По дате публикации
Эксплуатируемые и новые серьёзные CVE: октябрь 2023 г.
109 записей · 19 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
40В плане | CVE-2023-5322Эксплойта нет | D-Link DAR-7000 edit_manageadmin.php sql injectiondlink · dar-7000 firmware · CWE-89 | Высокая8,8 | — | 16,6 % | 1 окт. 2023 г. |
52В плане | CVE-2023-4211Готовый эксплойт | Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operationsarm · 5th gen gpu architecture kernel driver · CWE-416 | Средняя5,5 | KEV | 1,0 % | 1 окт. 2023 г. |
60На этой неделе | CVE-2023-5350Готовый эксплойт | SQL Injection in salesagility/suitecrmsalesagility · suitecrm · CWE-89 | Критическая9,1 | — | 2,1 % | 3 окт. 2023 г. |
45В плане | CVE-2023-44974Эксплойта нет | An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code viaemlog · emlog · CWE-434 | Критическая9,8 | — | 20,4 % | 3 окт. 2023 г. |
80Срочно | CVE-2023-4911Готовый эксплойт | Glibc: buffer overflow in ld.so leading to privilege escalationgnu · glibc · CWE-122 | Высокая7,8 | KEV | 63,7 % | 3 окт. 2023 г. |
34Наблюдать | CVE-2023-5375Proof of concept | Open Redirect in mosparo/mosparomosparo · mosparo · CWE-601 | Средняя6,1 | — | 34,6 % | 4 окт. 2023 г. |
49В плане | CVE-2023-43261Proof of concept | An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router componentsmilesight · ur5x firmware · CWE-532 | Высокая7,5 | — | 63,6 % | 4 окт. 2023 г. |
99Срочно | CVE-2023-22515Готовый эксплойт | Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknowatlassian · confluence data center · CWE-20 | Критическая9,8 | KEV | 99,2 % | 4 окт. 2023 г. |
31Наблюдать | CVE-2023-27121Эксплойта нет | A cross-site scripting (XSS) vulnerability in the component /framework/cron/action/humanize of Pleasant Solutions Pleasant Password Server vpleasantsolutions · pleasant password server · CWE-79 | Средняя6,1 | — | 22,7 % | 4 окт. 2023 г. |
61На этой неделе | CVE-2023-42824Готовый эксплойт | The issue was addressed with improved checks.apple · ipados | Высокая7,8 | KEV | 0,9 % | 4 окт. 2023 г. |
50В плане | CVE-2023-5399Эксплойта нет | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tamperinschneider-electric · spacelogic c-bus toolkit · CWE-22 | Критическая9,8 | — | 35,4 % | 4 окт. 2023 г. |
21Наблюдать | CVE-2023-44386Эксплойта нет | Incorrect request error handling triggers server crash in Vaporvapor · vapor · CWE-231 | Средняя5,3 | — | 0,7 % | 5 окт. 2023 г. |
37Наблюдать | CVE-2023-44860Эксплойта нет | An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTTnetis-systems · n3m firmware · CWE-863 | Высокая7,5 | — | 22,7 % | 6 окт. 2023 г. |
37Наблюдать | CVE-2023-45363Эксплойта нет | An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1.mediawiki · mediawiki · CWE-835 | Высокая7,5 | — | 23,7 % | 9 окт. 2023 г. |
40В плане | CVE-2023-43641Эксплойта нет | libcue vulnerable to out-of-bounds array accesslipnitsk · libcue · CWE-787 | Высокая8,8 | — | 17,1 % | 9 окт. 2023 г. |
42В плане | CVE-2023-44959Эксплойта нет | An issue found in D-Link DSL-3782 v.1.03 and before allows remote authenticated users to execute arbitrary code as root via the Router IP Addlink · dsl-3782 firmware · CWE-77 | Высокая8,8 | — | 22,8 % | 9 окт. 2023 г. |
90Срочно | CVE-2023-44487Готовый эксплойт | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, assiemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware · CWE-400 | Высокая7,5 | KEV | 99,9 % | 10 окт. 2023 г. |
90Срочно | CVE-2023-4966Готовый эксплойт | Unauthenticated sensitive information disclosurecitrix · netscaler application delivery controller · CWE-119 | Высокая7,5 | KEV | 99,9 % | 10 окт. 2023 г. |
45В плане | CVE-2023-30803Эксплойта нет | Sangfor Next-Gen Application Firewall Authentication Bypasssangfor · next-gen application firewall · CWE-290 | Критическая9,8 | — | 20,8 % | 10 окт. 2023 г. |
58В плане | CVE-2023-30805Эксплойта нет | Sangfor Next-Gen Application Firewall Login Un Param Command Injectionsangfor · next-gen application firewall · CWE-78 | Критическая9,8 | — | 64,9 % | 10 окт. 2023 г. |
58В плане | CVE-2023-30806Эксплойта нет | Sangfor Next-Gen Application Firewall PHPSESSID Command Injectionsangfor · next-gen application firewall · CWE-78 | Критическая9,8 | — | 64,9 % | 10 окт. 2023 г. |
64На этой неделе | CVE-2023-34992Proof of concept | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to efortinet · fortisiem · CWE-78 | Критическая9,8 | — | 81,6 % | 10 окт. 2023 г. |
45В плане | CVE-2023-34993Proof of concept | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.fortinet · fortiwlm · CWE-78 | Критическая9,8 | — | 21,3 % | 10 окт. 2023 г. |
