По дате публикации
Эксплуатируемые и новые серьёзные CVE: ноябрь 2023 г.
167 записей · 11 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
46В плане | CVE-2023-4197Proof of concept | Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCEdolibarr · dolibarr erp\/crm · CWE-20 | Высокая8,8 | — | 35,9 % | 1 нояб. 2023 г. |
37Наблюдать | CVE-2023-1718Proof of concept | Bitrix24 Denial-of-Service (DoS) via Improper File Stream Accessbitrix24 · bitrix24 · CWE-835 | Высокая7,5 | — | 24,0 % | 1 нояб. 2023 г. |
40В плане | CVE-2023-1719Proof of concept | Bitrix24 Insecure Global Variable Extractionbitrix24 · bitrix24 · CWE-665 | Критическая9,8 | — | 4,9 % | 1 нояб. 2023 г. |
44В плане | CVE-2023-20048Proof of concept | A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attaccisco · secure firewall management center · CWE-269 | Критическая9,9 | — | 15,8 % | 1 нояб. 2023 г. |
38Наблюдать | CVE-2023-5178Proof of concept | Kernel: use after free in nvmet_tcp_free_crypto in nvmelinux · linux kernel · CWE-416 | Высокая8,8 | — | 9,6 % | 1 нояб. 2023 г. |
45В плане | CVE-2023-46695Эксплойта нет | An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7.djangoproject · django · CWE-770 | Высокая7,5 | — | 49,7 % | 2 нояб. 2023 г. |
39Наблюдать | CVE-2023-46954Proof of concept | SQL Injection vulnerability in Relativity ODA LLC RelativityOne v.12.1.537.3 Patch 2 and earlier allows a remote attacker to execute arbitrarelativity · relativityone · CWE-89 | Критическая9,8 | — | 1,1 % | 2 нояб. 2023 г. |
48В плане | CVE-2023-31102Эксплойта нет | Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.7-zip · 7-zip · CWE-191 | Высокая7,8 | — | 55,2 % | 3 нояб. 2023 г. |
37Наблюдать | CVE-2023-34259Proof of concept | Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read arbitrary files on thekyocera · d-copia253mf plus firmware · CWE-22 | Средняя4,9 | — | 60,4 % | 3 нояб. 2023 г. |
52В плане | CVE-2023-34260Эксплойта нет | Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow a denial of service (service outage) via /wlmdeu%2f%2e%2e%2f%2e%2e followed kyocera · d-copia253mf plus firmware · CWE-22 | Высокая7,5 | — | 73,3 % | 3 нояб. 2023 г. |
57В плане | CVE-2023-46847Эксплойта нет | Squid: denial of service in http digest authenticationsquid-cache · squid · CWE-120 | Высокая7,5 | — | 88,3 % | 3 нояб. 2023 г. |
33Наблюдать | CVE-2023-46848Эксплойта нет | Squid: denial of service in ftpsquid-cache · squid · CWE-681 | Высокая7,5 | — | 10,2 % | 3 нояб. 2023 г. |
40В плане | CVE-2023-3277Proof of concept | MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalationinspireui · mstore api · CWE-288 | Критическая9,8 | — | 2,8 % | 3 нояб. 2023 г. |
39Наблюдать | CVE-2023-41652Proof of concept | WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to SQL Injectioncarrcommunications · rsvpmaker · CWE-89 | Критическая9,8 | — | 1,0 % | 3 нояб. 2023 г. |
40В плане | CVE-2022-45805Proof of concept | WordPress Paytm Payment Gateway Plugin <= 2.7.3 is vulnerable to SQL Injectionpaytm · payment gateway · CWE-89 | Критическая9,8 | — | 2,3 % | 3 нояб. 2023 г. |
40В плане | CVE-2023-46404Proof of concept | PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing.utoronto · pcrs · CWE-94 | Критическая9,9 | — | 1,8 % | 3 нояб. 2023 г. |
39Наблюдать | CVE-2023-46980Proof of concept | An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted scmayurik · best courier management system · CWE-94 | Критическая9,8 | — | 1,5 % | 3 нояб. 2023 г. |
45В плане | CVE-2023-23368Эксплойта нет | QTS, QuTS hero, QuTScloudqnap · qts · CWE-78 | Критическая9,8 | — | 18,6 % | 3 нояб. 2023 г. |
43В плане | CVE-2023-23369Эксплойта нет | QTS, Multimedia Console, and Media Streaming add-onqnap · qts · CWE-77 | Критическая9,8 | — | 14,4 % | 3 нояб. 2023 г. |
33Наблюдать | CVE-2022-3172Proof of concept | Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)kubernetes · apiserver · CWE-918 | Высокая8,2 | — | 2,4 % | 3 нояб. 2023 г. |
31Наблюдать | CVE-2022-44569Proof of concept | A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication.ivanti · automation · CWE-287 | Высокая7,8 | — | 0,7 % | 3 нояб. 2023 г. |
43В плане | CVE-2023-47253Proof of concept | Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.phqualitor · qualitor · CWE-77 | Критическая9,8 | — | 14,3 % | 6 нояб. 2023 г. |
36Наблюдать | CVE-2023-4699Proof of concept | Arbitrary Command Execution Vulnerability in Mitsubishi Electric proprietary protocol communication of multiple FA productsmitsubishielectric · fx3u-32mt\/es firmware · CWE-306 | Критическая9,1 | — | 0,7 % | 6 нояб. 2023 г. |
39Наблюдать | CVE-2023-45657Proof of concept | WordPress Nexter Theme <= 2.0.3 is vulnerable to SQL Injectionposimyth · nexter · CWE-89 | Критическая9,8 | — | 1,2 % | 6 нояб. 2023 г. |
