product: nilsteampassnet/teampass

vendor: nilsteampassnet

product: teampass

vendor: teampass

summary: SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.


default_status: unaffected

product: MyCryptoCheckout

vendor: Unknown

status: affected

version_type: custom

ecosystem: php/wordpress

metric_type: Primary

severity: medium

metric_type: Secondary

part: a

product: mycryptocheckout

vendor: plainviewplugins

quality: metadata-backed

recipe_kind: composed

status: Modified

summary: The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting

title: Plainviewplugins Mycryptocheckout security vulnerability


product: Parkmatik

vendor: Elra

ecosystem: software/application

severity: critical

product: parkmatik

vendor: elra

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Elra Parkmatik allows SQL Injection through SOAP Parameter Tampering, Command Line Execution through SQL Injection. This issue affects Parkmatik: before 02.01-a51.

title: Elra Parkmatik security vulnerability


product: EcoStruxure Control Expert

vendor: Schneider Electric

version: V15.1 and above

vendor: schneider-electric

summary: A CWE-269: Improper Privilege Management vulnerability exists that could cause a local user to perform a denial of service through the console server service that is part of EcoStruxure Control Expert. Affected Products: EcoStruxure Control Expert (V15.1 and above)

title: Schneider-Electric Ecostruxure Control Expert security vulnerability


product: Ad Inserter

archetype: generic

severity: high

summary: The Ad Inserter WordPress plugin before 2.7.27 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present

title: Ad Inserter Project Ad Inserter security vulnerability


default_status: unknown

product: NGINX Agent

version_type: semver

summary: Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when the non-default trace level logging is enabled. Note: NGINX Agent is included with NGINX Instance Manager and used in conjunction with NGINX API Connectivity Manager, and NGINX Management Suite Security Monitoring.


product: ToolboxST

vendor: GE Gas Power

product: toolboxst

vendor: ge

summary: ToolboxST prior to version 7.10 is affected by a deserialization vulnerability. An attacker with local access to an HMI or who has conducted a social engineering attack on an authorized operator could execute code in a Toolbox user's context through the deserialization of an untrusted configuration file. Two CVSS scores have been provided to capture the differences between the two aforementioned attack vectors. Customers are advised to update to ToolboxST 7.10 which can be found in ControlST 7.10. If unable to update at this time customers should ensure they are following the guidance laid out in GE Gas Power's Secure Deployment Guide (GEH-6839). Customers should ensure they are not running ToolboxST as an Administrative user.


product: Quick Paypal Payments

vendor: fullworksplugins

summary: The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

title: Fullworksplugins Quick Paypal Payments security vulnerability


product: GitLab

vendor: GitLab

severity: low

product: gitlab

vendor: gitlab

summary: An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A namespace-level banned user can access the API.

title: Gitlab security vulnerability


product: Judging Management System

vendor: SourceCodester

summary: A vulnerability was found in SourceCodester Judging Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file summary_results.php. The manipulation of the argument main_event_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223549 was assigned to this vulnerability.


product: E-Commerce System

summary: A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ecommerce/admin/user/controller.php?action=edit of the component Username Handler. The manipulation of the argument USERID leads to improper access controls. The attack may be launched remotely. VDB-223550 is the identifier assigned to this vulnerability.


summary: A vulnerability classified as critical has been found in Simple and Beautiful Shopping Cart System 1.0. This affects an unknown part of the file uploadera.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223551.


product: Storage Unit Rental Management System

summary: A vulnerability classified as problematic was found in SourceCodester Storage Unit Rental Management System 1.0. This vulnerability affects unknown code of the file classes/Users.php?f=save. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223552.


product: TinyTIFF

product: tinytiff

summary: A vulnerability, which was classified as problematic, has been found in TinyTIFF 3.0.0.0. This issue affects some unknown processing of the file tinytiffreader.c of the component File Handler. The manipulation leads to buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-223553 was assigned to this vulnerability.


