parser. | ||
| CVE-2023-39685 | Hig | 0.42 | 7.5 | 0.01 | Sep 1, 2023 | An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string. | ||
| CVE-2023-24674 | Hig | 0.51 | 7.8 | 0.00 | Sep 1, 2023 | Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin parameter. | ||
| CVE-2023-4698 | Hig | 0.42 | 7.5 | 0.01 | Sep 1, 2023 | Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2. | ||
| CVE-2023-4697 | Hig | 0.50 | 8.8 | 0.01 | Sep 1, 2023 | Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2. | ||
| CVE-2023-4695 | Hig | 0.00 | 8.1 | 0.01 | Sep 1, 2023 | Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16. | ||
| CVE-2023-4481 | Hig | 0.50 | 7.5 | 0.18 | Sep 1, 2023 | An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When certain specific crafted BGP UPDATE messages are received… | ||
| CVE-2023-40187 | Hig | 0.48 | 7.3 | 0.01 | Aug 31, 2023 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of the 3.x beta branch are subject to a Use-After-Free issue in the `avc420_ensure_buffer` and `avc444_ensure_buffer` functions. If the value of… | ||
| CVE-2023-41749 | Hig | 0.49 | 7.5 | 0.00 | Aug 31, 2023 | Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Windows) before build 32047, Acronis Cyber Protect 15 (Windows) before build 35979. | ||
| CVE-2023-39355 | Hig | 0.00 | 7.0 | 0.01 | Aug 31, 2023 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Versions of FreeRDP on the 3.x release branch before beta3 are subject to a Use-After-Free in processing `RDPGFX_CMDID_RESETGRAPHICS` packets. If `context->maxPlaneSize` is… | ||
| CVE-2022-46869 | Hig | 0.51 | 7.8 | 0.00 | Aug 31, 2023 | Local privilege escalation during installation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis True Image OEM (Windows) before build 42575. | ||
| CVE-2023-41744 | Hig | 0.51 | 7.8 | 0.00 | Aug 31, 2023 | Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Agent (macOS) before build 30600, Acronis Cyber Protect 15 (macOS) before build 35979. | ||
| CVE-2023-41743 | Hig | 0.51 | 7.8 | 0.00 | Aug 31, 2023 | Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis Cyber Protect Cloud Agent (Windows) before build 31637, Acronis Cyber Protect 15… | ||
| CVE-2023-34392 | Hig | 0.53 | 8.2 | 0.00 | Aug 31, 2023 | A Missing Authentication for Critical Function vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run arbitrary commands on managed devices by an authorized device operator. See Instruction Manual Appendix A… | ||
| CVE-2023-34391 | Hig | 0.48 | 7.4 | 0.00 | Aug 31, 2023 | Insecure Inherited Permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows allows Leveraging/Manipulating Configuration File Search Paths. See Instruction Manual Appendix A [Cybersecurity] tag dated 20230522 for more… | ||
| CVE-2023-31175 | Hig | 0.57 | 8.8 | 0.00 | Aug 31, 2023 | An Execution with Unnecessary Privileges vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run system commands with the highest level privilege on the system. See Instruction Manual Appendix A and Appendix E… | ||
| CVE-2023-31174 | Hig | 0.48 | 7.4 | 0.00 | Aug 31, 2023 | A Cross-Site Request Forgery (CSRF) vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to embed instructions that could be executed by an authorized device operator. See Instruction Manual Appendix A and Appendix… | ||
| CVE-2023-31173 | Hig | 0.50 | 7.7 | 0.00 | Aug 31, 2023 | Use of Hard-coded Credentials vulnerability in Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator on Windows allows Authentication Bypass. See Instruction Manual Appendix A and Appendix E dated 20230615 for more details. This issue affects SEL-5037 SEL Grid… | ||
| CVE-2023-41742 | Hig | 0.49 | 7.5 | 0.01 | Aug 31, 2023 | Excessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30430, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979. | ||
| CVE-2022-46868 | Hig | 0.51 | 7.8 | 0.00 | Aug 31, 2023 | Local privilege escalation during recovery due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40173. | ||
| CVE-2022-45451 | Hig | 0.51 | 7.8 | 0.01 | Aug 31, 2023 | Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40173, Acronis Agent (Windows) before build 30600, Acronis Cyber Protect 15 (Windows) before build… |
- risk 0.51cvss 7.8epss 0.01
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331.
- risk 0.51cvss 7.8epss 0.00
ForeScout NAC SecureConnector version 11.2 - CWE-427: Uncontrolled Search Path Element
- risk 0.48cvss 7.4epss 0.00
A Hyundai model (2017) - CWE-294: Authentication Bypass by Capture-replay.
- risk 0.53cvss 8.1epss 0.00
StarTrinity Softswitch version 2023-02-16 - Multiple CSRF (CWE-352)
- risk 0.57cvss 8.8epss 0.00
StarTrinity Softswitch version 2023-02-16 - Open Redirect (CWE-601)
- risk 0.57cvss 8.8epss 0.00
StarTrinity Softswitch version 2023-02-16 - Persistent XSS (CWE-79)
- risk 0.57cvss 8.8epss 0.00
StarTrinity Softswitch version 2023-02-16 - Multiple Reflected XSS (CWE-79)
- risk 0.57cvss 8.8epss 0.00
7Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
- risk 0.47cvss 7.2epss 0.00
Synel Terminals - CWE-494: Download of Code Without Integrity Check
- risk 0.51cvss 7.8epss 0.01
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.
- risk 0.51cvss 7.8epss 0.01
Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.
