Critical vulnerability archive — page 566

novisurvey1 vulnerability on this pageMax CVSS 9.8Priority 97KEV 1

CVE-2023-29492 · novisurvey novi_survey

Novi Survey Insecure Deserialization Vulnerability

KEV · due 4 May EPSS 3%public exploit SSVC act CVSS 9.8

froxlor1 vulnerability on this pageMax CVSS 9.1Priority 57KEV 0

CVE-2023-2034 · froxlor froxlor/froxlor

Unrestricted Upload of File with Dangerous Type in froxlor/froxlor

EPSS 71%public exploit CVSS 9.1

mitre24 vulnerabilities on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2023-27648 · mitre

Directory Traversal vulnerability found in T-ME Studios Change Color of Keypad v.1.275.1.277 allows a remote attacker to execute arbitrar…

EPSS 3%public exploit CVSS 9.8

CVE-2023-29798 · mitre

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the command parameter in the setTrac…

EPSS 2%public exploit CVSS 9.8

CVE-2023-29799 · mitre

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpM…

EPSS 2%public exploit CVSS 9.8

CVE-2023-29800 · mitre

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the FileName parameter in the Upload…

EPSS 2%public exploit CVSS 9.8

CVE-2023-29801 · mitre

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogS…

EPSS 2%public exploit CVSS 9.8

CVE-2023-29802 · mitre

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosis…

EPSS 2%public exploit CVSS 9.8

CVE-2023-29803 · mitre

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the pid parameter in the disconnectV…

EPSS 2%public exploit CVSS 9.8

CVE-2023-29805 · mitre

WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the pro_stor_canceltrans_handler_part_19 function.

EPSS 2%public exploit CVSS 9.8

CVE-2023-27746 · mitre

BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute for…

EPSS 2%public exploit CVSS 9.8

CVE-2023-29622 · mitre

Purchase Order Management v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /purchase_order/admi…

EPSS 2%public exploit CVSS 9.8

CVE-2022-47027 · mitre

Timmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictio…

EPSS 1%public exploit CVSS 9.8

CVE-2023-27654 · mitre

An issue found in WHOv.1.0.28, v.1.0.30, v.1.0.32 allows an attacker to cause a escalation of privileges via the TTMultiProvider component.

EPSS 1%public exploit CVSS 9.8

CVE-2023-27667 · mitre

Auto Dealer Management System v1.0 was discovered to contain a SQL injection vulnerability.

EPSS 0.6%public exploit CVSS 9.8

CVE-2023-27748 · mitre

BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded firmware.

EPSS 0.7%public exploit CVSS 9.8

CVE-2023-29598 · mitre

lmxcms v1.4.1 was discovered to contain a SQL injection vulnerability via the setbook parameter at index.php.

EPSS 0.7%public exploit CVSS 9.8

CVE-2023-26918 · mitre

Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will b…

EPSS 6%CVSS 9.8

CVE-2023-27032 · mitre

Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopu…

EPSS 3%CVSS 9.8

CVE-2023-26463 · mitre

strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes…

EPSS 2%CVSS 9.8

CVE-2022-45173 · mitre

An issue was discovered in LIVEBOX Collaboration vDesk through v018.

EPSS 1%CVSS 9.8

CVE-2022-45174 · mitre

An issue was discovered in LIVEBOX Collaboration vDesk through v018.

EPSS 1%CVSS 9.8

CVE-2023-27779 · mitre

AM Presencia v3.7.3 was discovered to contain a SQL injection vulnerability via the user parameter in the login form.

EPSS 1.0%CVSS 9.8

CVE-2023-27812 · mitre

bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the delete_file() function.

EPSS 1%CVSS 9.1

CVE-2023-27830 · mitre

TightVNC before v2.8.75 allows attackers to escalate privileges on the host operating system via replacing legitimate files with crafted…

EPSS 1%CVSS 9.0

CVE-2021-46880 · mitre

x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unve…

EPSS 0.6%CVSS 9.8

snyk2 vulnerabilities on this pageMax CVSS 10.0Priority 56KEV 0

CVE-2023-26122 · snyk

All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization.