19Наблюдать | CVE-2023-5968Proof of concept | Password hash in response body after username updatemattermost · mattermost · CWE-200 | Средняя4,9 | — | 0,5 % | 6 нояб. 2023 г. |
39Наблюдать | CVE-2023-45827Proof of concept | Prototype Pollution vulnerability in @clickbar/dot-diverclickbar · dot-diver · CWE-1321 | Критическая9,8 | — | 1,1 % | 6 нояб. 2023 г. |
66На этой неделе | CVE-2023-46731Эксплойта нет | Remote code execution through the section parameter in Administration as guest in XWiki Platformxwiki · xwiki · CWE-94 | Критическая9,8 | — | 88,5 % | 6 нояб. 2023 г. |
25Наблюдать | CVE-2023-46732Proof of concept | Reflected Cross-site scripting through revision parameter in content menu in XWiki Platformxwiki · xwiki · CWE-79 | Средняя6,1 | — | 2,1 % | 6 нояб. 2023 г. |
39Наблюдать | CVE-2023-5777Эксплойта нет | Weintek EasyBuilder Pro Use of Hard-coded Credentialsweintek · easybuilder pro · CWE-798 | Критическая9,8 | — | 0,5 % | 6 нояб. 2023 г. |
24Наблюдать | CVE-2023-46998Proof of concept | Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted bootboxjs · bootbox · CWE-79 | Средняя6,1 | — | 1,4 % | 7 нояб. 2023 г. |
21Наблюдать | CVE-2023-47102Proof of concept | UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid.urbackup · urbackup server · CWE-203 | Средняя5,3 | — | 0,6 % | 7 нояб. 2023 г. |
45В плане | CVE-2023-38547Эксплойта нет | A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access itsveeam · one · CWE-200 | Критическая9,8 | — | 18,9 % | 7 нояб. 2023 г. |
21Наблюдать | CVE-2023-38548Эксплойта нет | A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of veeam · one · CWE-522 | Средняя4,3 | — | 11,8 % | 7 нояб. 2023 г. |
27Наблюдать | CVE-2023-38549Эксплойта нет | A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of veeam · one · CWE-79 | Средняя5,4 | — | 19,1 % | 7 нояб. 2023 г. |
21Наблюдать | CVE-2023-41723Эксплойта нет | A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule.veeam · one · CWE-922 | Средняя4,3 | — | 12,3 % | 7 нояб. 2023 г. |
39Наблюдать | CVE-2023-42283Proof of concept | Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL querytyk · tyk · CWE-89 | Критическая9,8 | — | 1,2 % | 7 нояб. 2023 г. |
39Наблюдать | CVE-2023-42284Proof of concept | Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL tyk · tyk · CWE-89 | Критическая9,8 | — | 1,2 % | 7 нояб. 2023 г. |
21Наблюдать | CVE-2023-4842Proof of concept | Social Sharing Plugin - Social Warfare <= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewarfareplugins · social warfare · CWE-79 | Средняя5,4 | — | 0,5 % | 7 нояб. 2023 г. |
60На этой неделе | CVE-2023-41425Готовый эксплойт | Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted scripwondercms · wondercms · CWE-79 | Средняя6,1 | — | 54,3 % | 7 нояб. 2023 г. |
36Наблюдать | CVE-2023-46501Proof of concept | An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin passboltwire · boltwire · CWE-284 | Критическая9,1 | — | 1,2 % | 7 нояб. 2023 г. |
26Наблюдать | CVE-2023-45857Proof of concept | An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-axios · axios · CWE-352 | Средняя6,5 | — | 0,5 % | 8 нояб. 2023 г. |
54В плане | CVE-2023-3959Эксплойта нет | Zavio IP Camera Stack-Based Buffer Overflowzavio · cf7500 firmware · CWE-121 | Критическая9,8 | — | 48,7 % | 8 нояб. 2023 г. |
43В плане | CVE-2023-4249Эксплойта нет | Zavio IP Camera Stack-Based Buffer Overflowzavio · cf7500 firmware · CWE-121 | Критическая9,8 | — | 12,9 % | 8 нояб. 2023 г. |
36Наблюдать | CVE-2021-43609Proof of concept | An issue was discovered in Spiceworks Help Desk Server before 1.3.3.spiceworks · help desk server · CWE-89 | Высокая8,8 | — | 2,0 % | 8 нояб. 2023 г. |
21Наблюдать | CVE-2023-37790Proof of concept | Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Profile Picture Upload fubroadcom · clarity · CWE-79 | Средняя5,4 | — | 0,4 % | 8 нояб. 2023 г. |
43В плане | CVE-2023-47248Proof of concept | PyArrow, PyArrow: Arbitrary code execution when loading a malicious data fileapache · pyarrow · CWE-502 | Критическая9,8 | — | 14,5 % | 9 нояб. 2023 г. |
21Наблюдать | CVE-2023-5546Proof of concept | Moodle: stored xss in quiz grading report via user id numbermoodle · moodle · CWE-79 | Средняя5,4 | — | 1,2 % | 9 нояб. 2023 г. |
41В плане | CVE-2023-39796Proof of concept | SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via wbce · wbce cms · CWE-89 | Критическая9,8 | — | 6,1 % | 10 нояб. 2023 г. |
99Срочно | CVE-2023-47246Готовый эксплойт | In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat wesysaid · sysaid · CWE-22 | Критическая9,8 | KEV | 98,8 % | 10 нояб. 2023 г. |
21Наблюдать | CVE-2023-45806Proof of concept | Discourse vulnerable to DoS via Regexp Injection in Full Namediscourse · discourse · CWE-1333 | Средняя5,4 | — | 0,9 % | 10 нояб. 2023 г. |
24Наблюдать | CVE-2023-47119Proof of concept | HTML injection in oneboxed linksdiscourse · discourse · CWE-74 | Средняя6,1 | — | 0,9 % | 10 нояб. 2023 г. |
