| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-29887 | Hig | 0.49 | 7.5 | 0.05 | Apr 18, 2023 | A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the File parameter. | ||
| CVE-2023-21996 | Hig | 0.49 | 7.5 | 0.01 | Apr 18, 2023 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via… | ||
| CVE-2023-21990 | Hig | 0.53 | 8.2 | 0.00 | Apr 18, 2023 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where… | ||
| CVE-2023-21987 | Hig | 0.51 | 7.8 | 0.01 | Apr 18, 2023 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where… | ||
| CVE-2023-21985 | Hig | 0.50 | 7.7 | 0.00 | Apr 18, 2023 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise… | ||
| CVE-2023-21980 | Hig | 0.46 | 7.1 | 0.01 | Apr 18, 2023 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.41 and prior and 8.0.32 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols… | ||
| CVE-2023-21979 | Hig | 0.49 | 7.5 | 0.01 | Apr 18, 2023 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to… | ||
| CVE-2023-21964 | Hig | 0.49 | 7.5 | 0.01 | Apr 18, 2023 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to… | ||
| CVE-2023-21948 | Hig | 0.51 | 7.8 | 0.00 | Apr 18, 2023 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Core). The supported version that is affected is 10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle… | ||
| CVE-2023-21932 | Hig | 0.50 | 7.2 | 0.45 | Apr 18, 2023 | Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OXI). The supported version that is affected is 5.6. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to… | ||
| CVE-2023-21931 | Hig | 0.55 | 7.5 | 0.82 | Apr 18, 2023 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to… | ||
| CVE-2023-21930 | Hig | 0.48 | 7.4 | 0.01 | Apr 18, 2023 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1.… | ||
| CVE-2023-21923 | Hig | 0.54 | 8.3 | 0.01 | Apr 18, 2023 | Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Supported versions that are affected are Prior to 6.3.1.3 and Prior to 7.0.0.1. Easily exploitable vulnerability allows low privileged attacker with network… | ||
| CVE-2023-21912 | Hig | 0.49 | 7.5 | 0.01 | Apr 18, 2023 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.41 and prior and 8.0.30 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via… | ||
| CVE-2023-21896 | Hig | 0.46 | 7.0 | 0.00 | Apr 18, 2023 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: NSSwitch). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to… | ||
| CVE-2022-43377 | Hig | 0.49 | 7.5 | 0.01 | Apr 18, 2023 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is performed on the account. Affected Products: NetBotz 4 - 355/450/455/550/570 (V4.7.0 and prior) | ||
| CVE-2022-43376 | Hig | 0.49 | 7.6 | 0.00 | Apr 18, 2023 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause code and session manipulation when malicious code is inserted into the browser. Affected Products: NetBotz 4 - 355/450/455/550/570 (V4.7.0 … | ||
| CVE-2023-22294 | Hig | 0.57 | 8.8 | 0.01 | Apr 18, 2023 | Privilege escalation in Tribe29 Checkmk Appliance before 1.6.4 allows authenticated site users to escalate privileges via incorrectly set permissions. | ||
| CVE-2023-29855 | Hig | 0.47 | 7.2 | 0.01 | Apr 18, 2023 | WBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php. | ||
| CVE-2023-25556 | Hig | 0.54 | 8.3 | 0.00 | Apr 18, 2023 | A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the attacker has access to the KNX installation. | ||
| CVE-2023-27976 | Hig | 0.57 | 8.8 | 0.01 | Apr 18, 2023 | A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause remote code execution when a valid user visits a malicious link provided through the web endpoints. Affected Products: EcoStruxure Control Expert (V15.1 and above) | ||
| CVE-2021-41614 | Hig | 0.51 | 7.8 | 0.00 | Apr 18, 2023 | An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program Counter Register (EPCR) are not implemented correctly. User programs from an unauthorized privilege level can make read/write accesses to… | ||
| CVE-2021-41612 | Hig | 0.57 | 8.8 | 0.01 | Apr 18, 2023 | An issue was discovered in the ALU unit of the OpenRISC mor1kx processor. The carry flag is not being updated correctly for the subtract instruction, which results in an incorrect value of the carry flag. Any software that relies on this flag may experience corruption in… | ||