product: Simple Online Hotel Reservation System

vendor: code-projects

vendor: fabian

summary: A vulnerability, which was classified as critical, was found in code-projects Simple Online Hotel Reservation System 1.0. Affected is an unknown function of the file add_room.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. VDB-223554 is the identifier assigned to this vulnerability.


product: Mattermost

vendor: Mattermost

status: unaffected

product: mattermost

vendor: mattermost

summary: Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of a board owner.

title: Mattermost security vulnerability


summary: A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/assign/assign.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223555.


product: Air Cargo Management System

summary: A vulnerability was found in SourceCodester Air Cargo Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/transactions/update_status.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223556.


product: FeiFeiCMS

product: feifeicms

vendor: feifeicms

summary: A vulnerability was found in FeiFeiCMS 2.7.130201. It has been classified as problematic. This affects an unknown part of the file \Public\system\slide_add.html of the component Extension Tool. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223557 was assigned to this vulnerability.


product: Medical Certificate Generator App

summary: A vulnerability was found in SourceCodester Medical Certificate Generator App 1.0. It has been declared as critical. This vulnerability affects unknown code of the file action.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-223558 is the identifier assigned to this vulnerability.


summary: A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/assign/assign.php. The manipulation of the argument sid leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223559.


summary: A vulnerability classified as problematic has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file /admin/reports/index.php of the component GET Parameter Handler. The manipulation of the argument date_to leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223560.


summary: A vulnerability classified as problematic was found in SourceCodester E-Commerce System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/user/controller.php?action=edit. The manipulation of the argument U_NAME with the input <script>alert('1')</script> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223561 was assigned to this vulnerability.


product: tinydng

vendor: syoyo

summary: A vulnerability, which was classified as problematic, has been found in syoyo tinydng. Affected by this issue is the function __interceptor_memcpy of the file tiny_dng_loader.h. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. It is recommended to apply a patch to fix this issue. VDB-223562 is the identifier assigned to this vulnerability.


product: DataGear

product: datagear

vendor: datagear

summary: A vulnerability, which was classified as critical, was found in DataGear up to 4.5.0. This affects an unknown part of the file /analysisProject/pagingQueryData. The manipulation of the argument queryOrder leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.5.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223563.


summary: A vulnerability has been found in DataGear up to 1.11.1 and classified as problematic. This vulnerability affects unknown code of the component Plugin Handler. The manipulation leads to cross site scripting. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 1.12.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-223564.


summary: A vulnerability was found in DataGear up to 1.11.1 and classified as problematic. This issue affects some unknown processing of the component Graph Dataset Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.12.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-223565 was assigned to this vulnerability.


product: Remote Desktop Manager

vendor: Devolutions

ecosystem: windows/system

vendor: devolutions

summary: Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attacker with access to the user interface to obtain sensitive information via the error message dialog that displays the password in clear text.

title: Devolutions Remote Desktop Manager security vulnerability


product: Mega Main Menu

vendor: MegaMain

vendor: megamain

summary: The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

title: Megamain Mega Main Menu security vulnerability


product: Driver Manager

vendor: Lenovo

vendor: lenovo

status: Analyzed

summary: A path hijacking vulnerability was reported in Lenovo Driver Manager prior to version 3.1.1307.1308 that could allow a local user to execute code with elevated privileges.

title: Lenovo Drivers Management security vulnerability


product: pimcore/pimcore

vendor: pimcore

version: unspecified

product: pimcore

summary: SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.


product: binutils

version: unknown

vendor: gnu

summary: Heap based buffer overflow in binutils-gdb/bfd/libbfd.c in bfd_getl64.


product: Gateway

summary: Uncontrolled resource consumption in the logging feature in Devolutions Gateway 2023.1.1 and earlier allows an attacker to cause a denial of service by filling up the disk and render the system unusable.