31Наблюдать | CVE-2023-47108Proof of concept | DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metricsopentelemetry · opentelemetry · CWE-770 | Высокая7,5 | — | 2,0 % | 10 нояб. 2023 г. |
39Наблюдать | CVE-2023-47129Proof of concept | Statamic CMS remote code execution via front-end form uploadsstatamic · statamic · CWE-434 | Критическая9,8 | — | 1,1 % | 10 нояб. 2023 г. |
41В плане | CVE-2022-45835Proof of concept | WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF)phonepe · phonepe · CWE-918 | Высокая7,5 | — | 37,6 % | 12 нояб. 2023 г. |
31Наблюдать | CVE-2023-47117Proof of concept | Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studiohumansignal · label studio · CWE-200 | Высокая7,5 | — | 4,0 % | 13 нояб. 2023 г. |
22Наблюдать | CVE-2023-46014Proof of concept | SQL Injection vulnerability in hospitalLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'hemail'code-projects · blood bank · CWE-89 | Средняя5,5 | — | 0,3 % | 13 нояб. 2023 г. |
24Наблюдать | CVE-2023-46015Proof of concept | Cross Site Scripting (XSS) vulnerability in index.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via 'msg' paramcode-projects · blood bank · CWE-79 | Средняя6,1 | — | 0,4 % | 13 нояб. 2023 г. |
24Наблюдать | CVE-2023-46016Proof of concept | Cross Site Scripting (XSS) in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'search' parameter in tcode-projects · blood bank · CWE-79 | Средняя6,1 | — | 0,4 % | 13 нояб. 2023 г. |
22Наблюдать | CVE-2023-46017Proof of concept | SQL Injection vulnerability in receiverLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'remail'code-projects · blood bank · CWE-89 | Средняя5,5 | — | 0,3 % | 13 нояб. 2023 г. |
22Наблюдать | CVE-2023-46018Proof of concept | SQL injection vulnerability in receiverReg.php in Code-Projects Blood Bank 1.0 \allows attackers to run arbitrary SQL commands via 'remail' code-projects · blood bank · CWE-89 | Средняя5,5 | — | 0,3 % | 13 нояб. 2023 г. |
24Наблюдать | CVE-2023-46019Proof of concept | Cross Site Scripting (XSS) vulnerability in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'error' pcode-projects · blood bank · CWE-79 | Средняя6,1 | — | 0,4 % | 13 нояб. 2023 г. |
24Наблюдать | CVE-2023-46020Proof of concept | Cross Site Scripting (XSS) in updateprofile.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'rename', 'recode-projects · blood bank · CWE-79 | Средняя6,1 | — | 0,4 % | 13 нояб. 2023 г. |
22Наблюдать | CVE-2023-46021Proof of concept | SQL Injection vulnerability in cancel.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary commands via the 'reqid' parametcode-projects · blood bank · CWE-89 | Средняя5,5 | — | 0,3 % | 13 нояб. 2023 г. |
24Наблюдать | CVE-2023-47684Proof of concept | WordPress Essential Grid Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)themepunch · essential grid · CWE-79 | Средняя6,1 | — | 0,8 % | 13 нояб. 2023 г. |
38Наблюдать | CVE-2023-42325Эксплойта нет | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the stanetgate · pfsense · CWE-79 | Средняя5,4 | — | 57,9 % | 14 нояб. 2023 г. |
38Наблюдать | CVE-2023-42327Эксплойта нет | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getnetgate · pfsense · CWE-79 | Средняя5,4 | — | 55,3 % | 14 нояб. 2023 г. |
54В плане | CVE-2023-42326Proof of concept | An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php netgate · pfsense · CWE-77 | Высокая8,8 | — | 64,0 % | 14 нояб. 2023 г. |
58В плане | CVE-2023-45878Proof of concept | GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authenticatigibbonedu · gibbon · CWE-787 | Критическая9,8 | — | 63,1 % | 14 нояб. 2023 г. |
48В плане | CVE-2023-34991Эксплойта нет | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and fortinet · fortiwlm · CWE-89 | Критическая9,8 | — | 28,7 % | 14 нояб. 2023 г. |
43В плане | CVE-2023-36017Эксплойта нет | Windows Scripting Engine Memory Corruption Vulnerabilitymicrosoft · windows 10 1507 · CWE-843 | Высокая8,8 | — | 25,2 % | 14 нояб. 2023 г. |
91Срочно | CVE-2023-36025Готовый эксплойт | Windows SmartScreen Security Feature Bypass Vulnerabilitymicrosoft · windows 10 1507 | Высокая8,8 | KEV | 88,0 % | 14 нояб. 2023 г. |
64На этой неделе | CVE-2023-36033Готовый эксплойт | Windows DWM Core Library Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1809 · CWE-822 | Высокая7,8 | KEV | 10,9 % | 14 нояб. 2023 г. |
58В плане | CVE-2023-36035Эксплойта нет | Microsoft Exchange Server Spoofing Vulnerabilitymicrosoft · exchange server · CWE-502 | Высокая8,0 | — | 86,5 % | 14 нояб. 2023 г. |
66На этой неделе | CVE-2023-36036Готовый эксплойт | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-122 | Высокая7,8 | KEV | 16,6 % | 14 нояб. 2023 г. |
54В плане | CVE-2023-36039Эксплойта нет | Microsoft Exchange Server Spoofing Vulnerabilitymicrosoft · exchange server · CWE-502 | Высокая8,0 | — | 72,9 % | 14 нояб. 2023 г. |