| CVE-2023-28983 | Hig | 0.57 | 8.8 | 0.01 | Apr 17, 2023 | An OS Command Injection vulnerability in gRPC Network Operations Interface (gNOI) server module of Juniper Networks Junos OS Evolved allows an authenticated, low privileged, network based attacker to inject shell commands and execute code. This issue affects Juniper Networks… | ||
| CVE-2023-28982 | Hig | 0.49 | 7.5 | 0.01 | Apr 17, 2023 | A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS). In a BGP rib sharding scenario, when an… | ||
| CVE-2023-28976 | Hig | 0.49 | 7.5 | 0.01 | Apr 17, 2023 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). If specific traffic is received on MX… | ||
| CVE-2023-28974 | Hig | 0.48 | 7.4 | 0.00 | Apr 17, 2023 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the bbe-smgd of Juniper Networks Junos OS allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). In a Broadband Edge / Subscriber Management scenario on MX Series when a… | ||
| CVE-2023-28973 | Hig | 0.46 | 7.1 | 0.00 | Apr 17, 2023 | An Improper Authorization vulnerability in the 'sysmanctl' shell command of Juniper Networks Junos OS Evolved allows a local, authenticated attacker to execute administrative commands that could impact the integrity of the system or system availability. Administrative functions… | ||
| CVE-2023-28971 | Hig | 0.47 | 7.2 | 0.00 | Apr 17, 2023 | An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the timescaledb feature of Juniper Networks Paragon Active Assurance (PAA) (Formerly Netrounds) allows an attacker to bypass existing firewall rules and limitations used to restrict internal… | ||
| CVE-2023-28967 | Hig | 0.49 | 7.5 | 0.01 | Apr 17, 2023 | A Use of Uninitialized Resource vulnerability in the Border Gateway Protocol (BGP) software of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to send specific genuine BGP packets to a device configured with BGP to cause a Denial… | ||
| CVE-2023-28966 | Hig | 0.51 | 7.8 | 0.00 | Apr 17, 2023 | An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS Evolved allows a low-privileged local attacker with shell access to modify existing files or execute commands as root. The issue is caused by improper file and directory permissions on certain system… | ||
| CVE-2023-28964 | Hig | 0.49 | 7.5 | 0.01 | Apr 17, 2023 | An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network based, unauthenticated attacker to cause an RPD crash leading to a Denial of Service (DoS). Continued… | ||
| CVE-2023-28960 | Hig | 0.53 | 8.2 | 0.00 | Apr 17, 2023 | An Incorrect Permission Assignment for Critical Resource vulnerability in Juniper Networks Junos OS Evolved allows a local, authenticated low-privileged attacker to copy potentially malicious files into an existing Docker container on the local system. A follow-on administrator… | ||
| CVE-2023-24504 | Hig | 0.49 | 7.5 | 0.00 | Apr 17, 2023 | Electra Central AC unit – Adjacent attacker may cause the unit to connect to unauthorized update server. | ||
| CVE-2023-24503 | Hig | 0.49 | 7.5 | 0.00 | Apr 17, 2023 | Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW. | ||
| CVE-2023-24502 | Hig | 0.49 | 7.5 | 0.00 | Apr 17, 2023 | Electra Central AC unit – The unit opens an AP with an easily calculated password. | ||
| CVE-2023-24500 | Hig | 0.49 | 7.5 | 0.00 | Apr 17, 2023 | Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW. | ||
| CVE-2023-27911 | Hig | 0.51 | 7.8 | 0.01 | Apr 17, 2023 | A user may be tricked into opening a malicious FBX file that may exploit a heap buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may lead to code execution. | ||
| CVE-2023-27910 | Hig | 0.51 | 7.8 | 0.01 | Apr 17, 2023 | A user may be tricked into opening a malicious FBX file that may exploit a stack buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may lead to code execution. | ||
| CVE-2023-27909 | Hig | 0.51 | 7.8 | 0.00 | Apr 17, 2023 | An Out-Of-Bounds Write Vulnerability in Autodesk® FBX® SDK version 2020 or prior may lead to code execution through maliciously crafted FBX files or information disclosure. | ||
