| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-22648 | Hig | 0.52 | 8.0 | 0.00 | Jun 1, 2023 | A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on… | ||
| CVE-2022-43760 | Hig | 0.48 | 8.4 | 0.01 | Jun 1, 2023 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is executed within another user's browser, allowing the attacker to steal sensitive… | ||
| CVE-2023-3028 | Hig | 0.56 | 8.6 | 0.00 | Jun 1, 2023 | Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerabilities were… | ||
| CVE-2023-24584 | Hig | 0.49 | 7.5 | 0.01 | Jun 1, 2023 | Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature. This issue affects Controller 6000: before vCR8.80.230201a, before vCR8.70.230201a, before vCR8.60.230201b, before vCR8.50.230201a, all versions of vCR8.40 and… | ||
| CVE-2023-34312 | Hig | 0.51 | 7.8 | 0.01 | Jun 1, 2023 | In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate pointers from inter-process communication, which leads to a write-what-where condition. | ||
| CVE-2023-29748 | Hig | 0.49 | 7.5 | 0.01 | Jun 1, 2023 | Story Saver for Instragram - Video Downloader 1.0.6 for Android has an exposed component that provides a method to modify the SharedPreference file. An attacker can leverage this method to inject a large amount of data into any SharedPreference file, which will be loaded into… | ||
| CVE-2023-29159 | Hig | 0.42 | 7.5 | 0.03 | Jun 1, 2023 | Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette. | ||
| CVE-2023-29154 | Hig | 0.50 | 7.2 | 0.41 | Jun 1, 2023 | SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user who can access the affected product with an administrative privilege may execute an arbitrary SQL command via specially crafted input to the query setting page. | ||
| CVE-2023-28937 | Hig | 0.57 | 8.8 | 0.01 | Jun 1, 2023 | DataSpider Servista version 4.4 and earlier uses a hard-coded cryptographic key. DataSpider Servista is data integration software. ScriptRunner and ScriptRunner for Amazon SQS are used to start the configured processes on DataSpider Servista. The cryptographic key is embedded in… | ||
| CVE-2023-28713 | Hig | 0.53 | 8.1 | 0.00 | Jun 1, 2023 | Plaintext storage of a password exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. Because account information of the database is saved in a local file in plaintext, a user who can access the PC where the affected product is installed can obtain the information. As a… | ||
| CVE-2023-28657 | Hig | 0.57 | 8.8 | 0.01 | Jun 1, 2023 | Improper access control vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user of the PC where the affected product is installed may gain an administrative privilege. As a result, information regarding the product may be obtained and/or altered by the… | ||
| CVE-2023-28399 | Hig | 0.51 | 7.8 | 0.00 | Jun 1, 2023 | Incorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. ACL (Access Control List) is not appropriately set to the local folder where the affected product is installed, therefore a wide range of privileges is permitted… | ||
| CVE-2022-35742 | Hig | 0.51 | 7.5 | 0.22 | Jun 1, 2023 | Microsoft Outlook Denial of Service Vulnerability | ||
| CVE-2023-2977 | Hig | 0.00 | 7.1 | 0.00 | Jun 1, 2023 | A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2… | ||
| CVE-2023-2598 | Hig | 0.51 | 7.8 | 0.01 | Jun 1, 2023 | A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the Linux kernel that allows out-of-bounds access to physical memory beyond the end of the buffer. This flaw enables full local privilege escalation. | ||
| CVE-2023-23955 | Hig | 0.53 | 8.1 | 0.00 | Jun 1, 2023 | Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Server-Side Request Forgery vulnerability. | ||
| CVE-2023-23953 | Hig | 0.51 | 7.8 | 0.00 | Jun 1, 2023 | Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to an Elevation of Privilege vulnerability. | ||
| CVE-2023-33643 | — | Hig | 0.47 | 7.2 | 0.01 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /goform/aspForm. | |
| CVE-2023-33642 | — | Hig | 0.47 | 7.2 | 0.01 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm. | |
| CVE-2023-33641 | — | Hig | 0.47 | 7.2 | 0.01 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm. | |
| CVE-2023-33640 | — | Hig | 0.47 | 7.2 | 0.01 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/aspForm. | |
| CVE-2023-33639 | — | Hig | 0.47 | 7.2 | 0.01 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspForm. | |
| CVE-2023-33638 | — | Hig | 0.47 | 7.2 | 0.01 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm. | |
| CVE-2023-33637 | — | Hig | 0.47 | 7.2 | 0.01 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm. | |
| CVE-2023-33636 | — | Hig | 0.47 | 7.2 | 0.01 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspForm. | |
| CVE-2023-33635 | — | Hig | 0.47 | 7.2 | 0.01 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm. | |