title: Devolutions Devolutions Gateway security vulnerability


product: Linux

version: Linux Kernel prior to Kernel 5.7 RC14

ecosystem: linux/kernel

part: o

vendor: linux

summary: A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel. This issue may allow a local attacker with user privilege to cause a denial of service.


product: Linux kernel

summary: A NULL pointer dereference was found in io_file_bitmap_get in io_uring/filetable.c in the io_uring sub-component in the Linux Kernel. When fixed files are unregistered, some context information (file_alloc_{start,end} and alloc_hint) is not cleared. A subsequent request that has auto index selection enabled via IORING_FILE_INDEX_ALLOC can cause a NULL pointer dereference. An unprivileged user can use the flaw to cause a system crash.


default_status: affected

product: Red Hat build of Quarkus 2.13.8.Final

vendor: Red Hat

version_type: rpm

product: quarkus

vendor: quarkus

summary: A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.

title: A flaw was found in Quarkus


product: Avast Antivirus

vendor: Avast

product: AVG Antivirus

vendor: AVG

product: antivirus

vendor: avast

product: anti-virus

vendor: avg

summary: Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the Quarantine process, leading to arbitrary file/directory deletion. The issue was fixed with Avast and AVG Antivirus version 22.11 and virus definitions from 14 February 2023 or later.

title: Avast Antivirus security vulnerability


summary: Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the restore process leading to arbitrary file creation. The issue was fixed with Avast and AVG Antivirus version 22.11

title: Avast Antivirus security vulnerability


vendor: AVAST

summary: Avast and AVG Antivirus for Windows were susceptible to a NULL pointer dereference issue via RPC-interface. The issue was fixed with Avast and AVG Antivirus version 22.11


vendor: SourceCodester

summary: A vulnerability has been found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This vulnerability affects the function exec of the file admin/operations/approve_delete.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-223654 is the identifier assigned to this vulnerability.


summary: A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects the function exec of the file admin/operations/currency.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223655.


summary: A vulnerability classified as critical has been found in SourceCodester Automatic Question Paper Generator System 1.0. This affects an unknown part of the file classes/Users.php?f=save_ruser. The manipulation of the argument id/email leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-223659.


summary: A vulnerability classified as critical was found in SourceCodester Automatic Question Paper Generator System 1.0. This vulnerability affects unknown code of the file admin/courses/view_class.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-223660.


summary: A vulnerability, which was classified as problematic, has been found in SourceCodester Automatic Question Paper Generator System 1.0. This issue affects some unknown processing of the file classes/Master.php?f=save_class. The manipulation of the argument description leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-223661 was assigned to this vulnerability.


product: novel-plus

vendor: xxyopen

summary: A vulnerability, which was classified as critical, was found in novel-plus 3.6.2. Affected is the function MenuService of the file sys/menu/list. The manipulation of the argument sort leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-223662 is the identifier assigned to this vulnerability.


summary: A vulnerability has been found in novel-plus 3.6.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the file common/log/list. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223663.


product: tagDiv Composer

vendor: Unknown

product: composer

vendor: tagdiv

summary: The tagDiv Composer WordPress plugin before 4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

title: Tagdiv Composer security vulnerability


product: tagDiv Cloud Library

summary: The tagDiv Cloud Library WordPress plugin before 2.7 does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated users, allowing unauthenticated users to change arbitrary user metadata, which could lead to privilege escalation by setting themselves as an admin of the blog.

title: Tagdiv Cloud Library security vulnerability


product: Short URL

vendor: kaizencoders

summary: The Short URL plugin for WordPress is vulnerable to stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Kaizencoders Short Url security vulnerability


product: Server

vendor: Devolutions

vendor: devolutions

summary: Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versions allows users with restricted rights to bypass entry permission via id collision.