| CVE-2023-27907 | Hig | 0.51 | 7.8 | 0.00 | Apr 17, 2023 | A malicious actor may convince a victim to open a malicious USD file that may trigger an out-of-bounds write vulnerability which may result in code execution. | ||
| CVE-2023-27906 | Hig | 0.51 | 7.8 | 0.00 | Apr 17, 2023 | A malicious actor may convince a victim to open a malicious USD file that may trigger an out-of-bounds read vulnerability which may result in code execution. | ||
| CVE-2023-25010 | Hig | 0.51 | 7.8 | 0.00 | Apr 17, 2023 | A malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code execution. | ||
| CVE-2023-27705 | Hig | 0.49 | 7.5 | 0.01 | Apr 17, 2023 | APNG_Optimizer v1.4 was discovered to contain a buffer overflow via the component /apngopt/ubuntu.png. | ||
| CVE-2023-1831 | Hig | 0.47 | 7.2 | 0.00 | Apr 17, 2023 | Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config). | ||
| CVE-2023-27755 | Hig | 0.57 | 8.8 | 0.01 | Apr 17, 2023 | go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download. | ||
| CVE-2023-27733 | Hig | 0.47 | 7.2 | 0.01 | Apr 17, 2023 | DedeCMS v5.7.106 was discovered to contain a SQL injection vulnerability via the component /dede/sys_sql_query.php. | ||
| CVE-2023-0765 | Hig | 0.57 | 8.8 | 0.01 | Apr 17, 2023 | The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin… | ||
| CVE-2023-0277 | Hig | 0.47 | 7.2 | 0.01 | Apr 17, 2023 | The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin | ||
| CVE-2023-2017 | Hig | 0.57 | 8.8 | 0.02 | Apr 17, 2023 | Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the… |
- risk 0.49cvss 7.5epss 0.05
A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the File parameter.
- risk 0.49cvss 7.5epss 0.01
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via…
- risk 0.53cvss 8.2epss 0.00
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where…
- risk 0.51cvss 7.8epss 0.01
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where…
- risk 0.50cvss 7.7epss 0.00
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise…
- risk 0.46cvss 7.1epss 0.01
Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.41 and prior and 8.0.32 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols…
- risk 0.49cvss 7.5epss 0.01
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to…
- risk 0.49cvss 7.5epss 0.01
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to…
- risk 0.51cvss 7.8epss 0.00
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Core). The supported version that is affected is 10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle…
- risk 0.50cvss 7.2epss 0.45
Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OXI). The supported version that is affected is 5.6. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to…
- risk 0.55cvss 7.5epss 0.82
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to…
- risk 0.48cvss 7.4epss 0.01
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1.…
- risk 0.54cvss 8.3epss 0.01
Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Supported versions that are affected are Prior to 6.3.1.3 and Prior to 7.0.0.1. Easily exploitable vulnerability allows low privileged attacker with network…
- risk 0.49cvss 7.5epss 0.01
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.41 and prior and 8.0.30 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via…
- risk 0.46cvss 7.0epss 0.00
Vulnerability in the Oracle Solaris product of Oracle Systems (component: NSSwitch). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to…
- risk 0.49cvss 7.5epss 0.01
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is performed on the account. Affected Products: NetBotz 4 - 355/450/455/550/570 (V4.7.0 and prior)
- risk 0.49cvss 7.6epss 0.00
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause code and session manipulation when malicious code is inserted into the browser. Affected Products: NetBotz 4 - 355/450/455/550/570 (V4.7.0 …
- risk 0.57cvss 8.8epss 0.01
Privilege escalation in Tribe29 Checkmk Appliance before 1.6.4 allows authenticated site users to escalate privileges via incorrectly set permissions.
- risk 0.47cvss 7.2epss 0.01
WBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php.
- risk 0.54cvss 8.3epss 0.00
A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the attacker has access to the KNX installation.