58В плане | CVE-2023-36563Готовый эксплойт | Microsoft WordPad Information Disclosure Vulnerabilitymicrosoft · windows 10 1507 · CWE-20 | Средняя5,5 | KEV | 20,3 % | 10 окт. 2023 г. |
60На этой неделе | CVE-2023-36584Готовый эксплойт | Windows Mark of the Web Security Feature Bypass Vulnerabilitymicrosoft · windows 10 1507 | Средняя5,4 | KEV | 3,2 % | 10 окт. 2023 г. |
51В плане | CVE-2023-36606Эксплойта нет | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerabilitymicrosoft · windows 10 · CWE-400 | Высокая7,5 | — | 69,3 % | 10 окт. 2023 г. |
51В плане | CVE-2023-38171Эксплойта нет | Microsoft QUIC Denial of Service Vulnerabilitymicrosoft · .net · CWE-476 | Высокая7,5 | — | 71,0 % | 10 окт. 2023 г. |
78На этой неделе | CVE-2023-41763Готовый эксплойт | Skype for Business Elevation of Privilege Vulnerabilitymicrosoft · skype for business server · CWE-918 | Средняя5,3 | KEV | 90,5 % | 10 окт. 2023 г. |
35Наблюдать | CVE-2023-41772Proof of concept | Win32k Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1809 · CWE-284 | Высокая7,8 | — | 13,3 % | 10 окт. 2023 г. |
39Наблюдать | CVE-2023-30804Эксплойта нет | Sangfor Next-Gen Application Firewall Authenticated File Disclosuresangfor · next-gen application firewall · CWE-22 | Средняя6,9 | — | 38,9 % | 10 окт. 2023 г. |
56В плане | CVE-2023-32645Эксплойта нет | A leftover debug code vulnerability exists in the httpd debug credentials functionality of Yifan YF325 v1.0_20221108.yifanwireless · yf325 firmware · CWE-489 | Критическая9,8 | — | 55,2 % | 11 окт. 2023 г. |
50В плане | CVE-2023-43661Эксплойта нет | Cachet vulnerable to Authenticated Remote Code Executionall-three · cachet · CWE-94 | Высокая8,8 | — | 51,4 % | 11 окт. 2023 г. |
60На этой неделе | CVE-2023-45138Эксплойта нет | Change Request Application vulnerable to XSS and remote code execution through change request titlexwiki · change request · CWE-79 | Критическая9,6 | — | 71,7 % | 12 окт. 2023 г. |
40В плане | CVE-2023-29464Эксплойта нет | Rockwell Automation FactoryTalk Linx Vulnerable to Denial-of-Service and Information Disclosurerockwellautomation · factorytalk linx · CWE-20 | Критическая9,1 | — | 14,9 % | 13 окт. 2023 г. |
44В плане | CVE-2023-45852Proof of concept | In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands viviessmann · vitogate 300 firmware · CWE-77 | Критическая9,8 | — | 15,2 % | 13 окт. 2023 г. |
33Наблюдать | CVE-2023-5591Эксплойта нет | SQL Injection in librenms/librenmslibrenms · librenms · CWE-89 | Средняя6,5 | — | 23,7 % | 15 окт. 2023 г. |
100Срочно | CVE-2023-20198Готовый эксплойт | Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software.cisco · ios xe · CWE-420 | Критическая10,0 | KEV | 99,6 % | 16 окт. 2023 г. |
38Наблюдать | CVE-2023-5003Proof of concept | Active Directory Integration < 4.1.10 - Unauthenticated Log Disclosureminiorange · active directory integration \/ ldap integration · CWE-538 | Высокая7,5 | — | 26,6 % | 16 окт. 2023 г. |
47В плане | CVE-2023-45375Proof of concept | In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via `Pire01generator · pireospay · CWE-89 | Высокая8,8 | — | 41,0 % | 17 окт. 2023 г. |
43В плане | CVE-2023-44693Эксплойта нет | D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php.dlink · dar-7000 firmware · CWE-89 | Критическая9,8 | — | 14,4 % | 17 окт. 2023 г. |
47В плане | CVE-2023-39456Эксплойта нет | Apache Traffic Server: Malformed http/2 frames can cause an abortapache · traffic server · CWE-20 | Высокая7,5 | — | 58,2 % | 17 окт. 2023 г. |
63На этой неделе | CVE-2023-38545Proof of concept | This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.haxx · libcurl · CWE-787 | Критическая9,8 | — | 78,6 % | 18 окт. 2023 г. |
61На этой неделе | CVE-2023-45727Готовый эксплойт | Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1northgrid · proself · CWE-611 | Высокая7,5 | KEV | 4,8 % | 18 окт. 2023 г. |
74На этой неделе | CVE-2023-5631Готовый эксплойт | Stored XSS vulnerability in Roundcuberoundcube · webmail · CWE-79 | Средняя5,4 | KEV | 76,9 % | 18 окт. 2023 г. |
45В плане | CVE-2023-5642Эксплойта нет | Advantech R-SeeNet Unauthenticated Read/Writeadvantech · r-seenet · CWE-200 | Критическая9,8 | — | 19,4 % | 18 окт. 2023 г. |
49В плане | CVE-2023-46229Proof of concept | LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to anlangchain · langchain · CWE-918 | Высокая8,8 | — | 47,6 % | 19 окт. 2023 г. |
44В плане | CVE-2023-35180Эксплойта нет | SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerabilitysolarwinds · access rights manager · CWE-502 | Высокая8,8 | — | 30,0 % | 19 окт. 2023 г. |