48В плане | CVE-2023-36041Эксплойта нет | Microsoft Excel Remote Code Execution Vulnerabilitymicrosoft · 365 apps · CWE-416 | Высокая7,8 | — | 56,7 % | 14 нояб. 2023 г. |
44В плане | CVE-2023-36050Эксплойта нет | Microsoft Exchange Server Spoofing Vulnerabilitymicrosoft · exchange server · CWE-502 | Высокая8,0 | — | 39,2 % | 14 нояб. 2023 г. |
40В плане | CVE-2023-36052Эксплойта нет | Azure CLI REST Command Information Disclosure Vulnerabilitymicrosoft · azure command-line interface · CWE-359 | Высокая8,6 | — | 21,0 % | 14 нояб. 2023 г. |
44В плане | CVE-2023-36397Эксплойта нет | Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-126 | Критическая9,8 | — | 17,5 % | 14 нояб. 2023 г. |
32Наблюдать | CVE-2023-36407Proof of concept | Windows Hyper-V Elevation of Privilege Vulnerabilitymicrosoft · windows 11 21h2 · CWE-20 | Высокая7,8 | — | 1,7 % | 14 нояб. 2023 г. |
35Наблюдать | CVE-2023-36413Эксплойта нет | Microsoft Office Security Feature Bypass Vulnerabilitymicrosoft · 365 apps | Средняя6,5 | — | 29,9 % | 14 нояб. 2023 г. |
65На этой неделе | CVE-2023-36424Готовый эксплойт | Windows Common Log File System Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-125 | Высокая7,8 | KEV | 12,0 % | 14 нояб. 2023 г. |
28Наблюдать | CVE-2023-36427Proof of concept | Windows Hyper-V Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1809 | Высокая7,0 | — | 1,4 % | 14 нояб. 2023 г. |
32Наблюдать | CVE-2023-23583Proof of concept | Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially intel · core i3-10100y firmware · CWE-1281 | Высокая7,8 | — | 1,7 % | 14 нояб. 2023 г. |
30Наблюдать | CVE-2023-31320Proof of concept | Improper input validation in the AMD RadeonTM Graphics display driver may allow an attacker to corrupt the display potentially resulting in amd · radeon software · CWE-20 | Высокая7,5 | — | 1,2 % | 14 нояб. 2023 г. |
24Наблюдать | CVE-2023-47125Proof of concept | By-passing Cross-Site Scripting Protection in HTML Sanitizertypo3 · html sanitizer · CWE-79 | Средняя6,1 | — | 0,5 % | 14 нояб. 2023 г. |
43В плане | CVE-2023-36049Эксплойта нет | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerabilitymicrosoft · .net framework · CWE-20 | Критическая9,8 | — | 12,5 % | 14 нояб. 2023 г. |
31Наблюдать | CVE-2023-46022Proof of concept | SQL Injection vulnerability in delete.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via the 'bid' paramcode-projects · blood bank · CWE-89 | Высокая7,8 | — | 0,7 % | 14 нояб. 2023 г. |
30Наблюдать | CVE-2023-46024Proof of concept | SQL Injection vulnerability in index.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to run arbitrary SQphpgurukul · teacher subject allocation management system · CWE-89 | Высокая7,5 | — | 1,0 % | 14 нояб. 2023 г. |
31Наблюдать | CVE-2023-35080Proof of concept | A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploiivanti · secure access client · CWE-276 | Высокая7,8 | — | 0,7 % | 14 нояб. 2023 г. |
24Наблюдать | CVE-2023-41597Proof of concept | EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t.eyoucms · eyoucms · CWE-79 | Средняя6,1 | — | 1,2 % | 15 нояб. 2023 г. |
42В плане | CVE-2023-6112Эксплойта нет | Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via agoogle · chrome · CWE-416 | Высокая8,8 | — | 24,7 % | 15 нояб. 2023 г. |
83Срочно | CVE-2023-48365Готовый эксплойт | Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683.qlik · qlik sense · CWE-444 | Критическая9,9 | KEV | 47,4 % | 15 нояб. 2023 г. |
26Наблюдать | CVE-2023-43757Proof of concept | Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD.elecom · wrc-2533ghbk2-t firmware · CWE-326 | Средняя6,5 | — | 0,4 % | 16 нояб. 2023 г. |
48В плане | CVE-2023-6016Эксплойта нет | H2O Remote Code Execution via POJO Model Importh2o · h2o · CWE-94 | Критическая9,8 | — | 30,5 % | 16 нояб. 2023 г. |
53В плане | CVE-2023-6018Proof of concept | MLflow Arbitrary File Writelfprojects · mlflow · CWE-78 | Критическая9,8 | — | 47,8 % | 16 нояб. 2023 г. |
31Наблюдать | CVE-2023-6023Proof of concept | ModelDB Local File Includevertaai · modeldb · CWE-29 | Высокая7,5 | — | 2,9 % | 16 нояб. 2023 г. |
61На этой неделе | CVE-2023-6019Готовый эксплойт | Ray Command Injection in cpu_profile Parameterray project · ray · CWE-78 | Критическая9,8 | — | 74,6 % | 16 нояб. 2023 г. |
41В плане | CVE-2023-6021Proof of concept | Ray Log File Local File Includeray project · ray · CWE-29 | Высокая7,5 | — | 37,0 % | 16 нояб. 2023 г. |
31Наблюдать | CVE-2023-6038Proof of concept | Local File Inclusion in h2oai/h2o-3h2o · h2o · CWE-862 | Высокая7,5 | — | 4,3 % | 16 нояб. 2023 г. |
- CVE-2023-419746В плане
Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE
ВысокаяCVSS 8,8Proof of conceptEPSS 35 %dolibarr · dolibarr erp\/crm1 нояб. 2023 г.
