| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-32200 | Hig | 0.57 | 8.8 | 0.01 | Jul 12, 2023 | There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. It allows a remote user to execute javascript via a SPARQL query. This issue affects Apache Jena: from 3.7.0 through 4.8.0. | ||
| CVE-2023-2763 | Hig | 0.51 | 7.8 | 0.00 | Jul 12, 2023 | Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. These vulnerabilities could allow an attacker to execute… | ||
| CVE-2023-2762 | Hig | 0.51 | 7.8 | 0.00 | Jul 12, 2023 | A Use-After-Free vulnerability in SLDPRT file reading procedure exists in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted SLDPRT file. | ||
| CVE-2023-37197 | Hig | 0.57 | 8.8 | 0.01 | Jul 12, 2023 | A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions… | ||
| CVE-2023-37196 | Hig | 0.57 | 8.8 | 0.01 | Jul 12, 2023 | A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions when… | ||
| CVE-2023-3525 | Hig | 0.49 | 7.5 | 0.01 | Jul 12, 2023 | The Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' function in versions up to, and including, 0.0.4. This makes it possible for unauthenticated attackers to set their payment status to… | ||
| CVE-2023-3168 | Hig | 0.40 | 7.2 | 0.00 | Jul 12, 2023 | The WP Reroute Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject… | ||
| CVE-2023-3167 | Hig | 0.40 | 7.2 | 0.00 | Jul 12, 2023 | The Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web… | ||
| CVE-2023-3166 | Hig | 0.40 | 7.2 | 0.00 | Jul 12, 2023 | The Lana Email Logger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, Lana Email Logger due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to… | ||
| CVE-2023-3158 | Hig | 0.47 | 7.2 | 0.01 | Jul 12, 2023 | The Mail Control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 0.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary… | ||
| CVE-2023-3135 | Hig | 0.40 | 7.2 | 0.00 | Jul 12, 2023 | The Mailtree Log Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject… | ||
| CVE-2023-3122 | Hig | 0.40 | 7.2 | 0.00 | Jul 12, 2023 | The GD Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 3.9.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web… | ||
| CVE-2023-3105 | Hig | 0.57 | 8.8 | 0.02 | Jul 12, 2023 | The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes… | ||
| CVE-2023-3093 | Hig | 0.47 | 7.2 | 0.00 | Jul 12, 2023 | The YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web… | ||
| CVE-2023-3092 | Hig | 0.47 | 7.2 | 0.00 | Jul 12, 2023 | The SMTP Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.3.46 due to insufficient input sanitization and output escaping when the 'Save Data SendMail' feature is enabled. This makes it possible for… | ||
| CVE-2023-3088 | Hig | 0.40 | 7.2 | 0.00 | Jul 12, 2023 | The WP Mail Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web… | ||
| CVE-2023-3087 | Hig | 0.40 | 7.2 | 0.01 | Jul 12, 2023 | The FluentSMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web… | ||
| CVE-2023-3082 | Hig | 0.40 | 7.2 | 0.01 | Jul 12, 2023 | The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web… | ||
| CVE-2023-3081 | Hig | 0.40 | 7.2 | 0.01 | Jul 12, 2023 | The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary… | ||
| CVE-2023-3080 | Hig | 0.40 | 7.2 | 0.00 | Jul 12, 2023 | The WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary… | ||
| CVE-2023-3023 | Hig | 0.40 | 7.2 | 0.01 | Jul 12, 2023 | The WP EasyCart plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in versions up to, and including, 5.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This… | ||
| CVE-2023-3127 | Hig | 0.49 | 7.5 | 0.01 | Jul 11, 2023 | An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights. | ||
| CVE-2023-24491 | Hig | 0.51 | 7.8 | 0.00 | Jul 11, 2023 | A vulnerability has been discovered in the Citrix Secure Access client for Windows which, if exploited, could allow an attacker with access to an endpoint with Standard User Account that has the vulnerable client installed to escalate their local privileges to that of NT… | ||
