По дате публикации
Эксплуатируемые и новые серьёзные CVE: декабрь 2023 г.
162 записей · 9 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
40В плане | CVE-2023-48842Proof of concept | D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi.dlink · go-rt-ac750 firmware · CWE-77 | Критическая9,8 | — | 3,7 % | 1 дек. 2023 г. |
21Наблюдать | CVE-2023-4460Proof of concept | Uploading SVG, WEBP and ICO files <= 1.2.1 - Author+ Stored XSS via SVGuploading svg\, webp and ico files project · uploading svg\, webp and ico files · CWE-79 | Средняя5,4 | — | 1,0 % | 4 дек. 2023 г. |
60На этой неделе | CVE-2023-6063Готовый эксплойт | WP Fastest Cache < 1.2.2 - Unauthenticated SQL Injectionwpfastestcache · wp fastest cache · CWE-89 | Высокая7,5 | — | 73,7 % | 4 дек. 2023 г. |
31Наблюдать | CVE-2023-40084Proof of concept | In run of MDnsSdListener.cpp, there is a possible memory corruption due to a use after free.google · android · CWE-416 | Высокая7,8 | — | 0,2 % | 4 дек. 2023 г. |
31Наблюдать | CVE-2023-40459Proof of concept | Improper input leads to DoSsierrawireless · aleos · CWE-476 | Высокая7,5 | — | 2,2 % | 4 дек. 2023 г. |
31Наблюдать | CVE-2023-45777Proof of concept | In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activities using system privilgoogle · android | Высокая7,8 | — | 0,3 % | 4 дек. 2023 г. |
31Наблюдать | CVE-2023-45779Proof of concept | In the APEX module framework of AOSP, there is a possible malicious update to platform components due to improperly used crypto.google · android | Высокая7,8 | — | 0,3 % | 4 дек. 2023 г. |
56В плане | CVE-2023-49285Эксплойта нет | Denial of Service in HTTP Message Processing in Squidsquid-cache · squid · CWE-126 | Высокая7,5 | — | 88,1 % | 4 дек. 2023 г. |
33Наблюдать | CVE-2023-49286Эксплойта нет | Denial of Service in Helper Process managementsquid-cache · squid · CWE-253 | Высокая7,5 | — | 10,3 % | 4 дек. 2023 г. |
24Наблюдать | CVE-2023-49293Proof of concept | Cross-site Scripting in `server.transformIndexHtml` via URL payload in vitevitejs · vite · CWE-79 | Средняя6,1 | — | 0,9 % | 4 дек. 2023 г. |
26Наблюдать | CVE-2023-5808Proof of concept | System Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products are susceptible to unintended information disclosure vihitachi · vantara hitachi network attached storage · CWE-285 | Средняя6,5 | — | 0,5 % | 4 дек. 2023 г. |
30Наблюдать | CVE-2023-28588Proof of concept | Integer Overflow or Wraparound in Bluetooth Hostqualcomm · apq8017 firmware · CWE-190 | Высокая7,5 | — | 0,5 % | 4 дек. 2023 г. |
61На этой неделе | CVE-2023-33063Готовый эксплойт | Use After Free in DSP Servicesqualcomm · 315 5g iot modem firmware · CWE-416 | Высокая7,8 | KEV | 0,6 % | 4 дек. 2023 г. |
61На этой неделе | CVE-2023-33106Готовый эксплойт | Use of Out-of-range Pointer Offset in Graphicsqualcomm · ar8035 firmware · CWE-823 | Высокая7,8 | KEV | 0,7 % | 4 дек. 2023 г. |
61На этой неделе | CVE-2023-33107Готовый эксплойт | Integer Overflow or Wraparound in Graphics Linuxqualcomm · 315 5g iot modem firmware · CWE-190 | Высокая7,8 | KEV | 0,7 % | 4 дек. 2023 г. |
41В плане | CVE-2023-43472Proof of concept | An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API.lfprojects · mlflow | Высокая7,5 | — | 36,5 % | 5 дек. 2023 г. |
68На этой неделе | CVE-2023-49070Готовый эксплойт | Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still presentapache · ofbiz · CWE-94 | Критическая9,8 | — | 95,3 % | 5 дек. 2023 г. |
70На этой неделе | CVE-2023-6448Готовый эксплойт | Unitronics VisiLogic uses a default administrative passwordunitronics · vision1210 firmware · CWE-1188 | Критическая9,8 | KEV | 2,0 % | 5 дек. 2023 г. |
81Срочно | CVE-2023-44221Готовый эксплойт | Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrsonicwall · sma 200 firmware · CWE-78 | Высокая7,2 | KEV | 76,2 % | 5 дек. 2023 г. |
39Наблюдать | CVE-2023-22522Эксплойта нет | This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input intatlassian · confluence data center · CWE-74 | Высокая8,8 | — | 12,9 % | 6 дек. 2023 г. |
38Наблюдать | CVE-2023-22523Эксплойта нет | This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discoveryatlassian · assets discovery cloud | Высокая8,8 | — | 11,2 % | 6 дек. 2023 г. |
46В плане | CVE-2023-22524Proof of concept | Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability.atlassian · companion | Критическая9,8 | — | 24,7 % | 6 дек. 2023 г. |
80Срочно | CVE-2023-49897Готовый эксплойт | An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier.fxc · ae1021 firmware · CWE-78 | Высокая8,8 | KEV | 50,4 % | 6 дек. 2023 г. |
39Наблюдать | CVE-2023-48849Proof of concept | Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to incoruijie · rg-eg1000c firmware | Критическая9,8 | — | 1,2 % | 6 дек. 2023 г. |