- risk 0.57cvss 8.8epss 0.01
A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause remote code execution when a valid user visits a malicious link provided through the web endpoints. Affected Products: EcoStruxure Control Expert (V15.1 and above)
- risk 0.51cvss 7.8epss 0.00
An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program Counter Register (EPCR) are not implemented correctly. User programs from an unauthorized privilege level can make read/write accesses to…
- risk 0.57cvss 8.8epss 0.01
An issue was discovered in the ALU unit of the OpenRISC mor1kx processor. The carry flag is not being updated correctly for the subtract instruction, which results in an incorrect value of the carry flag. Any software that relies on this flag may experience corruption in…
- risk 0.57cvss 8.8epss 0.01
An OS Command Injection vulnerability in gRPC Network Operations Interface (gNOI) server module of Juniper Networks Junos OS Evolved allows an authenticated, low privileged, network based attacker to inject shell commands and execute code. This issue affects Juniper Networks…
- risk 0.49cvss 7.5epss 0.01
A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS). In a BGP rib sharding scenario, when an…
- risk 0.49cvss 7.5epss 0.01
An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). If specific traffic is received on MX…
- risk 0.48cvss 7.4epss 0.00
An Improper Check for Unusual or Exceptional Conditions vulnerability in the bbe-smgd of Juniper Networks Junos OS allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). In a Broadband Edge / Subscriber Management scenario on MX Series when a…
- risk 0.46cvss 7.1epss 0.00
An Improper Authorization vulnerability in the 'sysmanctl' shell command of Juniper Networks Junos OS Evolved allows a local, authenticated attacker to execute administrative commands that could impact the integrity of the system or system availability. Administrative functions…
- risk 0.47cvss 7.2epss 0.00
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the timescaledb feature of Juniper Networks Paragon Active Assurance (PAA) (Formerly Netrounds) allows an attacker to bypass existing firewall rules and limitations used to restrict internal…
- risk 0.49cvss 7.5epss 0.01
A Use of Uninitialized Resource vulnerability in the Border Gateway Protocol (BGP) software of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to send specific genuine BGP packets to a device configured with BGP to cause a Denial…
- risk 0.51cvss 7.8epss 0.00
An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS Evolved allows a low-privileged local attacker with shell access to modify existing files or execute commands as root. The issue is caused by improper file and directory permissions on certain system…
- risk 0.49cvss 7.5epss 0.01
An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network based, unauthenticated attacker to cause an RPD crash leading to a Denial of Service (DoS). Continued…
- risk 0.53cvss 8.2epss 0.00
An Incorrect Permission Assignment for Critical Resource vulnerability in Juniper Networks Junos OS Evolved allows a local, authenticated low-privileged attacker to copy potentially malicious files into an existing Docker container on the local system. A follow-on administrator…
- risk 0.49cvss 7.5epss 0.00
Electra Central AC unit – Adjacent attacker may cause the unit to connect to unauthorized update server.
- risk 0.49cvss 7.5epss 0.00
Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW.
- risk 0.49cvss 7.5epss 0.00
Electra Central AC unit – The unit opens an AP with an easily calculated password.
- risk 0.49cvss 7.5epss 0.00
Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW.
- risk 0.51cvss 7.8epss 0.01
A user may be tricked into opening a malicious FBX file that may exploit a heap buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may lead to code execution.
- risk 0.51cvss 7.8epss 0.01
A user may be tricked into opening a malicious FBX file that may exploit a stack buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may lead to code execution.
- risk 0.51cvss 7.8epss 0.00
An Out-Of-Bounds Write Vulnerability in Autodesk® FBX® SDK version 2020 or prior may lead to code execution through maliciously crafted FBX files or information disclosure.
- risk 0.51cvss 7.8epss 0.00
A malicious actor may convince a victim to open a malicious USD file that may trigger an out-of-bounds write vulnerability which may result in code execution.
- risk 0.51cvss 7.8epss 0.00
A malicious actor may convince a victim to open a malicious USD file that may trigger an out-of-bounds read vulnerability which may result in code execution.
- risk 0.51cvss 7.8epss 0.00
A malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code execution.
- risk 0.49cvss 7.5epss 0.01
APNG_Optimizer v1.4 was discovered to contain a buffer overflow via the component /apngopt/ubuntu.png.
- risk 0.47cvss 7.2epss 0.00
Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).
- risk 0.57cvss 8.8epss 0.01
go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download.
- risk 0.47cvss 7.2epss 0.01
DedeCMS v5.7.106 was discovered to contain a SQL injection vulnerability via the component /dede/sys_sql_query.php.
- risk 0.57cvss 8.8epss 0.01
The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin…
- risk 0.47cvss 7.2epss 0.01
The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- risk 0.57cvss 8.8epss 0.02
Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the…