| CVE-2023-33634 | — | Hig | 0.47 | 7.2 | 0.01 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm. | |
| CVE-2023-33633 | — | Hig | 0.47 | 7.2 | 0.01 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm. | |
| CVE-2023-33632 | — | Hig | 0.47 | 7.2 | 0.01 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the ipqos_lanip_dellist interface at /goform/aspForm. | |
| CVE-2023-33631 | — | Hig | 0.47 | 7.2 | 0.01 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelSTList interface at /goform/aspForm. | |
| CVE-2023-33630 | — | Hig | 0.47 | 7.2 | 0.01 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the EditvsList interface at /goform/aspForm. | |
| CVE-2023-33629 | — | Hig | 0.47 | 7.2 | 0.04 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm. | |
| CVE-2023-33628 | — | Hig | 0.47 | 7.2 | 0.01 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm. | |
| CVE-2023-33627 | — | Hig | 0.47 | 7.2 | 0.01 | May 31, 2023 | H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm. | |
| CVE-2023-34258 | Hig | 0.49 | 7.5 | 0.01 | May 31, 2023 | An issue was discovered in BMC Patrol before 22.1.00. The agent's configuration can be remotely queried. This configuration contains the Patrol account password, encrypted with a default AES key. This account can then be used to achieve remote code execution. | ||
| CVE-2023-26278 | Hig | 0.53 | 8.2 | 0.00 | May 31, 2023 | IBM QRadar WinCollect Agent 10.0 through 10.1.3 could allow a local authenticated attacker to gain elevated privileges on the system. IBM X-Force ID: 248158. | ||
| CVE-2022-48502 | Hig | 0.46 | 7.1 | 0.01 | May 31, 2023 | An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c. | ||
| CVE-2023-34088 | Hig | 0.57 | 8.7 | 0.00 | May 31, 2023 | Collabora Online is a collaborative online office suite. A stored cross-site scripting (XSS) vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27. An attacker could create a document with an XSS payload as a document name. Later, if an… | ||
| CVE-2023-33722 | Hig | 0.57 | 8.8 | 0.02 | May 31, 2023 | EDIMAX BR-6288ACL v1.12 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the pppUserName parameter. | ||
| CVE-2023-33718 | Hig | 0.57 | 8.8 | 0.01 | May 31, 2023 | mp4v2 v2.1.3 was discovered to contain a memory leak via MP4File::ReadString() at mp4file_io.cpp | ||
| CVE-2023-26277 | Hig | 0.51 | 7.8 | 0.00 | May 31, 2023 | IBM QRadar WinCollect Agent 10.0 though 10.1.3 could allow a local user to execute commands on the system due to execution with unnecessary privileges. IBM X-Force ID: 248156. | ||
| CVE-2022-35757 | Hig | 0.48 | 7.3 | 0.01 | May 31, 2023 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | ||
| CVE-2022-35756 | Hig | 0.52 | 7.8 | 0.11 | May 31, 2023 | Windows Kerberos Elevation of Privilege Vulnerability | ||
| CVE-2022-35755 | Hig | 0.48 | 7.3 | 0.10 | May 31, 2023 | Windows Print Spooler Elevation of Privilege Vulnerability | ||
| CVE-2022-35753 | Hig | 0.53 | 8.1 | 0.01 | May 31, 2023 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability | ||
| CVE-2022-35752 | Hig | 0.53 | 8.1 | 0.01 | May 31, 2023 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability | ||
| CVE-2022-35751 | Hig | 0.51 | 7.8 | 0.05 | May 31, 2023 | Windows Hyper-V Elevation of Privilege Vulnerability | ||
| CVE-2022-35750 | Hig | 0.51 | 7.8 | 0.06 | May 31, 2023 | Win32k Elevation of Privilege Vulnerability | ||
| CVE-2022-35749 | Hig | 0.51 | 7.8 | 0.01 | May 31, 2023 | Windows Digital Media Receiver Elevation of Privilege Vulnerability | ||
| CVE-2022-35748 | Hig | 0.53 | 7.5 | 0.47 | May 31, 2023 | HTTP.sys Denial of Service Vulnerability |
- risk 0.52cvss 8.0epss 0.00
A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on…
- risk 0.48cvss 8.4epss 0.01
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is executed within another user's browser, allowing the attacker to steal sensitive…
- risk 0.56cvss 8.6epss 0.00
Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerabilities were…
- risk 0.49cvss 7.5epss 0.01
Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature. This issue affects Controller 6000: before vCR8.80.230201a, before vCR8.70.230201a, before vCR8.60.230201b, before vCR8.50.230201a, all versions of vCR8.40 and…
- risk 0.51cvss 7.8epss 0.01
In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate pointers from inter-process communication, which leads to a write-what-where condition.
- risk 0.49cvss 7.5epss 0.01
Story Saver for Instragram - Video Downloader 1.0.6 for Android has an exposed component that provides a method to modify the SharedPreference file. An attacker can leverage this method to inject a large amount of data into any SharedPreference file, which will be loaded into…
- risk 0.42cvss 7.5epss 0.03
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.