47В плане | CVE-2023-46042Эксплойта нет | An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo().get-simple · getsimplecms · CWE-94 | Критическая9,8 | — | 25,2 % | 19 окт. 2023 г. |
52В плане | CVE-2023-34051Proof of concept | VMware Aria Operations for Logs contains an authentication bypass vulnerability.vmware · aria operations for logs · CWE-863 | Критическая9,8 | — | 44,6 % | 20 окт. 2023 г. |
44В плане | CVE-2023-5683Эксплойта нет | Byzoro Smart S85F Management Platform importconf.php os command injectionbyzoro · smart s85f firmware · CWE-78 | Критическая9,8 | — | 17,9 % | 21 окт. 2023 г. |
63На этой неделе | CVE-2023-5684Эксплойта нет | Byzoro Smart S85F Management Platform importexport.php os command injectionbyzoro · smart s85f firmware · CWE-78 | Критическая9,8 | — | 78,4 % | 21 окт. 2023 г. |
30Наблюдать | CVE-2023-5702Proof of concept | Viessmann Vitogate 300 direct requestviessmann · vitogate 300 firmware · CWE-425 | Средняя6,5 | — | 14,5 % | 22 окт. 2023 г. |
51В плане | CVE-2023-43622Proof of concept | Apache HTTP Server: DoS in HTTP/2 with initial windows size 0apache · http server · CWE-400 | Высокая7,5 | — | 68,8 % | 23 окт. 2023 г. |
24Наблюдать | CVE-2023-45802Proof of concept | Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RSTapache · http server · CWE-404 | Средняя5,9 | — | 3,1 % | 23 окт. 2023 г. |
32Наблюдать | CVE-2023-46127Эксплойта нет | Frappe vulnerable to HTML injection by any Desk userfrappe · frappe · CWE-79 | Средняя5,4 | — | 36,9 % | 23 окт. 2023 г. |
39Наблюдать | CVE-2023-37635Proof of concept | UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the appuvdesk · community-skeleton · CWE-307 | Критическая9,8 | — | 1,1 % | 23 окт. 2023 г. |
30Наблюдать | CVE-2023-45966Proof of concept | umputun remark42 version 1.12.1 and before has a Blind Server-Side Request Forgery (SSRF) vulnerability.remark42 · remark42 · CWE-918 | Высокая7,5 | — | 0,7 % | 23 окт. 2023 г. |
21Наблюдать | CVE-2023-43358Proof of concept | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Tcmsmadesimple · cms made simple · CWE-79 | Средняя5,4 | — | 0,4 % | 23 окт. 2023 г. |
19Наблюдать | CVE-2023-44760Proof of concept | Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted scriptconcretecms · concrete cms · CWE-79 | Средняя4,8 | — | 0,6 % | 23 окт. 2023 г. |
40В плане | CVE-2022-3699Готовый эксплойт | A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior tolenovo · diagnostics · CWE-787 | Высокая7,8 | — | 4,2 % | 25 окт. 2023 г. |
86Срочно | CVE-2023-20273Готовый эксплойт | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the pricisco · ios xe · CWE-78 | Высокая7,2 | KEV | 92,9 % | 25 окт. 2023 г. |
99Срочно | CVE-2023-34048Готовый эксплойт | VMware vCenter Server Out-of-Bounds Write Vulnerabilityvmware · vcenter server · CWE-787 | Критическая9,8 | KEV | 99,4 % | 25 окт. 2023 г. |
24Наблюдать | CVE-2023-34446Proof of concept | iTop XSS vulnerability on pages/preferences.phpcombodo · itop · CWE-79 | Средняя6,1 | — | 0,5 % | 25 окт. 2023 г. |
24Наблюдать | CVE-2023-36085Proof of concept | The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endsisqualwfm · sisqualwfm · CWE-601 | Средняя6,1 | — | 0,5 % | 25 окт. 2023 г. |
38Наблюдать | CVE-2023-37908Proof of concept | org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerabilityxwiki · xwiki-rendering · CWE-83 | Критическая9,6 | — | 1,0 % | 25 окт. 2023 г. |
28Наблюдать | CVE-2023-38041Proof of concept | A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition.ivanti · secure access client · CWE-367 | Высокая7,0 | — | 0,6 % | 25 окт. 2023 г. |
21Наблюдать | CVE-2023-43360Proof of concept | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Tcmsmadesimple · cms made simple · CWE-79 | Средняя5,4 | — | 0,5 % | 25 окт. 2023 г. |
60На этой неделе | CVE-2023-43795Proof of concept | WPS Server Side Request Forgery in GeoServerosgeo · geoserver · CWE-918 | Критическая9,8 | — | 68,4 % | 25 окт. 2023 г. |
19Наблюдать | CVE-2023-44767Proof of concept | A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content.ritecms · ritecms · CWE-79 | Средняя4,8 | — | 0,4 % | 25 окт. 2023 г. |
21Наблюдать | CVE-2023-44769Proof of concept | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted scripttribalsystems · zenario · CWE-79 | Средняя5,4 | — | 0,6 % | 25 окт. 2023 г. |
30Наблюдать | CVE-2023-46136Proof of concept | Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginningpalletsprojects · werkzeug · CWE-400 | Высокая7,5 | — | 1,0 % | 25 окт. 2023 г. |