| CVE-2023-29984 | Hig | 0.49 | 7.5 | 0.01 | Jul 11, 2023 | Null pointer dereference vulnerability exists in multiple vendors MFPs and printers which implement Debut web server 1.2 or 1.3. Processing a specially crafted request may lead an affected product to a denial-of-service (DoS) condition. As for the affected… | ||
| CVE-2023-36884 | Hig | 0.75 | 7.5 | 0.99 | KEV | Jul 11, 2023 | Windows Search Remote Code Execution Vulnerability | |
| CVE-2023-37271 | Hig | 0.48 | 8.4 | 0.01 | Jul 11, 2023 | RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least… | ||
| CVE-2023-36874 | Hig | 0.68 | 7.8 | 0.43 | KEV | Jul 11, 2023 | Windows Error Reporting Service Elevation of Privilege Vulnerability | |
| CVE-2023-36867 | Hig | 0.51 | 7.8 | 0.01 | Jul 11, 2023 | Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability | ||
| CVE-2023-36538 | Hig | 0.55 | 8.4 | 0.00 | Jul 11, 2023 | Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access. | ||
| CVE-2023-36537 | Hig | 0.47 | 7.3 | 0.00 | Jul 11, 2023 | Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access. | ||
| CVE-2023-36536 | Hig | 0.53 | 8.2 | 0.00 | Jul 11, 2023 | Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access. | ||
| CVE-2023-35374 | Hig | 0.51 | 7.8 | 0.01 | Jul 11, 2023 | Paint 3D Remote Code Execution Vulnerability | ||
| CVE-2023-35364 | Hig | 0.57 | 8.8 | 0.01 | Jul 11, 2023 | Windows Kernel Elevation of Privilege Vulnerability | ||
| CVE-2023-35363 | Hig | 0.51 | 7.8 | 0.00 | Jul 11, 2023 | Windows Kernel Elevation of Privilege Vulnerability | ||
| CVE-2023-35362 | Hig | 0.51 | 7.8 | 0.00 | Jul 11, 2023 | Windows Clip Service Elevation of Privilege Vulnerability | ||
| CVE-2023-35361 | Hig | 0.46 | 7.0 | 0.00 | Jul 11, 2023 | Windows Kernel Elevation of Privilege Vulnerability | ||
| CVE-2023-35360 | Hig | 0.46 | 7.0 | 0.00 | Jul 11, 2023 | Windows Kernel Elevation of Privilege Vulnerability | ||
| CVE-2023-35358 | Hig | 0.51 | 7.8 | 0.01 | Jul 11, 2023 | Windows Kernel Elevation of Privilege Vulnerability | ||
| CVE-2023-35357 | Hig | 0.51 | 7.8 | 0.01 | Jul 11, 2023 | Windows Kernel Elevation of Privilege Vulnerability | ||
| CVE-2023-35356 | Hig | 0.51 | 7.8 | 0.01 | Jul 11, 2023 | Windows Kernel Elevation of Privilege Vulnerability | ||
| CVE-2023-35353 | Hig | 0.51 | 7.8 | 0.01 | Jul 11, 2023 | Connected User Experiences and Telemetry Elevation of Privilege Vulnerability | ||
| CVE-2023-35352 | Hig | 0.49 | 7.5 | 0.01 | Jul 11, 2023 | Windows Remote Desktop Security Feature Bypass Vulnerability | ||
| CVE-2023-35350 | Hig | 0.47 | 7.2 | 0.01 | Jul 11, 2023 | Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability | ||
| CVE-2023-35347 | Hig | 0.46 | 7.1 | 0.01 | Jul 11, 2023 | Microsoft Install Service Elevation of Privilege Vulnerability | ||
| CVE-2023-35343 | Hig | 0.51 | 7.8 | 0.01 | Jul 11, 2023 | Windows Geolocation Service Remote Code Execution Vulnerability | ||
| CVE-2023-35342 | Hig | 0.51 | 7.8 | 0.00 | Jul 11, 2023 | Windows Image Acquisition Elevation of Privilege Vulnerability | ||
| CVE-2023-35340 | Hig | 0.51 | 7.8 | 0.00 | Jul 11, 2023 | Windows CNG Key Isolation Service Elevation of Privilege Vulnerability | ||
| CVE-2023-35339 | Hig | 0.49 | 7.5 | 0.02 | Jul 11, 2023 | Windows CryptoAPI Denial of Service Vulnerability | ||
| CVE-2023-35338 | Hig | 0.49 | 7.5 | 0.02 | Jul 11, 2023 | Windows Peer Name Resolution Protocol Denial of Service Vulnerability | ||
| CVE-2023-35337 | Hig | 0.51 | 7.8 | 0.00 | Jul 11, 2023 | Win32k Elevation of Privilege Vulnerability |
- risk 0.57cvss 8.8epss 0.01
There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. It allows a remote user to execute javascript via a SPARQL query. This issue affects Apache Jena: from 3.7.0 through 4.8.0.