- CVE-2023-171837Наблюдать
Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access
ВысокаяCVSS 7,5Proof of conceptEPSS 24 %bitrix24 · bitrix241 нояб. 2023 г.
- CVE-2023-171940В плане
Bitrix24 Insecure Global Variable Extraction
КритическаяCVSS 9,8Proof of conceptEPSS 4 %bitrix24 · bitrix241 нояб. 2023 г.
- CVE-2023-2004844В плане
A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attac
КритическаяCVSS 9,9Proof of conceptEPSS 15 %cisco · secure firewall management center1 нояб. 2023 г.
- CVE-2023-517838Наблюдать
Kernel: use after free in nvmet_tcp_free_crypto in nvme
ВысокаяCVSS 8,8Proof of conceptEPSS 9 %linux · linux kernel1 нояб. 2023 г.
- CVE-2023-4669545В плане
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7.
ВысокаяCVSS 7,5Эксплойта нетEPSS 49 %djangoproject · django2 нояб. 2023 г.
- CVE-2023-4695439Наблюдать
SQL Injection vulnerability in Relativity ODA LLC RelativityOne v.12.1.537.3 Patch 2 and earlier allows a remote attacker to execute arbitra
КритическаяCVSS 9,8Proof of conceptEPSS 1 %relativity · relativityone2 нояб. 2023 г.
- CVE-2023-3110248В плане
Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.
ВысокаяCVSS 7,8Эксплойта нетEPSS 55 %7-zip · 7-zip3 нояб. 2023 г.
- CVE-2023-3425937Наблюдать
Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read arbitrary files on the
СредняяCVSS 4,9Proof of conceptEPSS 60 %kyocera · d-copia253mf plus firmware3 нояб. 2023 г.
- CVE-2023-3426052В плане
Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow a denial of service (service outage) via /wlmdeu%2f%2e%2e%2f%2e%2e followed
ВысокаяCVSS 7,5Эксплойта нетEPSS 73 %kyocera · d-copia253mf plus firmware3 нояб. 2023 г.
- CVE-2023-4684757В плане
Squid: denial of service in http digest authentication
ВысокаяCVSS 7,5Эксплойта нетEPSS 88 %squid-cache · squid3 нояб. 2023 г.
- CVE-2023-4684833Наблюдать
Squid: denial of service in ftp
ВысокаяCVSS 7,5Эксплойта нетEPSS 10 %squid-cache · squid3 нояб. 2023 г.
- CVE-2023-327740В плане
MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation
КритическаяCVSS 9,8Proof of conceptEPSS 2 %inspireui · mstore api3 нояб. 2023 г.
- CVE-2023-4165239Наблюдать
WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to SQL Injection
КритическаяCVSS 9,8Proof of conceptEPSS 1 %carrcommunications · rsvpmaker3 нояб. 2023 г.
- CVE-2022-4580540В плане
WordPress Paytm Payment Gateway Plugin <= 2.7.3 is vulnerable to SQL Injection
КритическаяCVSS 9,8Proof of conceptEPSS 2 %paytm · payment gateway3 нояб. 2023 г.
- CVE-2023-4640440В плане
PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing.
КритическаяCVSS 9,9Proof of conceptEPSS 1 %utoronto · pcrs3 нояб. 2023 г.
- CVE-2023-4698039Наблюдать
An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted sc
КритическаяCVSS 9,8Proof of conceptEPSS 1 %mayurik · best courier management system3 нояб. 2023 г.
- CVE-2023-2336845В плане
QTS, QuTS hero, QuTScloud
КритическаяCVSS 9,8Эксплойта нетEPSS 18 %qnap · qts3 нояб. 2023 г.
- CVE-2023-2336943В плане
QTS, Multimedia Console, and Media Streaming add-on
КритическаяCVSS 9,8Эксплойта нетEPSS 14 %qnap · qts3 нояб. 2023 г.