54В плане | CVE-2023-46347Proof of concept | In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform Sndkdesign · ndk steppingpack · CWE-89 | Критическая9,8 | — | 49,8 % | 25 окт. 2023 г. |
44В плане | CVE-2023-46370Эксплойта нет | Tenda W18E V16.01.0.8(1576) has a command injection vulnerability via the hostName parameter in the formSetNetCheckTools function.tenda · w18e firmware · CWE-77 | Критическая9,8 | — | 18,0 % | 25 окт. 2023 г. |
39Наблюдать | CVE-2023-46371Proof of concept | TP-Link device TL-WDR7660 2.0.30 and TL-WR886N 2.0.12 has a stack overflow vulnerability via the function upgradeInfoJsonToBin.tp-link · tl-wdr7660 firmware · CWE-787 | Критическая9,8 | — | 1,1 % | 25 окт. 2023 г. |
59В плане | CVE-2023-46574Proof of concept | An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the Uplototolink · a3700r firmware · CWE-77 | Критическая9,8 | — | 65,4 % | 25 окт. 2023 г. |
31Наблюдать | CVE-2023-40404Proof of concept | A use-after-free issue was addressed with improved memory management.apple · macos · CWE-416 | Высокая7,8 | — | 1,1 % | 25 окт. 2023 г. |
40В плане | CVE-2023-45136Proof of concept | XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabledxwiki · xwiki · CWE-79 | Критическая9,6 | — | 5,1 % | 25 окт. 2023 г. |
36Наблюдать | CVE-2023-5043Proof of concept | Ingress nginx annotation injection causes arbitrary command executionkubernetes · ingress-nginx · CWE-20 | Высокая8,8 | — | 2,2 % | 25 окт. 2023 г. |
52В плане | CVE-2023-5044Proof of concept | Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotationkubernetes · ingress-nginx · CWE-20 | Высокая8,8 | — | 56,6 % | 25 окт. 2023 г. |
31Наблюдать | CVE-2023-5717Proof of concept | Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) componentlinux · linux kernel · CWE-787 | Высокая7,8 | — | 0,8 % | 25 окт. 2023 г. |
35Наблюдать | CVE-2023-46449Proof of concept | Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control.mayurik · inventory management system · CWE-732 | Высокая8,8 | — | 0,7 % | 26 окт. 2023 г. |
21Наблюдать | CVE-2023-46450Proof of concept | Sourcecodester Free and Open Source inventory management system 1.0 is vulnerable to Cross Site Scripting (XSS) via the Add supplier functiomayurik · inventory management system · CWE-79 | Средняя5,4 | — | 0,4 % | 26 окт. 2023 г. |
94Срочно | CVE-2023-43208Готовый эксплойт | NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution.nextgen · mirth connect · CWE-78 | Критическая9,8 | KEV | 82,7 % | 26 окт. 2023 г. |
49В плане | CVE-2023-31419Proof of concept | Elasticsearch StackOverflow vulnerabilityelastic · elasticsearch · CWE-121 | Высокая7,5 | — | 61,7 % | 26 окт. 2023 г. |
98Срочно | CVE-2023-46747Готовый эксплойт | BIG-IP Configuration utility unauthenticated remote code execution vulnerabilityf5 · big-ip access policy manager · CWE-288 | Критическая9,8 | KEV | 96,5 % | 26 окт. 2023 г. |
66На этой неделе | CVE-2023-46748Готовый эксплойт | BIG-IP Configuration utility authenticated SQL injection vulnerabilityf5 · big-ip access policy manager · CWE-89 | Высокая8,8 | KEV | 4,4 % | 26 окт. 2023 г. |
46В плане | CVE-2018-17879Эксплойта нет | An issue was discovered on certain ABUS TVIP cameras.abus · tvip 10000 firmware · CWE-78 | Критическая9,8 | — | 21,8 % | 26 окт. 2023 г. |
31Наблюдать | CVE-2023-43352Proof of concept | An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu compocmsmadesimple · cms made simple · CWE-94 | Высокая7,8 | — | 0,5 % | 26 окт. 2023 г. |
28Наблюдать | CVE-2023-46813Proof of concept | An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers.linux · linux kernel | Высокая7,0 | — | 0,6 % | 26 окт. 2023 г. |
60На этой неделе | CVE-2023-45498Готовый эксплойт | VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.vinchin · vinchin backup and recovery · CWE-77 | Критическая9,8 | — | 20,4 % | 27 окт. 2023 г. |
60На этой неделе | CVE-2023-45499Готовый эксплойт | VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials.vinchin · vinchin backup and recovery · CWE-798 | Критическая9,8 | — | 7,8 % | 27 окт. 2023 г. |
40В плане | CVE-2023-46818Готовый эксплойт | An issue was discovered in ISPConfig before 3.2.11p1.ispconfig · ispconfig · CWE-94 | Высокая7,2 | — | 15,8 % | 27 окт. 2023 г. |
99Срочно | CVE-2023-46604Готовый эксплойт | Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attackapache · activemq · CWE-502 | Критическая9,8 | KEV | 99,8 % | 27 окт. 2023 г. |