31Наблюдать | CVE-2023-39539Proof of concept | Failure when uploading a Logo image fileami · aptio v · CWE-20 | Высокая7,8 | — | 0,6 % | 6 дек. 2023 г. |
55В плане | CVE-2023-48123Proof of concept | An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a craftenetgate · pfsense | Высокая8,8 | — | 67,8 % | 6 дек. 2023 г. |
24Наблюдать | CVE-2023-6568Proof of concept | Reflected XSS via Content-Type Header in mlflow/mlflowlfprojects · mlflow · CWE-79 | Средняя6,1 | — | 1,6 % | 7 дек. 2023 г. |
24Наблюдать | CVE-2023-43102Эксплойта нет | An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4.zimbra · collaboration · CWE-79 | Средняя6,1 | — | 0,4 % | 7 дек. 2023 г. |
63На этой неделе | CVE-2023-50164Proof of concept | Apache Struts: File upload component had a directory traversal vulnerabilityapache · struts · CWE-552 | Критическая9,8 | — | 80,8 % | 7 дек. 2023 г. |
39Наблюдать | CVE-2022-45362Proof of concept | WordPress Paytm Payment Gateway Plugin <= 2.7.0 is vulnerable to Server Side Request Forgery (SSRF)paytm · payment gateway · CWE-918 | Средняя6,5 | — | 41,7 % | 7 дек. 2023 г. |
21Наблюдать | CVE-2023-46974Proof of concept | Cross Site Scripting vulnerability in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code via a craftemayurik · courier management system · CWE-79 | Средняя5,4 | — | 0,6 % | 7 дек. 2023 г. |
46В плане | CVE-2023-6579Эксплойта нет | osCommerce POST Parameter shopping-cart sql injectionoscommerce · oscommerce · CWE-89 | Критическая9,8 | — | 24,0 % | 7 дек. 2023 г. |
27Наблюдать | CVE-2023-45866Proof of concept | Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, andgoogle · android · CWE-287 | Средняя6,3 | — | 7,8 % | 8 дек. 2023 г. |
87Срочно | CVE-2023-47565Готовый эксплойт | An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x.qnap · qvr firmware · CWE-78 | Высокая8,8 | KEV | 73,2 % | 8 дек. 2023 г. |
48В плане | CVE-2023-6612Эксплойта нет | Totolink X5000R cstecgi.cgi setWizardCfg os command injectiontotolink · x5000r firmware · CWE-78 | Критическая9,8 | — | 30,6 % | 8 дек. 2023 г. |
35Наблюдать | CVE-2023-6654Proof of concept | PHPEMS Session Data session.cls.php deserializationphpems · phpems · CWE-502 | Высокая8,8 | — | 1,6 % | 10 дек. 2023 г. |
40В плане | CVE-2023-6655Proof of concept | Hongjing e-HR Login Interface loadhistroyorgtree sql injectionhrp2000 · e-hr · CWE-89 | Критическая9,8 | — | 3,7 % | 10 дек. 2023 г. |
21Наблюдать | CVE-2023-50465Proof of concept | A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated usemonicahq · monica · CWE-79 | Средняя5,4 | — | 0,5 % | 10 дек. 2023 г. |
45В плане | CVE-2023-49964Proof of concept | An issue was discovered in Hyland Alfresco Community Edition through 7.2.0.hyland · alfresco content services · CWE-74 | Высокая8,8 | — | 34,6 % | 11 дек. 2023 г. |
26Наблюдать | CVE-2023-6538Proof of concept | System Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products is susceptible to unintended information disclosure viahitachi · system management unit firmware · CWE-285 | Средняя6,5 | — | 1,5 % | 11 дек. 2023 г. |
24Наблюдать | CVE-2023-49494Proof of concept | DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEdidedecms · dedecms · CWE-79 | Средняя6,1 | — | 1,1 % | 11 дек. 2023 г. |
39Наблюдать | CVE-2023-50245Proof of concept | OpenEXR-viewer memory overflow vulnerabilityafichet · openexr viewer · CWE-120 | Критическая9,8 | — | 1,0 % | 11 дек. 2023 г. |
25Наблюдать | CVE-2023-5536Proof of concept | A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalatecanonical · ubuntu linux · CWE-276 | Средняя6,4 | — | 0,2 % | 11 дек. 2023 г. |
28Наблюдать | CVE-2023-41623Proof of concept | Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php.emlog · emlog · CWE-89 | Высокая7,2 | — | 0,8 % | 12 дек. 2023 г. |
46В плане | CVE-2023-46454Proof of concept | In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the pgl-inet · gl-ar300m firmware · CWE-78 | Критическая9,8 | — | 23,4 % | 12 дек. 2023 г. |
44В плане | CVE-2023-46455Proof of concept | In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attack in the OpenVPN cligl-inet · gl-ar300m firmware · CWE-22 | Высокая7,5 | — | 46,9 % | 12 дек. 2023 г. |
46В плане | CVE-2023-46456Эксплойта нет | In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload fugl-inet · gl-ar300m firmware · CWE-74 | Критическая9,8 | — | 24,7 % | 12 дек. 2023 г. |
30Наблюдать | CVE-2023-28465Proof of concept | The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to cerhapifhir · hl7 fhir core · CWE-22 | Высокая7,5 | — | 1,3 % | 12 дек. 2023 г. |
60На этой неделе | CVE-2023-35628Эксплойта нет | Windows MSHTML Platform Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-416 | Высокая8,1 | — | 92,8 % | 12 дек. 2023 г. |