title: Devolutions Devolutions Server security vulnerability


status: Deferred

summary: The Short URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.8. This is due to missing or incorrect nonce validation on the configuration_page function. This makes it possible for unauthenticated attackers to add and import redirects, including comments containing cross-site scripting as detailed in CVE-2023-1602, granted they can trick a site administrator into performing an action such as clicking on a link.


vendor: radareorg

vendor: radare

summary: Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.


ecosystem: java/maven

summary: A vulnerability was found in novel-plus 3.6.2 and classified as critical. Affected by this issue is some unknown functionality of the file DictController.java. The manipulation of the argument orderby leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223736.


summary: A vulnerability was found in novel-plus 3.6.2. It has been classified as critical. This affects an unknown part of the file /common/sysFile/list. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223737 was assigned to this vulnerability.


product: CRMEB Java

vendor: Zhong Bang

vendor: crmeb

summary: A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been declared as critical. This vulnerability affects the function getAdminList of the file /api/admin/store/product/list. The manipulation of the argument cateId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-223738 is the identifier assigned to this vulnerability.


summary: A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been rated as problematic. This issue affects the function save of the file /api/admin/store/product/save. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223739.


product: Rebuild

product: rebuild

vendor: ruifang-tech

summary: A vulnerability, which was classified as critical, has been found in Rebuild up to 3.2.3. Affected by this issue is some unknown functionality of the file /project/tasks/list. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-223742 is the identifier assigned to this vulnerability.


product: Kernel

ecosystem: operating-system

product: fedora

vendor: fedoraproject

vendor: linux

summary: A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and possibly cause a kernel information lea

title: Fedoraproject Fedora security vulnerability


summary: A vulnerability, which was classified as critical, was found in Rebuild up to 3.2.3. This affects an unknown part of the file /files/list-file. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-223743.


summary: A vulnerability has been found in Rebuild up to 3.2.3 and classified as problematic. This vulnerability affects unknown code of the file /feeds/post/publish. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-223744.


product: WP Custom Author URL

summary: The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

title: Wp Custom Author Url Project Wp Custom Author Url security vulnerability


product: Ultimate Addons for Contact Form 7

vendor: psdtowpservice

vendor: themefic

summary: The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and including, 3.1.23. This makes it possible for authenticated attackers of any authorization level to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Themefic Ultimate Addons For Contact Form 7 security vulnerability


product: TeaCMS

vendor: XiaoBingBy

product: teacms

summary: A vulnerability was found in XiaoBingBy TeaCMS up to 2.0.2. It has been classified as problematic. Affected is an unknown function of the component Article Title Handler. The manipulation with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223800.


product: B&R VC4

vendor: B&R Industrial Automation

vendor: br-automation

summary: Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules). This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization. This issue affects B&R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.


product: MELSEC WS Series WS0-GETH00200

vendor: Mitsubishi Electric Corporation

version: Serial number 2310 **** and prior

vendor: mitsubishielectric

summary: Active Debug Code vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 Serial number 2310 **** and prior allows a remote unauthenticated attacker to bypass authentication and illegally log into the affected module by connecting to it via telnet which is hidden function and is enabled by default when shipped from the factory. As a result, a remote attacker with unauthorized login can reset the module, and if certain conditions are met, he/she can disclose or tamper with the module's configuration or rewrite the firmware.

title: Mitsubishielectric Melsec Ws0-Geth00200 Firmware security vulnerability


vendor: Wago

less_than_or_equal: FW22 SP1

vendor: wago

summary: Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a malformed packet.

title: Wago 750-331 Firmware security vulnerability


summary: Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime.