- CVE-2022-317233Наблюдать
Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)
ВысокаяCVSS 8,2Proof of conceptEPSS 2 %kubernetes · apiserver3 нояб. 2023 г.
- CVE-2022-4456931Наблюдать
A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %ivanti · automation3 нояб. 2023 г.
- CVE-2023-4725343В плане
Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.ph
КритическаяCVSS 9,8Proof of conceptEPSS 14 %qualitor · qualitor6 нояб. 2023 г.
- CVE-2023-469936Наблюдать
Arbitrary Command Execution Vulnerability in Mitsubishi Electric proprietary protocol communication of multiple FA products
КритическаяCVSS 9,1Proof of conceptEPSS 0 %mitsubishielectric · fx3u-32mt\/es firmware6 нояб. 2023 г.
- CVE-2023-4565739Наблюдать
WordPress Nexter Theme <= 2.0.3 is vulnerable to SQL Injection
КритическаяCVSS 9,8Proof of conceptEPSS 1 %posimyth · nexter6 нояб. 2023 г.
- CVE-2023-596819Наблюдать
Password hash in response body after username update
СредняяCVSS 4,9Proof of conceptEPSS 0 %mattermost · mattermost6 нояб. 2023 г.
- CVE-2023-4582739Наблюдать
Prototype Pollution vulnerability in @clickbar/dot-diver
КритическаяCVSS 9,8Proof of conceptEPSS 1 %clickbar · dot-diver6 нояб. 2023 г.
- CVE-2023-4673166На этой неделе
Remote code execution through the section parameter in Administration as guest in XWiki Platform
КритическаяCVSS 9,8Эксплойта нетEPSS 88 %xwiki · xwiki6 нояб. 2023 г.
- CVE-2023-4673225Наблюдать
Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform
СредняяCVSS 6,1Proof of conceptEPSS 2 %xwiki · xwiki6 нояб. 2023 г.
- CVE-2023-577739Наблюдать
Weintek EasyBuilder Pro Use of Hard-coded Credentials
КритическаяCVSS 9,8Эксплойта нетEPSS 0 %weintek · easybuilder pro6 нояб. 2023 г.
- CVE-2023-4699824Наблюдать
Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted
СредняяCVSS 6,1Proof of conceptEPSS 1 %bootboxjs · bootbox7 нояб. 2023 г.
- CVE-2023-4710221Наблюдать
UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid.
СредняяCVSS 5,3Proof of conceptEPSS 0 %urbackup · urbackup server7 нояб. 2023 г.
- CVE-2023-3854745В плане
A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its
КритическаяCVSS 9,8Эксплойта нетEPSS 18 %veeam · one7 нояб. 2023 г.
- CVE-2023-3854821Наблюдать
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of
СредняяCVSS 4,3Эксплойта нетEPSS 11 %veeam · one7 нояб. 2023 г.
- CVE-2023-3854927Наблюдать
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of
СредняяCVSS 5,4Эксплойта нетEPSS 19 %veeam · one7 нояб. 2023 г.
- CVE-2023-4172321Наблюдать
A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule.
СредняяCVSS 4,3Эксплойта нетEPSS 12 %veeam · one7 нояб. 2023 г.
- CVE-2023-4228339Наблюдать
Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query
КритическаяCVSS 9,8Proof of conceptEPSS 1 %tyk · tyk7 нояб. 2023 г.
- CVE-2023-4228439Наблюдать
Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL
КритическаяCVSS 9,8Proof of conceptEPSS 1 %tyk · tyk7 нояб. 2023 г.
- CVE-2023-484221Наблюдать
Social Sharing Plugin - Social Warfare <= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
СредняяCVSS 5,4Proof of conceptEPSS 0 %warfareplugins · social warfare7 нояб. 2023 г.
- CVE-2023-4142560На этой неделе
Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted scrip
СредняяCVSS 6,1Готовый эксплойтEPSS 54 %wondercms · wondercms7 нояб. 2023 г.
- CVE-2023-4650136Наблюдать
An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin pass
КритическаяCVSS 9,1Proof of conceptEPSS 1 %boltwire · boltwire7 нояб. 2023 г.
- CVE-2023-4585726Наблюдать
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-
СредняяCVSS 6,5Proof of conceptEPSS 0 %axios · axios8 нояб. 2023 г.
- CVE-2023-395954В плане
Zavio IP Camera Stack-Based Buffer Overflow
КритическаяCVSS 9,8Эксплойта нетEPSS 48 %zavio · cf7500 firmware8 нояб. 2023 г.
- CVE-2023-424943В плане
Zavio IP Camera Stack-Based Buffer Overflow
КритическаяCVSS 9,8Эксплойта нетEPSS 12 %zavio · cf7500 firmware8 нояб. 2023 г.
- CVE-2021-4360936Наблюдать
An issue was discovered in Spiceworks Help Desk Server before 1.3.3.
ВысокаяCVSS 8,8Proof of conceptEPSS 2 %spiceworks · help desk server8 нояб. 2023 г.
- CVE-2023-3779021Наблюдать
Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Profile Picture Upload fu
СредняяCVSS 5,4Proof of conceptEPSS 0 %broadcom · clarity8 нояб. 2023 г.
- CVE-2023-4724843В плане
PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file
КритическаяCVSS 9,8Proof of conceptEPSS 14 %apache · pyarrow9 нояб. 2023 г.