- risk 0.50cvss 7.2epss 0.41
SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user who can access the affected product with an administrative privilege may execute an arbitrary SQL command via specially crafted input to the query setting page.
- risk 0.57cvss 8.8epss 0.01
DataSpider Servista version 4.4 and earlier uses a hard-coded cryptographic key. DataSpider Servista is data integration software. ScriptRunner and ScriptRunner for Amazon SQS are used to start the configured processes on DataSpider Servista. The cryptographic key is embedded in…
- risk 0.53cvss 8.1epss 0.00
Plaintext storage of a password exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. Because account information of the database is saved in a local file in plaintext, a user who can access the PC where the affected product is installed can obtain the information. As a…
- risk 0.57cvss 8.8epss 0.01
Improper access control vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user of the PC where the affected product is installed may gain an administrative privilege. As a result, information regarding the product may be obtained and/or altered by the…
- risk 0.51cvss 7.8epss 0.00
Incorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. ACL (Access Control List) is not appropriately set to the local folder where the affected product is installed, therefore a wide range of privileges is permitted…
- risk 0.51cvss 7.5epss 0.22
Microsoft Outlook Denial of Service Vulnerability
- risk 0.00cvss 7.1epss 0.00
A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2…
- risk 0.51cvss 7.8epss 0.01
A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the Linux kernel that allows out-of-bounds access to physical memory beyond the end of the buffer. This flaw enables full local privilege escalation.
- risk 0.53cvss 8.1epss 0.00
Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Server-Side Request Forgery vulnerability.
- risk 0.51cvss 7.8epss 0.00
Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to an Elevation of Privilege vulnerability.
- risk 0.47cvss 7.2epss 0.01
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /goform/aspForm.
- risk 0.47cvss 7.2epss 0.01
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.
- risk 0.47cvss 7.2epss 0.01
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm.
- risk 0.47cvss 7.2epss 0.01
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/aspForm.
- risk 0.47cvss 7.2epss 0.01
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspForm.
- risk 0.47cvss 7.2epss 0.01
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.
- risk 0.47cvss 7.2epss 0.01
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm.
- risk 0.47cvss 7.2epss 0.01
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspForm.
- risk 0.47cvss 7.2epss 0.01
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm.
- risk 0.47cvss 7.2epss 0.01
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm.
- risk 0.47cvss 7.2epss 0.01
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm.
- risk 0.47cvss 7.2epss 0.01
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the ipqos_lanip_dellist interface at /goform/aspForm.
- risk 0.47cvss 7.2epss 0.01
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelSTList interface at /goform/aspForm.
- risk 0.47cvss 7.2epss 0.01
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the EditvsList interface at /goform/aspForm.
- risk 0.47cvss 7.2epss 0.04
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm.
- risk 0.47cvss 7.2epss 0.01
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm.
- risk 0.47cvss 7.2epss 0.01
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in BMC Patrol before 22.1.00. The agent's configuration can be remotely queried. This configuration contains the Patrol account password, encrypted with a default AES key. This account can then be used to achieve remote code execution.
- risk 0.53cvss 8.2epss 0.00
IBM QRadar WinCollect Agent 10.0 through 10.1.3 could allow a local authenticated attacker to gain elevated privileges on the system. IBM X-Force ID: 248158.
- risk 0.46cvss 7.1epss 0.01
An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c.
- risk 0.57cvss 8.7epss 0.00
Collabora Online is a collaborative online office suite. A stored cross-site scripting (XSS) vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27. An attacker could create a document with an XSS payload as a document name. Later, if an…
- risk 0.57cvss 8.8epss 0.02
EDIMAX BR-6288ACL v1.12 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the pppUserName parameter.
- risk 0.57cvss 8.8epss 0.01
mp4v2 v2.1.3 was discovered to contain a memory leak via MP4File::ReadString() at mp4file_io.cpp
- risk 0.51cvss 7.8epss 0.00
IBM QRadar WinCollect Agent 10.0 though 10.1.3 could allow a local user to execute commands on the system due to execution with unnecessary privileges. IBM X-Force ID: 248156.
- risk 0.48cvss 7.3epss 0.01
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
- risk 0.52cvss 7.8epss 0.11
Windows Kerberos Elevation of Privilege Vulnerability
- risk 0.48cvss 7.3epss 0.10
Windows Print Spooler Elevation of Privilege Vulnerability
- risk 0.53cvss 8.1epss 0.01
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
- risk 0.53cvss 8.1epss 0.01
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.05
Windows Hyper-V Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.06
Win32k Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows Digital Media Receiver Elevation of Privilege Vulnerability
- risk 0.53cvss 7.5epss 0.47
HTTP.sys Denial of Service Vulnerability