35Наблюдать | CVE-2023-35794Proof of concept | An issue was discovered in Cassia Access Controller 2.1.1.2303271039.cassianetworks · access controller · CWE-287 | Высокая8,8 | — | 0,9 % | 27 окт. 2023 г. |
13Наблюдать | CVE-2023-40127Proof of concept | In multiple locations, there is a possible way to access screenshots due to a confused deputy.google · android | Низкая3,3 | — | 0,2 % | 27 окт. 2023 г. |
31Наблюдать | CVE-2023-40130Proof of concept | In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code.google · android | Высокая7,8 | — | 0,1 % | 27 окт. 2023 г. |
22Наблюдать | CVE-2023-40133Proof of concept | In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy.google · android | Средняя5,5 | — | 0,1 % | 27 окт. 2023 г. |
57В плане | CVE-2023-5830Proof of concept | ColumbiaSoft Document Locator WebTools login improper authenticationdocumentlocator · document locator · CWE-287 | Критическая9,8 | — | 60,7 % | 27 окт. 2023 г. |
34Наблюдать | CVE-2023-46865Proof of concept | /api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing thcraterapp · crater · CWE-94 | Высокая7,2 | — | 20,3 % | 29 окт. 2023 г. |
18Наблюдать | CVE-2023-45671Proof of concept | Frigate reflected XSS through `/<camera_name>` API endpointsfrigate · frigate · CWE-79 | Средняя4,7 | — | 1,4 % | 30 окт. 2023 г. |
- CVE-2023-532240В плане
D-Link DAR-7000 edit_manageadmin.php sql injection
ВысокаяCVSS 8,8Эксплойта нетEPSS 16 %dlink · dar-7000 firmware1 окт. 2023 г.
- CVE-2023-421152В плане
Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations
СредняяCVSS 5,5KEVГотовый эксплойтEPSS 1 %arm · 5th gen gpu architecture kernel driver1 окт. 2023 г.
- CVE-2023-535060На этой неделе
SQL Injection in salesagility/suitecrm
КритическаяCVSS 9,1Готовый эксплойтEPSS 2 %salesagility · suitecrm3 окт. 2023 г.
- CVE-2023-4497445В плане
An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via
КритическаяCVSS 9,8Эксплойта нетEPSS 20 %emlog · emlog3 окт. 2023 г.
- CVE-2023-491180Срочно
Glibc: buffer overflow in ld.so leading to privilege escalation
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 63 %gnu · glibc3 окт. 2023 г.
- CVE-2023-537534Наблюдать
Open Redirect in mosparo/mosparo
СредняяCVSS 6,1Proof of conceptEPSS 34 %mosparo · mosparo4 окт. 2023 г.
- CVE-2023-4326149В плане
An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components
ВысокаяCVSS 7,5Proof of conceptEPSS 63 %milesight · ur5x firmware4 окт. 2023 г.
- CVE-2023-2251599Срочно
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknow
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %atlassian · confluence data center4 окт. 2023 г.
- CVE-2023-2712131Наблюдать
A cross-site scripting (XSS) vulnerability in the component /framework/cron/action/humanize of Pleasant Solutions Pleasant Password Server v
СредняяCVSS 6,1Эксплойта нетEPSS 22 %pleasantsolutions · pleasant password server4 окт. 2023 г.
- CVE-2023-4282461На этой неделе
The issue was addressed with improved checks.
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 0 %apple · ipados4 окт. 2023 г.
- CVE-2023-539950В плане
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tamperin
КритическаяCVSS 9,8Эксплойта нетEPSS 35 %schneider-electric · spacelogic c-bus toolkit4 окт. 2023 г.
- CVE-2023-4438621Наблюдать
Incorrect request error handling triggers server crash in Vapor
СредняяCVSS 5,3Эксплойта нетEPSS 0 %vapor · vapor5 окт. 2023 г.
- CVE-2023-4486037Наблюдать
An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTT
ВысокаяCVSS 7,5Эксплойта нетEPSS 22 %netis-systems · n3m firmware6 окт. 2023 г.
- CVE-2023-4536337Наблюдать
An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1.
ВысокаяCVSS 7,5Эксплойта нетEPSS 23 %mediawiki · mediawiki9 окт. 2023 г.
- CVE-2023-4364140В плане
libcue vulnerable to out-of-bounds array access
ВысокаяCVSS 8,8Эксплойта нетEPSS 17 %lipnitsk · libcue9 окт. 2023 г.
- CVE-2023-4495942В плане
An issue found in D-Link DSL-3782 v.1.03 and before allows remote authenticated users to execute arbitrary code as root via the Router IP Ad
ВысокаяCVSS 8,8Эксплойта нетEPSS 22 %dlink · dsl-3782 firmware9 окт. 2023 г.
- CVE-2023-4448790Срочно
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 99 %siemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware10 окт. 2023 г.
- CVE-2023-496690Срочно
Unauthenticated sensitive information disclosure
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 99 %citrix · netscaler application delivery controller10 окт. 2023 г.
- CVE-2023-3080345В плане
Sangfor Next-Gen Application Firewall Authentication Bypass
КритическаяCVSS 9,8Эксплойта нетEPSS 20 %sangfor · next-gen application firewall10 окт. 2023 г.