- CVE-2023-554621Наблюдать
Moodle: stored xss in quiz grading report via user id number
СредняяCVSS 5,4Proof of conceptEPSS 1 %moodle · moodle9 нояб. 2023 г.
- CVE-2023-3979641В плане
SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via
КритическаяCVSS 9,8Proof of conceptEPSS 6 %wbce · wbce cms10 нояб. 2023 г.
- CVE-2023-4724699Срочно
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat we
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 98 %sysaid · sysaid10 нояб. 2023 г.
- CVE-2023-4580621Наблюдать
Discourse vulnerable to DoS via Regexp Injection in Full Name
СредняяCVSS 5,4Proof of conceptEPSS 0 %discourse · discourse10 нояб. 2023 г.
- CVE-2023-4711924Наблюдать
HTML injection in oneboxed links
СредняяCVSS 6,1Proof of conceptEPSS 0 %discourse · discourse10 нояб. 2023 г.
- CVE-2023-4710831Наблюдать
DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %opentelemetry · opentelemetry10 нояб. 2023 г.
- CVE-2023-4712939Наблюдать
Statamic CMS remote code execution via front-end form uploads
КритическаяCVSS 9,8Proof of conceptEPSS 1 %statamic · statamic10 нояб. 2023 г.
- CVE-2022-4583541В плане
WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF)
ВысокаяCVSS 7,5Proof of conceptEPSS 37 %phonepe · phonepe12 нояб. 2023 г.
- CVE-2023-4711731Наблюдать
Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio
ВысокаяCVSS 7,5Proof of conceptEPSS 4 %humansignal · label studio13 нояб. 2023 г.
- CVE-2023-4601422Наблюдать
SQL Injection vulnerability in hospitalLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'hemail'
СредняяCVSS 5,5Proof of conceptEPSS 0 %code-projects · blood bank13 нояб. 2023 г.
- CVE-2023-4601524Наблюдать
Cross Site Scripting (XSS) vulnerability in index.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via 'msg' param
СредняяCVSS 6,1Proof of conceptEPSS 0 %code-projects · blood bank13 нояб. 2023 г.
- CVE-2023-4601624Наблюдать
Cross Site Scripting (XSS) in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'search' parameter in t
СредняяCVSS 6,1Proof of conceptEPSS 0 %code-projects · blood bank13 нояб. 2023 г.
- CVE-2023-4601722Наблюдать
SQL Injection vulnerability in receiverLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'remail'
СредняяCVSS 5,5Proof of conceptEPSS 0 %code-projects · blood bank13 нояб. 2023 г.
- CVE-2023-4601822Наблюдать
SQL injection vulnerability in receiverReg.php in Code-Projects Blood Bank 1.0 \allows attackers to run arbitrary SQL commands via 'remail'
СредняяCVSS 5,5Proof of conceptEPSS 0 %code-projects · blood bank13 нояб. 2023 г.
- CVE-2023-4601924Наблюдать
Cross Site Scripting (XSS) vulnerability in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'error' p
СредняяCVSS 6,1Proof of conceptEPSS 0 %code-projects · blood bank13 нояб. 2023 г.
- CVE-2023-4602024Наблюдать
Cross Site Scripting (XSS) in updateprofile.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'rename', 're
СредняяCVSS 6,1Proof of conceptEPSS 0 %code-projects · blood bank13 нояб. 2023 г.
- CVE-2023-4602122Наблюдать
SQL Injection vulnerability in cancel.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary commands via the 'reqid' paramet
СредняяCVSS 5,5Proof of conceptEPSS 0 %code-projects · blood bank13 нояб. 2023 г.
- CVE-2023-4768424Наблюдать
WordPress Essential Grid Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)
СредняяCVSS 6,1Proof of conceptEPSS 0 %themepunch · essential grid13 нояб. 2023 г.
- CVE-2023-4232538Наблюдать
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the sta
СредняяCVSS 5,4Эксплойта нетEPSS 57 %netgate · pfsense14 нояб. 2023 г.
- CVE-2023-4232738Наблюдать
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the get
СредняяCVSS 5,4Эксплойта нетEPSS 55 %netgate · pfsense14 нояб. 2023 г.
- CVE-2023-4232654В плане
An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php
ВысокаяCVSS 8,8Proof of conceptEPSS 64 %netgate · pfsense14 нояб. 2023 г.
- CVE-2023-4587858В плане
GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authenticati
КритическаяCVSS 9,8Proof of conceptEPSS 63 %gibbonedu · gibbon14 нояб. 2023 г.
- CVE-2023-3499148В плане
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and
КритическаяCVSS 9,8Эксплойта нетEPSS 28 %fortinet · fortiwlm14 нояб. 2023 г.
- CVE-2023-3601743В плане
Windows Scripting Engine Memory Corruption Vulnerability
ВысокаяCVSS 8,8Эксплойта нетEPSS 25 %microsoft · windows 10 150714 нояб. 2023 г.
- CVE-2023-3602591Срочно
Windows SmartScreen Security Feature Bypass Vulnerability
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 88 %microsoft · windows 10 150714 нояб. 2023 г.
- CVE-2023-3603364На этой неделе
Windows DWM Core Library Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 10 %microsoft · windows 10 180914 нояб. 2023 г.