30Наблюдать | CVE-2023-36003Proof of concept | XAML Diagnostics Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-426 | Высокая7,3 | — | 2,8 % | 12 дек. 2023 г. |
39Наблюдать | CVE-2023-36005Эксплойта нет | Windows Telephony Server Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-591 | Высокая8,1 | — | 23,8 % | 12 дек. 2023 г. |
34Наблюдать | CVE-2023-36019Эксплойта нет | Microsoft Power Platform Connector Spoofing Vulnerabilitymicrosoft · azure logic apps · CWE-73 | Высокая7,4 | — | 15,8 % | 12 дек. 2023 г. |
40В плане | CVE-2023-43364Proof of concept | main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.arjunsharda · searchor · CWE-74 | Критическая9,8 | — | 2,8 % | 12 дек. 2023 г. |
46В плане | CVE-2023-50252Эксплойта нет | php-svg-lib unsafe attributes merge when parsing `use` tagdompdf · php-svg-lib · CWE-15 | Критическая9,8 | — | 23,9 % | 12 дек. 2023 г. |
31Наблюдать | CVE-2023-35636Proof of concept | Microsoft Outlook Information Disclosure Vulnerabilitymicrosoft · 365 apps · CWE-200 | Средняя6,5 | — | 17,6 % | 12 дек. 2023 г. |
22Наблюдать | CVE-2023-6710Proof of concept | Mod_cluster/mod_proxy_cluster: stored cross site scriptingmodcluster · mod proxy cluster · CWE-79 | Средняя5,4 | — | 2,2 % | 12 дек. 2023 г. |
40В плане | CVE-2022-22942Готовый эксплойт | The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by othervmware · photon os · CWE-416 | Высокая7,8 | — | 2,5 % | 13 дек. 2023 г. |
25Наблюдать | CVE-2023-6379Proof of concept | Cross-site Scripting in Alkacon Software OpenCmsalkacon · opencms · CWE-79 | Средняя6,1 | — | 1,7 % | 13 дек. 2023 г. |
24Наблюдать | CVE-2023-6380Proof of concept | Open Redirect in Alkacon Software OpenCmsalkacon · opencms · CWE-601 | Средняя6,1 | — | 1,5 % | 13 дек. 2023 г. |
30Наблюдать | CVE-2023-34194Proof of concept | StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable assertion (and application exit) via a tinyxml project · tinyxml · CWE-617 | Высокая7,5 | — | 1,3 % | 13 дек. 2023 г. |
44В плане | CVE-2023-43813Эксплойта нет | glpi Authenticated SQL Injectionglpi-project · glpi · CWE-89 | Высокая8,8 | — | 30,9 % | 13 дек. 2023 г. |
59В плане | CVE-2023-46727Эксплойта нет | GLPI SQL injection through inventory agent requestglpi-project · glpi · CWE-89 | Критическая9,8 | — | 67,7 % | 13 дек. 2023 г. |
18Наблюдать | CVE-2023-50443Эксплойта нет | Encrypted disks created by PRIMX CRYHOD for Windows before Q.2020.4 (ANSSI qualification submission) or CRYHOD for Windows before 2023.5 canprimx · cryhod | Средняя4,6 | — | 0,3 % | 13 дек. 2023 г. |
24Наблюдать | CVE-2023-41621Proof of concept | A Cross Site Scripting (XSS) vulnerability was discovered in Emlog Pro v2.1.14 via the component /admin/store.php.emlog · emlog · CWE-79 | Средняя6,1 | — | 1,1 % | 13 дек. 2023 г. |
53В плане | CVE-2023-31546Proof of concept | Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature.dedebiz · dedebiz · CWE-79 | Критическая9,6 | — | 49,3 % | 13 дек. 2023 г. |
30Наблюдать | CVE-2023-45184Proof of concept | IBM i Access Client Solutionsibm · i access client solutions · CWE-922 | Высокая7,5 | — | 1,6 % | 13 дек. 2023 г. |
49В плане | CVE-2023-48084Proof of concept | Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.nagios · nagios xi · CWE-89 | Критическая9,8 | — | 33,9 % | 14 дек. 2023 г. |
62На этой неделе | CVE-2023-48085Эксплойта нет | Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php.nagios · nagios xi · CWE-94 | Критическая9,8 | — | 75,8 % | 14 дек. 2023 г. |
26Наблюдать | CVE-2023-45182Proof of concept | IBM i Access Client Solutions information disclosureibm · i access client solutions · CWE-922 | Средняя6,5 | — | 0,6 % | 14 дек. 2023 г. |
35Наблюдать | CVE-2023-45185Proof of concept | IBM i Access Client Solutions code executionibm · i access client solutions · CWE-863 | Высокая8,8 | — | 0,9 % | 14 дек. 2023 г. |
33Наблюдать | CVE-2023-6572Proof of concept | Command Injection in gradio-app/gradiogradio project · gradio · CWE-77 | Высокая8,1 | — | 1,6 % | 14 дек. 2023 г. |
39Наблюдать | CVE-2022-45365Proof of concept | WordPress Stock Ticker Plugin <= 3.23.2 is vulnerable to Cross Site Scripting (XSS)urosevic · stock ticker · CWE-79 | Средняя6,1 | — | 49,1 % | 14 дек. 2023 г. |
44В плане | CVE-2023-50564Proof of concept | An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary pluck-cms · pluck · CWE-434 | Высокая8,8 | — | 29,0 % | 14 дек. 2023 г. |
21Наблюдать | CVE-2023-6595Proof of concept | WhatsUp Gold Unauthenticated Access to an API Endpointprogress · whatsup gold · CWE-306 | Средняя5,3 | — | 0,8 % | 14 дек. 2023 г. |
47В плане | CVE-2023-50269Эксплойта нет | SQUID-2023:10 Denial of Service in HTTP Request parsingsquid-cache · squid · CWE-674 | Высокая7,5 | — | 57,6 % | 14 дек. 2023 г. |