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to commit to projects even from a restricted IP address.

title: Gitlab security vulnerability


product: Custom Post Type UI

vendor: Unknown

vendor: webdevstudios

summary: The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such information to an arbitrary email address via a CSRF attack.

title: Webdevstudios Custom Post Type Ui security vulnerability


product: WPCode

product: wpcode

vendor: wpcode

summary: The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcode_activate_snippets capability delete arbitrary log files on the server, including outside of the blog folders

title: Wpcode security vulnerability


product: openstack-heat

product: Red Hat OpenStack Platform 16.1

vendor: Red Hat

product: Red Hat OpenStack Platform 16.2

product: Red Hat OpenStack Platform 17.0

product: OpenStack RDO

vendor: RDO

product: heat

vendor: openstack

vendor: redhat

summary: An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.


product: Antivirus

vendor: Jianming

vendor: jiangmin

summary: A vulnerability was found in Jianming Antivirus 16.2.2022.418. It has been declared as critical. This vulnerability affects unknown code in the library kvcore.sys of the component IoControlCode Handler. The manipulation leads to memory corruption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224008.


summary: A vulnerability was found in Jianming Antivirus 16.2.2022.418. It has been rated as problematic. This issue affects some unknown processing in the library kvcore.sys of the component IoControlCode Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier VDB-224009 was assigned to this vulnerability.


summary: A vulnerability classified as problematic has been found in Jianming Antivirus 16.2.2022.418. Affected is an unknown function in the library kvcore.sys of the component IoControlCode Handler. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. VDB-224010 is the identifier assigned to this vulnerability.


vendor: JiangMin

summary: A vulnerability classified as critical was found in JiangMin Antivirus 16.2.2022.418. Affected by this vulnerability is the function 0x222010 in the library kvcore.sys of the component IOCTL Handler. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224011.


summary: A vulnerability, which was classified as problematic, has been found in JiangMin Antivirus 16.2.2022.418. Affected by this issue is the function 0x222000 in the library kvcore.sys of the component IOCTL Handler. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224012.


summary: A vulnerability, which was classified as problematic, was found in JiangMin Antivirus 16.2.2022.418. This affects the function 0x222010 in the library kvcore.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-224013 was assigned to this vulnerability.


product: openstack-barbican

product: barbican

summary: A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.


product: OTCMS

archetype: ssrf

product: otcms

vendor: otcms

summary: A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/info_deal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224016.

title: A vulnerability was found in OTCMS 6.72


summary: A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was assigned to this vulnerability.

title: A vulnerability was found in OTCMS 6.72


summary: A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barbican containers share the same CGROUP, USER, and NET namespace with the host system and other OpenStack services. If any service is compromised, it could gain access to the data transmitted to and from Barbican.


product: Kernel

version: Linux kernel 5.18-rc2

vendor: linux

summary: A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of the CPU similar to the speculative execution behavior kind of attacks.

title: Linux Linux Kernel security vulnerability


product: Malware Fighter

vendor: IObit

vendor: iobit

summary: A vulnerability was found in IObit Malware Fighter 9.4.0.776. It has been rated as problematic. Affected by this issue is the function 0x8001E024/0x8001E040 in the library ImfRegistryFilter.sys of the component IOCTL Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-224018 is the identifier assigned to this vulnerability.


summary: A vulnerability classified as problematic has been found in IObit Malware Fighter 9.4.0.776. This affects the function 0x8001E04C in the library ImfRegistryFilter.sys of the component IOCTL Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224019.


summary: A vulnerability classified as problematic was found in IObit Malware Fighter 9.4.0.776. This vulnerability affects the function 0x222010 in the library ObCallbackProcess.sys of the component IOCTL Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224020.


summary: A vulnerability, which was classified as problematic, has been found in IObit Malware Fighter 9.4.0.776. This issue affects the function 0x222018 in the library ObCallbackProcess.sys of the component IOCTL Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier VDB-224021 was assigned to this vulnerability.


summary: A vulnerability, which was classified as problematic, was found in IObit Malware Fighter 9.4.0.776. Affected is the function 0x222034/0x222038/0x22203C/0x222040 in the library ObCallbackProcess.sys of the component IOCTL Handler. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. VDB-224022 is the identifier assigned to this vulnerability.


