by Kastro CVE-2023-5684 · Byzoro Smart S85F Management Platform
The archive.
Browse all tracked critical vulnerabilities, including records outside today's brief.
39,219 matching vulnerabilities · Page 517 of 785
Byzoro
CVE-2023-5683 · Byzoro Smart S85F Management Platform
Byzoro Smart S85F Management Platform importconf.php os command injection
mitre
CVE-2023-46042 · mitre
An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo().
CVE-2023-45554 · mitre
File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via modification of the imageext parameter…
CVE-2023-37635 · mitre
UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the…
CVE-2023-46300 · mitre
iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integra…
CVE-2023-46301 · mitre
iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload.
CVE-2023-27152 · mitre
DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authent…
CVE-2023-31581 · mitre
Dromara Sureness before v1.0.8 was discovered to use a hardcoded key.
CVE-2023-46010 · mitre
An issue in SeaCMS v.12.9 allows an attacker to execute arbitrary commands via the admin_safe.php component.
CVE-2023-45381 · mitre
In the module "Creative Popup" (creativepopup) up to version 1.6.9 from WebshopWorks for PrestaShop, a guest can perform SQL injection vi…
CVE-2023-45992 · mitre
A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote,…
CVE-2023-37824 · mitre
Sitolog sitologapplicationconnect v7.8.a and before was discovered to contain a SQL injection vulnerability via the component /activate_h…
CVE-2023-39680 · mitre
Sollace Unicopia version 1.1.1 and before was discovered to deserialize untrusted data, allowing attackers to execute arbitrary code.
CVE-2023-45379 · mitre
In the module "Rotator Img" (posrotatorimg) in versions at least up to 1.1 from PosThemes for PrestaShop, a guest can perform SQL injection.
tp-link
CVE-2023-46371 · tp-link tl-wdr7660_firmware
TP-Link device TL-WDR7660 2.0.30 and TL-WR886N 2.0.12 has a stack overflow vulnerability via the function upgradeInfoJsonToBin.
CVE-2023-46373 · tp-link tl-wdr7660_firmware
TP-Link TL-WDR7660 2.0.30 has a stack overflow vulnerability via the function deviceInfoJsonToBincauses.
nothings
tenda
CVE-2023-46369 · tenda w18e_firmware
Tenda W18E V16.01.0.8(1576) contains a stack overflow vulnerability via the portMirrorMirroredPorts parameter in the formSetNetCheckTools…
CVE-2023-46370 · tenda w18e_firmware
Tenda W18E V16.01.0.8(1576) has a command injection vulnerability via the hostName parameter in the formSetNetCheckTools function.
CodeAstro
CVE-2023-5693 · CodeAstro Internet Banking System
CodeAstro Internet Banking System pages_reset_pwd.php sql injection
Netentsec
CVE-2023-5700 · Netentsec NS-ASG Application Security Gateway
Netentsec NS-ASG Application Security Gateway uploadiscgwrouteconf.php sql injection
vmware
quantumcloud
CVE-2023-5204 · quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response
CVE-2023-5241 · quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file
CVE-2023-5212 · quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file
CVE-2023-5533 · quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions
SolarWinds
CVE-2023-35182 · SolarWinds Access Rights Manager
SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability
CVE-2023-35187 · SolarWinds Access Rights Manager
SolarWinds Access Rights Manager Directory Traversal Remote Code Execution Vulnerability
CVE-2023-35184 · SolarWinds Access Rights Manager
SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability
simplepress
CVE-2020-36706 · simplepress Simple:Press Forum
Simple:Press – WordPress Forum Plugin <= 6.6.0 - Arbitrary File Upload
Weintek
wpdevteam
CVE-2023-4402 · wpdevteam Essential Blocks Pro
Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via products
hyno
CVE-2023-4488 · hyno Dropbox Folder Share
Dropbox Folder Share <= 1.9.7 - Unauthenticated Local File Inclusion
home-assistant
CVE-2023-41897 · home-assistant core
Lack of XFO header allows clickjacking in Home Assistant Core
CVE-2023-41895 · home-assistant core
Cross-site Scripting via auth_callback login in Home Assistant Core
CVE-2023-41896 · home-assistant core
Fake websocket server installation permits full takeover in Home Assistant Core
icegram
CVE-2023-5414 · icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress
Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read
iterm2
six2dez
knownband
wpvividplugins
CVE-2023-5576 · wpvividplugins WPvivid — Backup, Migration & Staging
Migration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret Exposure
IBM
CVE-2022-22466 · IBM Security Verify Governance
IBM Security Verify Governance information disclosure
HCL Software
CVE-2023-37503 · HCL Software HCL Compass