44В плане | CVE-2023-49294Эксплойта нет | Asterisk Path Traversal vulnerabilitydigium · asterisk · CWE-22 | Высокая7,5 | — | 45,2 % | 14 дек. 2023 г. |
48В плане | CVE-2023-6702Proof of concept | Type confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a craftedgoogle · chrome · CWE-843 | Высокая8,8 | — | 44,2 % | 14 дек. 2023 г. |
33Наблюдать | CVE-2023-6831Proof of concept | Path Traversal: '\..\filename' in mlflow/mlflowlfprojects · mlflow · CWE-29 | Высокая8,1 | — | 3,2 % | 14 дек. 2023 г. |
32Наблюдать | CVE-2023-6837Эксплойта нет | Incorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User Impersonationwso2 · api manager · CWE-863 | Высокая8,2 | — | 0,4 % | 15 дек. 2023 г. |
68На этой неделе | CVE-2023-6553Готовый эксплойт | Backup Migration <= 1.3.7 - Unauthenticated Remote Code Executionbackupbliss · backup migration · CWE-94 | Критическая9,8 | — | 97,8 % | 15 дек. 2023 г. |
60На этой неделе | CVE-2023-50917Готовый эксплойт | MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters.mjdm · majordomo · CWE-77 | Критическая9,8 | — | 38,0 % | 15 дек. 2023 г. |
55В плане | CVE-2023-50719Proof of concept | XWiki Platform Solr search discloses password hashes of all usersxwiki · xwiki · CWE-200 | Высокая7,5 | — | 83,5 % | 15 дек. 2023 г. |
39Наблюдать | CVE-2023-50720Proof of concept | XWiki Platform Solr search discloses email addresses of usersxwiki · xwiki · CWE-200 | Средняя5,3 | — | 59,1 % | 15 дек. 2023 г. |
59В плане | CVE-2023-50721Эксплойта нет | XWiki Platform RCE from account through SearchAdminxwiki · xwiki · CWE-94 | Высокая8,8 | — | 78,8 % | 15 дек. 2023 г. |
39Наблюдать | CVE-2023-50965Proof of concept | In MicroHttpServer (aka Micro HTTP Server) through 4398570, _ReadStaticFiles in lib/middleware.c allows a stack-based buffer overflow and postarnight · micro http server · CWE-787 | Критическая9,8 | — | 1,5 % | 16 дек. 2023 г. |
51В плане | CVE-2023-6893Эксплойта нет | Hikvision Intercom Broadcasting System exportrecord.php path traversalhikvision · intercom broadcast system · CWE-22 | Высокая7,5 | — | 70,2 % | 17 дек. 2023 г. |
66На этой неделе | CVE-2023-6895Proof of concept | Hikvision Intercom Broadcasting System ping.php os command injectionhikvision · intercom broadcast system · CWE-78 | Критическая9,8 | — | 89,0 % | 17 дек. 2023 г. |
57В плане | CVE-2023-6909Proof of concept | Path Traversal: '\..\filename' in mlflow/mlflowlfprojects · mlflow · CWE-29 | Высокая7,5 | — | 89,7 % | 18 дек. 2023 г. |
27Наблюдать | CVE-2023-6065Proof of concept | Quttera Web Malware Scanner < 3.4.2.1 - Directory Listing to Sensitive Data Exposurequttera · quttera web malware scanner · CWE-200 | Средняя5,3 | — | 18,5 % | 18 дек. 2023 г. |
17Наблюдать | CVE-2023-6289Proof of concept | Swift Performance Lite <= 2.3.6.14 - Unauthenticated Configuration Exportswteplugins · swift performance · CWE-287 | Средняя4,3 | — | 0,9 % | 18 дек. 2023 г. |
51В плане | CVE-2023-48795Proof of concept | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypasssh · ssh · CWE-354 | Средняя5,9 | — | 93,5 % | 18 дек. 2023 г. |
32Наблюдать | CVE-2023-51385Proof of concept | In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is refereopenbsd · openssh · CWE-78 | Средняя6,5 | — | 19,7 % | 18 дек. 2023 г. |
30Наблюдать | CVE-2023-44982Proof of concept | WordPress WP Retina 2x Plugin <= 6.4.5 is vulnerable to Sensitive Data Exposuremeowapps · perfect images · CWE-200 | Высокая7,5 | — | 1,4 % | 18 дек. 2023 г. |
24Наблюдать | CVE-2023-49489Proof of concept | Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalakodcloud · kodexplorer · CWE-79 | Средняя6,1 | — | 0,7 % | 19 дек. 2023 г. |
41В плане | CVE-2023-6856Эксплойта нет | The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver.mozilla · firefox · CWE-787 | Высокая8,8 | — | 20,6 % | 19 дек. 2023 г. |
30Наблюдать | CVE-2023-1514Proof of concept | A vulnerability exists in the component RTU500 Scripting interface.hitachienergy · rtu500 scripting interface · CWE-295 | Высокая7,5 | — | 0,3 % | 19 дек. 2023 г. |
63На этой неделе | CVE-2021-22962Эксплойта нет | An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.ivanti · avalanche | Критическая9,1 | — | 91,0 % | 19 дек. 2023 г. |
50В плане | CVE-2023-41727Эксплойта нет | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofivanti · avalanche · CWE-787 | Критическая9,8 | — | 36,3 % | 19 дек. 2023 г. |
50В плане | CVE-2023-46216Эксплойта нет | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofivanti · avalanche · CWE-787 | Критическая9,8 | — | 36,3 % | 19 дек. 2023 г. |
50В плане | CVE-2023-46217Эксплойта нет | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial ofivanti · avalanche · CWE-787 | Критическая9,8 | — | 36,3 % | 19 дек. 2023 г. |
- CVE-2023-4884240В плане
D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi.