- risk 0.51cvss 7.8epss 0.00
Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. These vulnerabilities could allow an attacker to execute…
- risk 0.51cvss 7.8epss 0.00
A Use-After-Free vulnerability in SLDPRT file reading procedure exists in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted SLDPRT file.
- risk 0.57cvss 8.8epss 0.01
A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions…
- risk 0.57cvss 8.8epss 0.01
A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions when…
- risk 0.49cvss 7.5epss 0.01
The Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' function in versions up to, and including, 0.0.4. This makes it possible for unauthenticated attackers to set their payment status to…
- risk 0.40cvss 7.2epss 0.00
The WP Reroute Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
- risk 0.40cvss 7.2epss 0.00
The Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
- risk 0.40cvss 7.2epss 0.00
The Lana Email Logger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, Lana Email Logger due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
- risk 0.47cvss 7.2epss 0.01
The Mail Control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 0.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…
- risk 0.40cvss 7.2epss 0.00
The Mailtree Log Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
- risk 0.40cvss 7.2epss 0.00
The GD Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 3.9.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
- risk 0.57cvss 8.8epss 0.02
The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes…
- risk 0.47cvss 7.2epss 0.00
The YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
- risk 0.47cvss 7.2epss 0.00
The SMTP Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.3.46 due to insufficient input sanitization and output escaping when the 'Save Data SendMail' feature is enabled. This makes it possible for…
- risk 0.40cvss 7.2epss 0.00
The WP Mail Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
- risk 0.40cvss 7.2epss 0.01
The FluentSMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
- risk 0.40cvss 7.2epss 0.01
The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
- risk 0.40cvss 7.2epss 0.01
The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…
- risk 0.40cvss 7.2epss 0.00
The WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…
- risk 0.40cvss 7.2epss 0.01
The WP EasyCart plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in versions up to, and including, 5.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This…
- risk 0.49cvss 7.5epss 0.01
An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.
- risk 0.51cvss 7.8epss 0.00
A vulnerability has been discovered in the Citrix Secure Access client for Windows which, if exploited, could allow an attacker with access to an endpoint with Standard User Account that has the vulnerable client installed to escalate their local privileges to that of NT…
- risk 0.49cvss 7.5epss 0.01
Null pointer dereference vulnerability exists in multiple vendors MFPs and printers which implement Debut web server 1.2 or 1.3. Processing a specially crafted request may lead an affected product to a denial-of-service (DoS) condition. As for the affected…
- risk 0.75cvss 7.5epss 0.99
Windows Search Remote Code Execution Vulnerability
- risk 0.48cvss 8.4epss 0.01
RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least…
- risk 0.68cvss 7.8epss 0.43
Windows Error Reporting Service Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability
- risk 0.55cvss 8.4epss 0.00
Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
- risk 0.47cvss 7.3epss 0.00
Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
- risk 0.53cvss 8.2epss 0.00
Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
- risk 0.51cvss 7.8epss 0.01
Paint 3D Remote Code Execution Vulnerability
- risk 0.57cvss 8.8epss 0.01
Windows Kernel Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.00
Windows Kernel Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.00
Windows Clip Service Elevation of Privilege Vulnerability
- risk 0.46cvss 7.0epss 0.00
Windows Kernel Elevation of Privilege Vulnerability
- risk 0.46cvss 7.0epss 0.00
Windows Kernel Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows Kernel Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows Kernel Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows Kernel Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
- risk 0.49cvss 7.5epss 0.01
Windows Remote Desktop Security Feature Bypass Vulnerability
- risk 0.47cvss 7.2epss 0.01
Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
- risk 0.46cvss 7.1epss 0.01
Microsoft Install Service Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows Geolocation Service Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.00
Windows Image Acquisition Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.00
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
- risk 0.49cvss 7.5epss 0.02
Windows CryptoAPI Denial of Service Vulnerability
- risk 0.49cvss 7.5epss 0.02
Windows Peer Name Resolution Protocol Denial of Service Vulnerability
- risk 0.51cvss 7.8epss 0.00
Win32k Elevation of Privilege Vulnerability