- CVE-2023-3080558В плане
Sangfor Next-Gen Application Firewall Login Un Param Command Injection
КритическаяCVSS 9,8Эксплойта нетEPSS 64 %sangfor · next-gen application firewall10 окт. 2023 г.
- CVE-2023-3080658В плане
Sangfor Next-Gen Application Firewall PHPSESSID Command Injection
КритическаяCVSS 9,8Эксплойта нетEPSS 64 %sangfor · next-gen application firewall10 окт. 2023 г.
- CVE-2023-3499264На этой неделе
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to e
КритическаяCVSS 9,8Proof of conceptEPSS 81 %fortinet · fortisiem10 окт. 2023 г.
- CVE-2023-3499345В плане
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.
КритическаяCVSS 9,8Proof of conceptEPSS 21 %fortinet · fortiwlm10 окт. 2023 г.
- CVE-2023-3656358В плане
Microsoft WordPad Information Disclosure Vulnerability
СредняяCVSS 5,5KEVГотовый эксплойтEPSS 20 %microsoft · windows 10 150710 окт. 2023 г.
- CVE-2023-3658460На этой неделе
Windows Mark of the Web Security Feature Bypass Vulnerability
СредняяCVSS 5,4KEVГотовый эксплойтEPSS 3 %microsoft · windows 10 150710 окт. 2023 г.
- CVE-2023-3660651В плане
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
ВысокаяCVSS 7,5Эксплойта нетEPSS 69 %microsoft · windows 1010 окт. 2023 г.
- CVE-2023-3817151В плане
Microsoft QUIC Denial of Service Vulnerability
ВысокаяCVSS 7,5Эксплойта нетEPSS 71 %microsoft · .net10 окт. 2023 г.
- CVE-2023-4176378На этой неделе
Skype for Business Elevation of Privilege Vulnerability
СредняяCVSS 5,3KEVГотовый эксплойтEPSS 90 %microsoft · skype for business server10 окт. 2023 г.
- CVE-2023-4177235Наблюдать
Win32k Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 13 %microsoft · windows 10 180910 окт. 2023 г.
- CVE-2023-3080439Наблюдать
Sangfor Next-Gen Application Firewall Authenticated File Disclosure
СредняяCVSS 6,9Эксплойта нетEPSS 38 %sangfor · next-gen application firewall10 окт. 2023 г.
- CVE-2023-3264556В плане
A leftover debug code vulnerability exists in the httpd debug credentials functionality of Yifan YF325 v1.0_20221108.
КритическаяCVSS 9,8Эксплойта нетEPSS 55 %yifanwireless · yf325 firmware11 окт. 2023 г.
- CVE-2023-4366150В плане
Cachet vulnerable to Authenticated Remote Code Execution
ВысокаяCVSS 8,8Эксплойта нетEPSS 51 %all-three · cachet11 окт. 2023 г.
- CVE-2023-4513860На этой неделе
Change Request Application vulnerable to XSS and remote code execution through change request title
КритическаяCVSS 9,6Эксплойта нетEPSS 71 %xwiki · change request12 окт. 2023 г.
- CVE-2023-2946440В плане
Rockwell Automation FactoryTalk Linx Vulnerable to Denial-of-Service and Information Disclosure
КритическаяCVSS 9,1Эксплойта нетEPSS 14 %rockwellautomation · factorytalk linx13 окт. 2023 г.
- CVE-2023-4585244В плане
In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands vi
КритическаяCVSS 9,8Proof of conceptEPSS 15 %viessmann · vitogate 300 firmware13 окт. 2023 г.
- CVE-2023-559133Наблюдать
SQL Injection in librenms/librenms
СредняяCVSS 6,5Эксплойта нетEPSS 23 %librenms · librenms15 окт. 2023 г.
- CVE-2023-20198100Срочно
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software.
КритическаяCVSS 10,0KEVГотовый эксплойтEPSS 99 %cisco · ios xe16 окт. 2023 г.
- CVE-2023-500338Наблюдать
Active Directory Integration < 4.1.10 - Unauthenticated Log Disclosure
ВысокаяCVSS 7,5Proof of conceptEPSS 26 %miniorange · active directory integration \/ ldap integration16 окт. 2023 г.
- CVE-2023-4537547В плане
In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via `Pire
ВысокаяCVSS 8,8Proof of conceptEPSS 41 %01generator · pireospay17 окт. 2023 г.
- CVE-2023-4469343В плане
D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php.
КритическаяCVSS 9,8Эксплойта нетEPSS 14 %dlink · dar-7000 firmware17 окт. 2023 г.
- CVE-2023-3945647В плане
Apache Traffic Server: Malformed http/2 frames can cause an abort
ВысокаяCVSS 7,5Эксплойта нетEPSS 58 %apache · traffic server17 окт. 2023 г.
- CVE-2023-3854563На этой неделе
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.
КритическаяCVSS 9,8Proof of conceptEPSS 78 %haxx · libcurl18 окт. 2023 г.
- CVE-2023-4572761На этой неделе
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 4 %northgrid · proself18 окт. 2023 г.
- CVE-2023-563174На этой неделе
Stored XSS vulnerability in Roundcube
СредняяCVSS 5,4KEVГотовый эксплойтEPSS 76 %roundcube · webmail18 окт. 2023 г.