КритическаяCVSS 9,8Proof of conceptEPSS 3 %dlink · go-rt-ac750 firmware1 дек. 2023 г.
- CVE-2023-446021Наблюдать
Uploading SVG, WEBP and ICO files <= 1.2.1 - Author+ Stored XSS via SVG
СредняяCVSS 5,4Proof of conceptEPSS 1 %uploading svg\, webp and ico files project · uploading svg\, webp and ico files4 дек. 2023 г.
- CVE-2023-606360На этой неделе
WP Fastest Cache < 1.2.2 - Unauthenticated SQL Injection
ВысокаяCVSS 7,5Готовый эксплойтEPSS 73 %wpfastestcache · wp fastest cache4 дек. 2023 г.
- CVE-2023-4008431Наблюдать
In run of MDnsSdListener.cpp, there is a possible memory corruption due to a use after free.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %google · android4 дек. 2023 г.
- CVE-2023-4045931Наблюдать
Improper input leads to DoS
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %sierrawireless · aleos4 дек. 2023 г.
- CVE-2023-4577731Наблюдать
In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activities using system privil
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %google · android4 дек. 2023 г.
- CVE-2023-4577931Наблюдать
In the APEX module framework of AOSP, there is a possible malicious update to platform components due to improperly used crypto.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %google · android4 дек. 2023 г.
- CVE-2023-4928556В плане
Denial of Service in HTTP Message Processing in Squid
ВысокаяCVSS 7,5Эксплойта нетEPSS 88 %squid-cache · squid4 дек. 2023 г.
- CVE-2023-4928633Наблюдать
Denial of Service in Helper Process management
ВысокаяCVSS 7,5Эксплойта нетEPSS 10 %squid-cache · squid4 дек. 2023 г.
- CVE-2023-4929324Наблюдать
Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite
СредняяCVSS 6,1Proof of conceptEPSS 0 %vitejs · vite4 дек. 2023 г.
- CVE-2023-580826Наблюдать
System Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products are susceptible to unintended information disclosure vi
СредняяCVSS 6,5Proof of conceptEPSS 0 %hitachi · vantara hitachi network attached storage4 дек. 2023 г.
- CVE-2023-2858830Наблюдать
Integer Overflow or Wraparound in Bluetooth Host
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %qualcomm · apq8017 firmware4 дек. 2023 г.
- CVE-2023-3306361На этой неделе
Use After Free in DSP Services
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 0 %qualcomm · 315 5g iot modem firmware4 дек. 2023 г.
- CVE-2023-3310661На этой неделе
Use of Out-of-range Pointer Offset in Graphics
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 0 %qualcomm · ar8035 firmware4 дек. 2023 г.
- CVE-2023-3310761На этой неделе
Integer Overflow or Wraparound in Graphics Linux
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 0 %qualcomm · 315 5g iot modem firmware4 дек. 2023 г.
- CVE-2023-4347241В плане
An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API.
ВысокаяCVSS 7,5Proof of conceptEPSS 36 %lfprojects · mlflow5 дек. 2023 г.
- CVE-2023-4907068На этой неделе
Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
КритическаяCVSS 9,8Готовый эксплойтEPSS 95 %apache · ofbiz5 дек. 2023 г.
- CVE-2023-644870На этой неделе
Unitronics VisiLogic uses a default administrative password
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 2 %unitronics · vision1210 firmware5 дек. 2023 г.
- CVE-2023-4422181Срочно
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administr
ВысокаяCVSS 7,2KEVГотовый эксплойтEPSS 76 %sonicwall · sma 200 firmware5 дек. 2023 г.
- CVE-2023-2252239Наблюдать
This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input int
ВысокаяCVSS 8,8Эксплойта нетEPSS 12 %atlassian · confluence data center6 дек. 2023 г.