EPSS 2%public exploit CVSS 10.0

CVE-2023-26121 · snyk

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of it…

EPSS 1%public exploit CVSS 10.0

VulDB1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2023-2056 · VulDB

DedeCMS module_main.php GetSystemFile code injection

EPSS 1.0%public exploit CVSS 9.8

Campcodes1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2023-2037 · Campcodes Video Sharing Website

Campcodes Video Sharing Website watch.php sql injection

EPSS 0.8%public exploit CVSS 9.8

hackerone1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2023-28121 · hackerone

An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on b…

EPSS 87%CVSS 9.8

Microsoft2 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2023-21554 · Microsoft Windows 10 Version 1809

Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

EPSS 95%CVSS 9.8

CVE-2023-28250 · Microsoft Windows 10 Version 1809

Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability

EPSS 2%CVSS 9.8

SAP3 vulnerabilities on this pageMax CVSS 10.0Priority 49KEV 0

CVE-2023-28765 · SAP BusinessObjects Business Intelligence Platform (Promotion Management)

Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )

EPSS 15%CVSS 9.8

CVE-2023-27267 · SAP Diagnostics Agent (OSCommand Bridge)

Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge)

EPSS 14%CVSS 9.0

CVE-2023-27497 · SAP Diagnostics Agent (EventLogServiceCollector)

Multiple vulnerabilities in SAP Diagnostics Agent (EventLogServiceCollector)

EPSS 0.8%CVSS 10.0

Siemens1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2023-28489 · Siemens CP-8031 MASTER MODULE

A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05).

EPSS 3%CVSS 9.8

Fortinet1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2022-41331 · Fortinet FortiPresence

A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows…

EPSS 1%CVSS 9.8

ForgeRock Inc.1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2022-3748 · ForgeRock Inc. Access Management

Improper authorization that can lead to account impersonation

EPSS 0.9%CVSS 9.8

DTS Electronics2 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2023-1803 · DTS Electronics Redline Router

Authentication Bypass in Redline Router

EPSS 0.8%CVSS 9.8

CVE-2023-1833 · DTS Electronics Redline Router

Authentication Bypass in Redline Router

EPSS 0.8%CVSS 9.8

hikvision1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2023-28808 · hikvision DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D

Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission.

EPSS 0.8%CVSS 9.8

SourceCodester2 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2023-1984 · SourceCodester Complaint Management System

SourceCodester Complaint Management System POST Parameter check_availability.php sql injection

EPSS 0.8%CVSS 9.8

CVE-2023-1983 · SourceCodester Sales Tracker Management System

SourceCodester Sales Tracker Management System GET Parameter manage_product.php sql injection

EPSS 0.7%CVSS 9.8

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.0Priority 40KEV 0

CVE-2022-45064 · Apache Software Foundation Apache Sling Engine

Apache Sling Engine: Include-based XSS

EPSS 1%CVSS 9.0

B&R Industrial Automation1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2023-1617 · B&R Industrial Automation B&R VC4

Improper Authentication Mechanism in B&R VC4 Visualization

EPSS 0.7%CVSS 9.8

Eskom1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2023-1863 · Eskom Water Metering Software

SQLi in Eskom Computer Water Metering Software

EPSS 0.7%CVSS 9.8

Libjxl1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2023-0645 · Libjxl Libjxl

Out of Bounds read in libjxl

EPSS 0.9%CVSS 9.1

Control iD1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2023-2043 · Control iD RHiD

Control iD RHiD Edit a sql injection

EPSS 0.5%CVSS 9.8

Arista Networks1 vulnerability on this pageMax CVSS 9.3Priority 31KEV 0

CVE-2023-24509 · Arista Networks Arista EOS

On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading t ...

EPSS 0.2%CVSS 9.3

The archive.