summary: A vulnerability has been found in IObit Malware Fighter 9.4.0.776 and classified as problematic. Affected by this vulnerability is the function 0x8001E000/0x8001E004/0x8001E018/0x8001E01C/0x8001E024/0x8001E040 in the library ImfHpRegFilter.sys of the component IOCTL Handler. The manipulation leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224023.


summary: A vulnerability was found in IObit Malware Fighter 9.4.0.776 and classified as problematic. Affected by this issue is the function 0x8018E010 in the library IMFCameraProtect.sys of the component IOCTL Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224024.


summary: A vulnerability was found in IObit Malware Fighter 9.4.0.776. It has been classified as problematic. This affects the function 0x8018E008 in the library IMFCameraProtect.sys of the component IOCTL Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier VDB-224025 was assigned to this vulnerability.


summary: A vulnerability was found in IObit Malware Fighter 9.4.0.776. It has been declared as critical. This vulnerability affects the function 0x8018E000/0x8018E004 in the library IMFCameraProtect.sys of the component IOCTL Handler. The manipulation leads to stack-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. VDB-224026 is the identifier assigned to this vulnerability.


vendor: calcom

vendor: cal

summary: Improper Access Control in GitHub repository calcom/cal.com prior to 2.7.


product: AI ChatBot

product: wpbot

vendor: quantumcloud

summary: The AI ChatBot WordPress plugin before 4.5.1 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

title: Quantumcloud Wpbot security vulnerability


vendor: Unknown

summary: The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is present on the blog


summary: The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSS


product: Linux Kernel

version: Kernel 6.2 RC5

product: SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

vendor: Siemens

summary: A use-after-free flaw was found in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel. This issue could allow a local attacker to crash the system or it may lead to a kernel information leak problem.


product: gpac/gpac

vendor: gpac

product: gpac

summary: Denial of Service in GitHub repository gpac/gpac prior to 2.4.0.


summary: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.


platforms: Windows MacOS Linux

vendor: ForgeRock Inc.

vendor: forgerock

summary: Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS) LDAP Connector on Windows, MacOS, Linux allows Remote Services with Stolen Credentials.This issue affects OpenIDM and Java Remote Connector Server (RCS): from 1.5.20.9 through 1.5.20.13.


summary: The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated users to update some settings, leading to Stored XSS due to the lack of escaping when outputting them in the admin dashboard


vendor: trasweb

summary: The Display post meta, term meta, comment meta, and user meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post metadata in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Display Post Meta, Term Meta, Comment Meta, And User Meta Project Displ… security vulnerability


product: Coverity

vendor: Synopsys

product: coverity

vendor: synopsys

summary: Coverity versions prior to 2023.3.2 are vulnerable to forced browsing, which exposes authenticated resources to unauthorized actors. The root cause of this vulnerability is an insecurely configured servlet mapping for the underlying Apache Tomcat server. As a result, the downloads directory and its contents are accessible. 5.9 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P/RL:O/RC:C)


product: Keycloak

vendor: redhat

product: keycloak

summary: A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak. Using this method an attacker may choose the certificate which will be validated by the server. If this happens and the KC_SPI_TRUSTSTORE_FILE_FILE variable is missing/misconfigured, any trustfile may be accepted with the logging information of "Cannot validate client certificate trust: Truststore not available". This may not impact availability as the attacker would have no access to the server, but consumer applications Integrity or Confidentiality may be impacted considering a possible access to them. Considering the environment is correctly set to use "Revalidate Client Certificate" this flaw is avoidable.

title: A flaw was found in Keycloak


product: linagora/twake

vendor: linagora

product: twake

summary: Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0.


vendor: SourceCodester

summary: A vulnerability has been found in SourceCodester Automatic Question Paper Generator System 1.0 and classified as critical. This vulnerability affects unknown code of the file users/classes/view_class.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224104.


product: libssh

vendor: libssh

product: fedora

vendor: fedoraproject

vendor: debian

summary: A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.