- CVE-2023-2252338Наблюдать
This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery
ВысокаяCVSS 8,8Эксплойта нетEPSS 11 %atlassian · assets discovery cloud6 дек. 2023 г.
- CVE-2023-2252446В плане
Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability.
КритическаяCVSS 9,8Proof of conceptEPSS 24 %atlassian · companion6 дек. 2023 г.
- CVE-2023-4989780Срочно
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier.
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 50 %fxc · ae1021 firmware6 дек. 2023 г.
- CVE-2023-4884939Наблюдать
Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to inco
КритическаяCVSS 9,8Proof of conceptEPSS 1 %ruijie · rg-eg1000c firmware6 дек. 2023 г.
- CVE-2023-3953931Наблюдать
Failure when uploading a Logo image file
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %ami · aptio v6 дек. 2023 г.
- CVE-2023-4812355В плане
An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafte
ВысокаяCVSS 8,8Proof of conceptEPSS 67 %netgate · pfsense6 дек. 2023 г.
- CVE-2023-656824Наблюдать
Reflected XSS via Content-Type Header in mlflow/mlflow
СредняяCVSS 6,1Proof of conceptEPSS 1 %lfprojects · mlflow7 дек. 2023 г.
- CVE-2023-4310224Наблюдать
An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4.
СредняяCVSS 6,1Эксплойта нетEPSS 0 %zimbra · collaboration7 дек. 2023 г.
- CVE-2023-5016463На этой неделе
Apache Struts: File upload component had a directory traversal vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 80 %apache · struts7 дек. 2023 г.
- CVE-2022-4536239Наблюдать
WordPress Paytm Payment Gateway Plugin <= 2.7.0 is vulnerable to Server Side Request Forgery (SSRF)
СредняяCVSS 6,5Proof of conceptEPSS 41 %paytm · payment gateway7 дек. 2023 г.
- CVE-2023-4697421Наблюдать
Cross Site Scripting vulnerability in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code via a crafte
СредняяCVSS 5,4Proof of conceptEPSS 0 %mayurik · courier management system7 дек. 2023 г.
- CVE-2023-657946В плане
osCommerce POST Parameter shopping-cart sql injection
КритическаяCVSS 9,8Эксплойта нетEPSS 24 %oscommerce · oscommerce7 дек. 2023 г.
- CVE-2023-4586627Наблюдать
Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and
СредняяCVSS 6,3Proof of conceptEPSS 7 %google · android8 дек. 2023 г.
- CVE-2023-4756587Срочно
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x.
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 73 %qnap · qvr firmware8 дек. 2023 г.
- CVE-2023-661248В плане
Totolink X5000R cstecgi.cgi setWizardCfg os command injection
КритическаяCVSS 9,8Эксплойта нетEPSS 30 %totolink · x5000r firmware8 дек. 2023 г.
- CVE-2023-665435Наблюдать
PHPEMS Session Data session.cls.php deserialization
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %phpems · phpems10 дек. 2023 г.
- CVE-2023-665540В плане
Hongjing e-HR Login Interface loadhistroyorgtree sql injection
КритическаяCVSS 9,8Proof of conceptEPSS 3 %hrp2000 · e-hr10 дек. 2023 г.
- CVE-2023-5046521Наблюдать
A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated use
СредняяCVSS 5,4Proof of conceptEPSS 0 %monicahq · monica10 дек. 2023 г.
- CVE-2023-4996445В плане
An issue was discovered in Hyland Alfresco Community Edition through 7.2.0.
ВысокаяCVSS 8,8Proof of conceptEPSS 34 %hyland · alfresco content services11 дек. 2023 г.
- CVE-2023-653826Наблюдать
System Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products is susceptible to unintended information disclosure via
СредняяCVSS 6,5Proof of conceptEPSS 1 %hitachi · system management unit firmware11 дек. 2023 г.
- CVE-2023-4949424Наблюдать
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEdi
СредняяCVSS 6,1Proof of conceptEPSS 1 %dedecms · dedecms11 дек. 2023 г.
- CVE-2023-5024539Наблюдать
OpenEXR-viewer memory overflow vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %afichet · openexr viewer11 дек. 2023 г.
- CVE-2023-553625Наблюдать
A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate
СредняяCVSS 6,4Proof of conceptEPSS 0 %canonical · ubuntu linux11 дек. 2023 г.
- CVE-2023-4162328Наблюдать
Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php.
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %emlog · emlog12 дек. 2023 г.
- CVE-2023-4645446В плане
In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the p
КритическаяCVSS 9,8Proof of conceptEPSS 23 %gl-inet · gl-ar300m firmware12 дек. 2023 г.
- CVE-2023-4645544В плане
In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attack in the OpenVPN cli
ВысокаяCVSS 7,5Proof of conceptEPSS 46 %gl-inet · gl-ar300m firmware12 дек. 2023 г.
- CVE-2023-4645646В плане
In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload fu
КритическаяCVSS 9,8Эксплойта нетEPSS 24 %gl-inet · gl-ar300m firmware12 дек. 2023 г.
- CVE-2023-2846530Наблюдать
The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to cer
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %hapifhir · hl7 fhir core12 дек. 2023 г.
- CVE-2023-3562860На этой неделе
Windows MSHTML Platform Remote Code Execution Vulnerability
ВысокаяCVSS 8,1Эксплойта нетEPSS 92 %microsoft · windows 10 150712 дек. 2023 г.