- CVE-2023-564245В плане
Advantech R-SeeNet Unauthenticated Read/Write
КритическаяCVSS 9,8Эксплойта нетEPSS 19 %advantech · r-seenet18 окт. 2023 г.
- CVE-2023-4622949В плане
LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an
ВысокаяCVSS 8,8Proof of conceptEPSS 47 %langchain · langchain19 окт. 2023 г.
- CVE-2023-3518044В плане
SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Эксплойта нетEPSS 30 %solarwinds · access rights manager19 окт. 2023 г.
- CVE-2023-4604247В плане
An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo().
КритическаяCVSS 9,8Эксплойта нетEPSS 25 %get-simple · getsimplecms19 окт. 2023 г.
- CVE-2023-3405152В плане
VMware Aria Operations for Logs contains an authentication bypass vulnerability.
КритическаяCVSS 9,8Proof of conceptEPSS 44 %vmware · aria operations for logs20 окт. 2023 г.
- CVE-2023-568344В плане
Byzoro Smart S85F Management Platform importconf.php os command injection
КритическаяCVSS 9,8Эксплойта нетEPSS 17 %byzoro · smart s85f firmware21 окт. 2023 г.
- CVE-2023-568463На этой неделе
Byzoro Smart S85F Management Platform importexport.php os command injection
КритическаяCVSS 9,8Эксплойта нетEPSS 78 %byzoro · smart s85f firmware21 окт. 2023 г.
- CVE-2023-570230Наблюдать
Viessmann Vitogate 300 direct request
СредняяCVSS 6,5Proof of conceptEPSS 14 %viessmann · vitogate 300 firmware22 окт. 2023 г.
- CVE-2023-4362251В плане
Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
ВысокаяCVSS 7,5Proof of conceptEPSS 68 %apache · http server23 окт. 2023 г.
- CVE-2023-4580224Наблюдать
Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST
СредняяCVSS 5,9Proof of conceptEPSS 3 %apache · http server23 окт. 2023 г.
- CVE-2023-4612732Наблюдать
Frappe vulnerable to HTML injection by any Desk user
СредняяCVSS 5,4Эксплойта нетEPSS 36 %frappe · frappe23 окт. 2023 г.
- CVE-2023-3763539Наблюдать
UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the app
КритическаяCVSS 9,8Proof of conceptEPSS 1 %uvdesk · community-skeleton23 окт. 2023 г.
- CVE-2023-4596630Наблюдать
umputun remark42 version 1.12.1 and before has a Blind Server-Side Request Forgery (SSRF) vulnerability.
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %remark42 · remark4223 окт. 2023 г.
- CVE-2023-4335821Наблюдать
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the T
СредняяCVSS 5,4Proof of conceptEPSS 0 %cmsmadesimple · cms made simple23 окт. 2023 г.
- CVE-2023-4476019Наблюдать
Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script
СредняяCVSS 4,8Proof of conceptEPSS 0 %concretecms · concrete cms23 окт. 2023 г.
- CVE-2022-369940В плане
A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to
ВысокаяCVSS 7,8Готовый эксплойтEPSS 4 %lenovo · diagnostics25 окт. 2023 г.
- CVE-2023-2027386Срочно
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the pri
ВысокаяCVSS 7,2KEVГотовый эксплойтEPSS 92 %cisco · ios xe25 окт. 2023 г.
- CVE-2023-3404899Срочно
VMware vCenter Server Out-of-Bounds Write Vulnerability
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %vmware · vcenter server25 окт. 2023 г.
- CVE-2023-3444624Наблюдать
iTop XSS vulnerability on pages/preferences.php
СредняяCVSS 6,1Proof of conceptEPSS 0 %combodo · itop25 окт. 2023 г.
- CVE-2023-3608524Наблюдать
The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" end
СредняяCVSS 6,1Proof of conceptEPSS 0 %sisqualwfm · sisqualwfm25 окт. 2023 г.
- CVE-2023-3790838Наблюдать
org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability
КритическаяCVSS 9,6Proof of conceptEPSS 1 %xwiki · xwiki-rendering25 окт. 2023 г.
- CVE-2023-3804128Наблюдать
A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition.
ВысокаяCVSS 7,0Proof of conceptEPSS 0 %ivanti · secure access client25 окт. 2023 г.
- CVE-2023-4336021Наблюдать
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the T
СредняяCVSS 5,4Proof of conceptEPSS 0 %cmsmadesimple · cms made simple25 окт. 2023 г.
- CVE-2023-4379560На этой неделе
WPS Server Side Request Forgery in GeoServer
КритическаяCVSS 9,8Proof of conceptEPSS 68 %osgeo · geoserver25 окт. 2023 г.
- CVE-2023-4476719Наблюдать
A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content.
СредняяCVSS 4,8Proof of conceptEPSS 0 %ritecms · ritecms25 окт. 2023 г.
- CVE-2023-4476921Наблюдать
A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script
СредняяCVSS 5,4Proof of conceptEPSS 0 %tribalsystems · zenario25 окт. 2023 г.
- CVE-2023-4613630Наблюдать
Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %palletsprojects · werkzeug25 окт. 2023 г.
- CVE-2023-4634754В плане
In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform S
КритическаяCVSS 9,8Proof of conceptEPSS 49 %ndkdesign · ndk steppingpack25 окт. 2023 г.