- risk 0.51cvss 7.8epss 0.01
Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.
- risk 0.51cvss 7.8epss 0.01
Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846.
- risk 0.49cvss 7.5epss 0.00
A vulnerability has been identified in MXsecurity versions prior to v1.0.1. The vulnerability may put the confidentiality and integrity of SSH communications at risk on the affected device. This vulnerability is attributed to a hard-coded SSH host key, which might facilitate…
- risk 0.49cvss 7.5epss 0.01
A vulnerability that allows for unauthorized access has been discovered in MXsecurity versions prior to v1.0.1. This vulnerability arises from inadequate authentication measures, potentially leading to the disclosure of device information by a remote attacker.
- risk 0.46cvss 7.1epss 0.01
A vulnerability that allows the unauthorized disclosure of authenticated information has been identified in MXsecurity versions prior to v1.0.1. This vulnerability arises when special elements are not neutralized correctly, allowing remote attackers to alter SQL commands.
- risk 0.53cvss 8.1epss 0.00
In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.
- risk 0.42cvss 7.5epss 0.00
@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the `init` function allows arbitrary javascript to be executed using the `javascript:` prefix. This vulnerability has been patched on…
- risk 0.49cvss 7.5epss 0.02
An issue in O-RAN Software Community E2 G-Release allows attackers to cause a Denial of Service (DoS) by incorrectly initiating the messaging procedure between the E2Node and E2Term components.
- risk 0.49cvss 7.5epss 0.01
O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged routing tables to the device.
- risk 0.49cvss 7.5epss 0.01
Buffer Overflow vulnerability in hzeller timg v.1.5.1 and before allows a remote attacker to cause a denial of service via the 0x61200000045c address.
- risk 0.49cvss 7.5epss 0.01
SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function.
- risk 0.49cvss 7.5epss 0.01
Server Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information.
- risk 0.00cvss 7.5epss 0.01
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc…
- risk 0.46cvss 7.1epss 0.00
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Dharmesh Patel Post List With Featured Image plugin <= 1.2 versions.
- risk 0.46cvss 7.1epss 0.00
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Chop-Chop Coming Soon Chop Chop plugin <= 2.2.4 versions.
- risk 0.46cvss 7.1epss 0.00
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ShopConstruct plugin <= 1.1.2 versions.
- risk 0.57cvss 8.8epss 0.01
Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loan_rules.php.
- risk 0.49cvss 7.5epss 0.01
Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e., '*' indicates that the full version specification varies across product model family, but firmware level P246 (or…
- risk 0.49cvss 7.5epss 0.01
ELSYS ERS 1.5 Sound v2.3.8 was discovered to contain a buffer overflow via the NFC data parser.
- risk 0.42cvss 7.5epss 0.01
An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string.
- risk 0.51cvss 7.8epss 0.00
Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin parameter.
- risk 0.42cvss 7.5epss 0.01
Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.
- risk 0.50cvss 8.8epss 0.01
Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.
- risk 0.00cvss 8.1epss 0.01
Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- risk 0.50cvss 7.5epss 0.18
An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When certain specific crafted BGP UPDATE messages are received…
- risk 0.48cvss 7.3epss 0.01
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of the 3.x beta branch are subject to a Use-After-Free issue in the `avc420_ensure_buffer` and `avc444_ensure_buffer` functions. If the value of…
- risk 0.49cvss 7.5epss 0.00
Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Windows) before build 32047, Acronis Cyber Protect 15 (Windows) before build 35979.
- risk 0.00cvss 7.0epss 0.01
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Versions of FreeRDP on the 3.x release branch before beta3 are subject to a Use-After-Free in processing `RDPGFX_CMDID_RESETGRAPHICS` packets. If `context->maxPlaneSize` is…
- risk 0.51cvss 7.8epss 0.00
Local privilege escalation during installation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis True Image OEM (Windows) before build 42575.
- risk 0.51cvss 7.8epss 0.00
Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Agent (macOS) before build 30600, Acronis Cyber Protect 15 (macOS) before build 35979.
- risk 0.51cvss 7.8epss 0.00
Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis Cyber Protect Cloud Agent (Windows) before build 31637, Acronis Cyber Protect 15…
- risk 0.53cvss 8.2epss 0.00
A Missing Authentication for Critical Function vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run arbitrary commands on managed devices by an authorized device operator. See Instruction Manual Appendix A…
- risk 0.48cvss 7.4epss 0.00
Insecure Inherited Permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows allows Leveraging/Manipulating Configuration File Search Paths. See Instruction Manual Appendix A [Cybersecurity] tag dated 20230522 for more…
- risk 0.57cvss 8.8epss 0.00
An Execution with Unnecessary Privileges vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run system commands with the highest level privilege on the system. See Instruction Manual Appendix A and Appendix E…
- risk 0.48cvss 7.4epss 0.00
A Cross-Site Request Forgery (CSRF) vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to embed instructions that could be executed by an authorized device operator. See Instruction Manual Appendix A and Appendix…
- risk 0.50cvss 7.7epss 0.00
Use of Hard-coded Credentials vulnerability in Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator on Windows allows Authentication Bypass. See Instruction Manual Appendix A and Appendix E dated 20230615 for more details. This issue affects SEL-5037 SEL Grid…
- risk 0.49cvss 7.5epss 0.01
Excessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30430, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.
- risk 0.51cvss 7.8epss 0.00
Local privilege escalation during recovery due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40173.
- risk 0.51cvss 7.8epss 0.01
Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40173, Acronis Agent (Windows) before build 30600, Acronis Cyber Protect 15 (Windows) before build…