- CVE-2023-3603558В плане
Microsoft Exchange Server Spoofing Vulnerability
ВысокаяCVSS 8,0Эксплойта нетEPSS 86 %microsoft · exchange server14 нояб. 2023 г.
- CVE-2023-3603666На этой неделе
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 16 %microsoft · windows 10 150714 нояб. 2023 г.
- CVE-2023-3603954В плане
Microsoft Exchange Server Spoofing Vulnerability
ВысокаяCVSS 8,0Эксплойта нетEPSS 72 %microsoft · exchange server14 нояб. 2023 г.
- CVE-2023-3604148В плане
Microsoft Excel Remote Code Execution Vulnerability
ВысокаяCVSS 7,8Эксплойта нетEPSS 56 %microsoft · 365 apps14 нояб. 2023 г.
- CVE-2023-3605044В плане
Microsoft Exchange Server Spoofing Vulnerability
ВысокаяCVSS 8,0Эксплойта нетEPSS 39 %microsoft · exchange server14 нояб. 2023 г.
- CVE-2023-3605240В плане
Azure CLI REST Command Information Disclosure Vulnerability
ВысокаяCVSS 8,6Эксплойта нетEPSS 21 %microsoft · azure command-line interface14 нояб. 2023 г.
- CVE-2023-3639744В плане
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
КритическаяCVSS 9,8Эксплойта нетEPSS 17 %microsoft · windows 10 150714 нояб. 2023 г.
- CVE-2023-3640732Наблюдать
Windows Hyper-V Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 1 %microsoft · windows 11 21h214 нояб. 2023 г.
- CVE-2023-3641335Наблюдать
Microsoft Office Security Feature Bypass Vulnerability
СредняяCVSS 6,5Эксплойта нетEPSS 29 %microsoft · 365 apps14 нояб. 2023 г.
- CVE-2023-3642465На этой неделе
Windows Common Log File System Driver Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 12 %microsoft · windows 10 150714 нояб. 2023 г.
- CVE-2023-3642728Наблюдать
Windows Hyper-V Elevation of Privilege Vulnerability
ВысокаяCVSS 7,0Proof of conceptEPSS 1 %microsoft · windows 10 180914 нояб. 2023 г.
- CVE-2023-2358332Наблюдать
Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially
ВысокаяCVSS 7,8Proof of conceptEPSS 1 %intel · core i3-10100y firmware14 нояб. 2023 г.
- CVE-2023-3132030Наблюдать
Improper input validation in the AMD RadeonTM Graphics display driver may allow an attacker to corrupt the display potentially resulting in
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %amd · radeon software14 нояб. 2023 г.
- CVE-2023-4712524Наблюдать
By-passing Cross-Site Scripting Protection in HTML Sanitizer
СредняяCVSS 6,1Proof of conceptEPSS 0 %typo3 · html sanitizer14 нояб. 2023 г.
- CVE-2023-3604943В плане
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
КритическаяCVSS 9,8Эксплойта нетEPSS 12 %microsoft · .net framework14 нояб. 2023 г.
- CVE-2023-4602231Наблюдать
SQL Injection vulnerability in delete.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via the 'bid' param
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %code-projects · blood bank14 нояб. 2023 г.
- CVE-2023-4602430Наблюдать
SQL Injection vulnerability in index.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to run arbitrary SQ
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %phpgurukul · teacher subject allocation management system14 нояб. 2023 г.
- CVE-2023-3508031Наблюдать
A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploi
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %ivanti · secure access client14 нояб. 2023 г.
- CVE-2023-4159724Наблюдать
EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t.
СредняяCVSS 6,1Proof of conceptEPSS 1 %eyoucms · eyoucms15 нояб. 2023 г.
- CVE-2023-611242В плане
Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a
ВысокаяCVSS 8,8Эксплойта нетEPSS 24 %google · chrome15 нояб. 2023 г.
- CVE-2023-4836583Срочно
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683.
КритическаяCVSS 9,9KEVГотовый эксплойтEPSS 47 %qlik · qlik sense15 нояб. 2023 г.
- CVE-2023-4375726Наблюдать
Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD.
СредняяCVSS 6,5Proof of conceptEPSS 0 %elecom · wrc-2533ghbk2-t firmware16 нояб. 2023 г.
- CVE-2023-601648В плане
H2O Remote Code Execution via POJO Model Import
КритическаяCVSS 9,8Эксплойта нетEPSS 30 %h2o · h2o16 нояб. 2023 г.
- CVE-2023-601853В плане
MLflow Arbitrary File Write
КритическаяCVSS 9,8Proof of conceptEPSS 47 %lfprojects · mlflow16 нояб. 2023 г.
- CVE-2023-602331Наблюдать
ModelDB Local File Include
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %vertaai · modeldb16 нояб. 2023 г.
- CVE-2023-601961На этой неделе
Ray Command Injection in cpu_profile Parameter
КритическаяCVSS 9,8Готовый эксплойтEPSS 74 %ray project · ray16 нояб. 2023 г.
- CVE-2023-602141В плане
Ray Log File Local File Include
ВысокаяCVSS 7,5Proof of conceptEPSS 37 %ray project · ray16 нояб. 2023 г.
- CVE-2023-603831Наблюдать
Local File Inclusion in h2oai/h2o-3
ВысокаяCVSS 7,5Proof of conceptEPSS 4 %h2o · h2o16 нояб. 2023 г.