- CVE-2023-4637044В плане
Tenda W18E V16.01.0.8(1576) has a command injection vulnerability via the hostName parameter in the formSetNetCheckTools function.
КритическаяCVSS 9,8Эксплойта нетEPSS 18 %tenda · w18e firmware25 окт. 2023 г.
- CVE-2023-4637139Наблюдать
TP-Link device TL-WDR7660 2.0.30 and TL-WR886N 2.0.12 has a stack overflow vulnerability via the function upgradeInfoJsonToBin.
КритическаяCVSS 9,8Proof of conceptEPSS 1 %tp-link · tl-wdr7660 firmware25 окт. 2023 г.
- CVE-2023-4657459В плане
An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the Uplo
КритическаяCVSS 9,8Proof of conceptEPSS 65 %totolink · a3700r firmware25 окт. 2023 г.
- CVE-2023-4040431Наблюдать
A use-after-free issue was addressed with improved memory management.
ВысокаяCVSS 7,8Proof of conceptEPSS 1 %apple · macos25 окт. 2023 г.
- CVE-2023-4513640В плане
XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
КритическаяCVSS 9,6Proof of conceptEPSS 5 %xwiki · xwiki25 окт. 2023 г.
- CVE-2023-504336Наблюдать
Ingress nginx annotation injection causes arbitrary command execution
ВысокаяCVSS 8,8Proof of conceptEPSS 2 %kubernetes · ingress-nginx25 окт. 2023 г.
- CVE-2023-504452В плане
Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation
ВысокаяCVSS 8,8Proof of conceptEPSS 56 %kubernetes · ingress-nginx25 окт. 2023 г.
- CVE-2023-571731Наблюдать
Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %linux · linux kernel25 окт. 2023 г.
- CVE-2023-4644935Наблюдать
Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control.
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %mayurik · inventory management system26 окт. 2023 г.
- CVE-2023-4645021Наблюдать
Sourcecodester Free and Open Source inventory management system 1.0 is vulnerable to Cross Site Scripting (XSS) via the Add supplier functio
СредняяCVSS 5,4Proof of conceptEPSS 0 %mayurik · inventory management system26 окт. 2023 г.
- CVE-2023-4320894Срочно
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 82 %nextgen · mirth connect26 окт. 2023 г.
- CVE-2023-3141949В плане
Elasticsearch StackOverflow vulnerability
ВысокаяCVSS 7,5Proof of conceptEPSS 61 %elastic · elasticsearch26 окт. 2023 г.
- CVE-2023-4674798Срочно
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 96 %f5 · big-ip access policy manager26 окт. 2023 г.
- CVE-2023-4674866На этой неделе
BIG-IP Configuration utility authenticated SQL injection vulnerability
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 4 %f5 · big-ip access policy manager26 окт. 2023 г.
- CVE-2018-1787946В плане
An issue was discovered on certain ABUS TVIP cameras.
КритическаяCVSS 9,8Эксплойта нетEPSS 21 %abus · tvip 10000 firmware26 окт. 2023 г.
- CVE-2023-4335231Наблюдать
An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu compo
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %cmsmadesimple · cms made simple26 окт. 2023 г.
- CVE-2023-4681328Наблюдать
An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers.
ВысокаяCVSS 7,0Proof of conceptEPSS 0 %linux · linux kernel26 окт. 2023 г.
- CVE-2023-4549860На этой неделе
VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.
КритическаяCVSS 9,8Готовый эксплойтEPSS 20 %vinchin · vinchin backup and recovery27 окт. 2023 г.
- CVE-2023-4549960На этой неделе
VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials.
КритическаяCVSS 9,8Готовый эксплойтEPSS 7 %vinchin · vinchin backup and recovery27 окт. 2023 г.
- CVE-2023-4681840В плане
An issue was discovered in ISPConfig before 3.2.11p1.
ВысокаяCVSS 7,2Готовый эксплойтEPSS 15 %ispconfig · ispconfig27 окт. 2023 г.
- CVE-2023-4660499Срочно
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %apache · activemq27 окт. 2023 г.
- CVE-2023-3579435Наблюдать
An issue was discovered in Cassia Access Controller 2.1.1.2303271039.
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %cassianetworks · access controller27 окт. 2023 г.
- CVE-2023-4012713Наблюдать
In multiple locations, there is a possible way to access screenshots due to a confused deputy.
НизкаяCVSS 3,3Proof of conceptEPSS 0 %google · android27 окт. 2023 г.
- CVE-2023-4013031Наблюдать
In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %google · android27 окт. 2023 г.
- CVE-2023-4013322Наблюдать
In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy.
СредняяCVSS 5,5Proof of conceptEPSS 0 %google · android27 окт. 2023 г.
- CVE-2023-583057В плане
ColumbiaSoft Document Locator WebTools login improper authentication
КритическаяCVSS 9,8Proof of conceptEPSS 60 %documentlocator · document locator27 окт. 2023 г.
- CVE-2023-4686534Наблюдать
/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing th
ВысокаяCVSS 7,2Proof of conceptEPSS 20 %craterapp · crater29 окт. 2023 г.
- CVE-2023-4567118Наблюдать
Frigate reflected XSS through `/<camera_name>` API endpoints
СредняяCVSS 4,7Proof of conceptEPSS 1 %frigate · frigate30 окт. 2023 г.