- CVE-2023-3600330Наблюдать
XAML Diagnostics Elevation of Privilege Vulnerability
ВысокаяCVSS 7,3Proof of conceptEPSS 2 %microsoft · windows 10 150712 дек. 2023 г.
- CVE-2023-3600539Наблюдать
Windows Telephony Server Elevation of Privilege Vulnerability
ВысокаяCVSS 8,1Эксплойта нетEPSS 23 %microsoft · windows 10 150712 дек. 2023 г.
- CVE-2023-3601934Наблюдать
Microsoft Power Platform Connector Spoofing Vulnerability
ВысокаяCVSS 7,4Эксплойта нетEPSS 15 %microsoft · azure logic apps12 дек. 2023 г.
- CVE-2023-4336440В плане
main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.
КритическаяCVSS 9,8Proof of conceptEPSS 2 %arjunsharda · searchor12 дек. 2023 г.
- CVE-2023-5025246В плане
php-svg-lib unsafe attributes merge when parsing `use` tag
КритическаяCVSS 9,8Эксплойта нетEPSS 23 %dompdf · php-svg-lib12 дек. 2023 г.
- CVE-2023-3563631Наблюдать
Microsoft Outlook Information Disclosure Vulnerability
СредняяCVSS 6,5Proof of conceptEPSS 17 %microsoft · 365 apps12 дек. 2023 г.
- CVE-2023-671022Наблюдать
Mod_cluster/mod_proxy_cluster: stored cross site scripting
СредняяCVSS 5,4Proof of conceptEPSS 2 %modcluster · mod proxy cluster12 дек. 2023 г.
- CVE-2022-2294240В плане
The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other
ВысокаяCVSS 7,8Готовый эксплойтEPSS 2 %vmware · photon os13 дек. 2023 г.
- CVE-2023-637925Наблюдать
Cross-site Scripting in Alkacon Software OpenCms
СредняяCVSS 6,1Proof of conceptEPSS 1 %alkacon · opencms13 дек. 2023 г.
- CVE-2023-638024Наблюдать
Open Redirect in Alkacon Software OpenCms
СредняяCVSS 6,1Proof of conceptEPSS 1 %alkacon · opencms13 дек. 2023 г.
- CVE-2023-3419430Наблюдать
StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable assertion (and application exit) via a
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %tinyxml project · tinyxml13 дек. 2023 г.
- CVE-2023-4381344В плане
glpi Authenticated SQL Injection
ВысокаяCVSS 8,8Эксплойта нетEPSS 30 %glpi-project · glpi13 дек. 2023 г.
- CVE-2023-4672759В плане
GLPI SQL injection through inventory agent request
КритическаяCVSS 9,8Эксплойта нетEPSS 67 %glpi-project · glpi13 дек. 2023 г.
- CVE-2023-5044318Наблюдать
Encrypted disks created by PRIMX CRYHOD for Windows before Q.2020.4 (ANSSI qualification submission) or CRYHOD for Windows before 2023.5 can
СредняяCVSS 4,6Эксплойта нетEPSS 0 %primx · cryhod13 дек. 2023 г.
- CVE-2023-4162124Наблюдать
A Cross Site Scripting (XSS) vulnerability was discovered in Emlog Pro v2.1.14 via the component /admin/store.php.
СредняяCVSS 6,1Proof of conceptEPSS 1 %emlog · emlog13 дек. 2023 г.
- CVE-2023-3154653В плане
Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature.
КритическаяCVSS 9,6Proof of conceptEPSS 49 %dedebiz · dedebiz13 дек. 2023 г.
- CVE-2023-4518430Наблюдать
IBM i Access Client Solutions
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %ibm · i access client solutions13 дек. 2023 г.
- CVE-2023-4808449В плане
Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.
КритическаяCVSS 9,8Proof of conceptEPSS 33 %nagios · nagios xi14 дек. 2023 г.
- CVE-2023-4808562На этой неделе
Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php.
КритическаяCVSS 9,8Эксплойта нетEPSS 75 %nagios · nagios xi14 дек. 2023 г.
- CVE-2023-4518226Наблюдать
IBM i Access Client Solutions information disclosure
СредняяCVSS 6,5Proof of conceptEPSS 0 %ibm · i access client solutions14 дек. 2023 г.
- CVE-2023-4518535Наблюдать
IBM i Access Client Solutions code execution
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %ibm · i access client solutions14 дек. 2023 г.
- CVE-2023-657233Наблюдать
Command Injection in gradio-app/gradio
ВысокаяCVSS 8,1Proof of conceptEPSS 1 %gradio project · gradio14 дек. 2023 г.
- CVE-2022-4536539Наблюдать
WordPress Stock Ticker Plugin <= 3.23.2 is vulnerable to Cross Site Scripting (XSS)
СредняяCVSS 6,1Proof of conceptEPSS 49 %urosevic · stock ticker14 дек. 2023 г.
- CVE-2023-5056444В плане
An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary
ВысокаяCVSS 8,8Proof of conceptEPSS 29 %pluck-cms · pluck14 дек. 2023 г.
- CVE-2023-659521Наблюдать
WhatsUp Gold Unauthenticated Access to an API Endpoint
СредняяCVSS 5,3Proof of conceptEPSS 0 %progress · whatsup gold14 дек. 2023 г.
- CVE-2023-5026947В плане
SQUID-2023:10 Denial of Service in HTTP Request parsing
ВысокаяCVSS 7,5Эксплойта нетEPSS 57 %squid-cache · squid14 дек. 2023 г.
- CVE-2023-4929444В плане
Asterisk Path Traversal vulnerability
ВысокаяCVSS 7,5Эксплойта нетEPSS 45 %digium · asterisk14 дек. 2023 г.
- CVE-2023-670248В плане
Type confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted
ВысокаяCVSS 8,8Proof of conceptEPSS 44 %google · chrome14 дек. 2023 г.
- CVE-2023-683133Наблюдать
Path Traversal: '\..\filename' in mlflow/mlflow
ВысокаяCVSS 8,1Proof of conceptEPSS 3 %lfprojects · mlflow14 дек. 2023 г.
- CVE-2023-683732Наблюдать
Incorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User Impersonation
ВысокаяCVSS 8,2Эксплойта нетEPSS 0 %wso2 · api manager15 дек. 2023 г.
- CVE-2023-655368На этой неделе
Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
КритическаяCVSS 9,8Готовый эксплойтEPSS 97 %backupbliss · backup migration15 дек. 2023 г.
- CVE-2023-5091760На этой неделе
MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters.
КритическаяCVSS 9,8Готовый эксплойтEPSS 38 %mjdm · majordomo15 дек. 2023 г.
- CVE-2023-5071955В плане
XWiki Platform Solr search discloses password hashes of all users
ВысокаяCVSS 7,5Proof of conceptEPSS 83 %xwiki · xwiki15 дек. 2023 г.
- CVE-2023-5072039Наблюдать
XWiki Platform Solr search discloses email addresses of users
СредняяCVSS 5,3Proof of conceptEPSS 59 %xwiki · xwiki15 дек. 2023 г.
- CVE-2023-5072159В плане
XWiki Platform RCE from account through SearchAdmin
ВысокаяCVSS 8,8Эксплойта нетEPSS 78 %xwiki · xwiki15 дек. 2023 г.
- CVE-2023-5096539Наблюдать
In MicroHttpServer (aka Micro HTTP Server) through 4398570, _ReadStaticFiles in lib/middleware.c allows a stack-based buffer overflow and po
КритическаяCVSS 9,8Proof of conceptEPSS 1 %starnight · micro http server16 дек. 2023 г.
- CVE-2023-689351В плане
Hikvision Intercom Broadcasting System exportrecord.php path traversal
ВысокаяCVSS 7,5Эксплойта нетEPSS 70 %hikvision · intercom broadcast system17 дек. 2023 г.
- CVE-2023-689566На этой неделе
Hikvision Intercom Broadcasting System ping.php os command injection
КритическаяCVSS 9,8Proof of conceptEPSS 89 %hikvision · intercom broadcast system17 дек. 2023 г.
- CVE-2023-690957В плане
Path Traversal: '\..\filename' in mlflow/mlflow
ВысокаяCVSS 7,5Proof of conceptEPSS 89 %lfprojects · mlflow18 дек. 2023 г.
- CVE-2023-606527Наблюдать
Quttera Web Malware Scanner < 3.4.2.1 - Directory Listing to Sensitive Data Exposure
СредняяCVSS 5,3Proof of conceptEPSS 18 %quttera · quttera web malware scanner18 дек. 2023 г.
- CVE-2023-628917Наблюдать
Swift Performance Lite <= 2.3.6.14 - Unauthenticated Configuration Export
СредняяCVSS 4,3Proof of conceptEPSS 0 %swteplugins · swift performance18 дек. 2023 г.
- CVE-2023-4879551В плане
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypas
СредняяCVSS 5,9Proof of conceptEPSS 93 %ssh · ssh18 дек. 2023 г.
- CVE-2023-5138532Наблюдать
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is refere
СредняяCVSS 6,5Proof of conceptEPSS 19 %openbsd · openssh18 дек. 2023 г.
- CVE-2023-4498230Наблюдать
WordPress WP Retina 2x Plugin <= 6.4.5 is vulnerable to Sensitive Data Exposure
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %meowapps · perfect images18 дек. 2023 г.
- CVE-2023-4948924Наблюдать
Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escala
СредняяCVSS 6,1Proof of conceptEPSS 0 %kodcloud · kodexplorer19 дек. 2023 г.
- CVE-2023-685641В плане
The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver.
ВысокаяCVSS 8,8Эксплойта нетEPSS 20 %mozilla · firefox19 дек. 2023 г.
- CVE-2023-151430Наблюдать
A vulnerability exists in the component RTU500 Scripting interface.
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %hitachienergy · rtu500 scripting interface19 дек. 2023 г.
- CVE-2021-2296263На этой неделе
An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.
КритическаяCVSS 9,1Эксплойта нетEPSS 91 %ivanti · avalanche19 дек. 2023 г.
- CVE-2023-4172750В плане
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
КритическаяCVSS 9,8Эксплойта нетEPSS 36 %ivanti · avalanche19 дек. 2023 г.
- CVE-2023-4621650В плане
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
КритическаяCVSS 9,8Эксплойта нетEPSS 36 %ivanti · avalanche19 дек. 2023 г.
- CVE-2023-4621750В плане
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
КритическаяCVSS 9,8Эксплойта нетEPSS 36 %ivanti · avalanche19 дек. 2023 г.