product: openvswitch

vendor: cloudbase

summary: A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.

title: A flaw was found in openvswitch (OVS)


product: SEOPress

product: seopress

vendor: seopress

summary: The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.

title: Seopress security vulnerability


product: Kernel

version: Linux kernel 6.3-rc4

vendor: linux

summary: A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system.


product: Sophos Web Appliance

vendor: Sophos

known_ransomware_campaign_use: Unknown

product: Web Appliance

required_action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

vendor_project: Sophos

vulnerability_name: Sophos Web Appliance Command Injection Vulnerability

author: Codex

content_markdown:
CVE-2023-1671 is a pre-authentication command-injection vulnerability in the
`warn-proceed` handler of Sophos Web Appliance (SWA). Sophos states that the
flaw can allow arbitrary code execution and that SWA release `4.3.10.4` fixes
it. The Sophos advisory says CISA observed exploitation in the wild. CISA
added the vulnerability to its Known Exploited Vulnerabilities catalog on
November 16, 2023, with a federal-agency due date of December 7, 2023.

This is now an end-of-life product problem as well as a patch problem. Sophos
ended support for Web Appliance on July 20, 2023. A durable remediation plan
must therefore verify the fixed release, remove untrusted reachability, assess
the period of vulnerable exposure, and retire or replace every remaining SWA
instance. Installing `4.3.10.4` is the documented CVE fix; it does not restore
vendor support or prove that an exposed appliance was not compromised.

## Evidence basis and limits

This recipe is based on the Sophos security advisory, Sophos lifecycle record,
CISA KEV entry, live GHAD `GHSA-5f37-m2hf-qphr`, and NVD. Live GHAD has
**vulnerabilities empty**. NVD CPE excludes **4.3.10.4**, matching the
vendor-named fix. Do not invent a later 4.3.10.5 floor. In its April 2023
advisory, Sophos said no customer action was required because updates were
installed automatically by default. It also recommended protecting SWA with a
firewall and keeping it inaccessible from the public Internet.

That automatic-update statement described the default behavior when the fix
was published; it is not evidence that a particular appliance received
`4.3.10.4`. Sophos's current lifecycle page says SWA is unsupported, no longer
receives updates, and may show update errors after July 20, 2023. Do not assume
the automatic updater or an old update source remains operational. Inventory,
version, network, and log evidence are still required. Public sources do not
document a safe CVE-specific active test, so this recipe contains no request
path, command payload, or exploit check.

## When to use it

Use this recipe when inventory, a scanner, or an operator identifies a Sophos
Web Appliance (physical, virtual, standby, or recovered) that may still be
reachable or whose version is unknown. The durable outcome is isolation,
verified `4.3.10.4` only when a provenance-checked Sophos artifact remains
available, incident review of any untrusted-exposure window, and a named
retirement plan for the EOL product.

Do not use it to probe `warn-proceed`, send a command-injection payload, or
treat an automatic-update claim as proof the appliance is patched or clean.

## Inputs

- Appliance inventory: hostname, environment, form factor, HA/standby copies,
  snapshots, and owner.
- Version evidence from an authorized operator or management interface, not
  from an unauthenticated probe.
- Historical and current network reachability for the management and proxy
  listeners.
- Update provenance if `4.3.10.4` is still installable, plus rollback and
  replacement-owner evidence.
- Log-retention coverage for any period of untrusted reachability.

## Affected and fixed state

| Appliance state | CVE-2023-1671 disposition | Required action |
| --- | --- | --- |
| SWA without verified `4.3.10.4`, or version unknown | Treat as affected | Isolate from untrusted networks, preserve evidence, and retire or replace; use the fixed release only when a provenance-verified Sophos update remains available |
| SWA `4.3.10.4` with verified update evidence | Contains the vendor-documented fix | Assess earlier exposure and retire the unsupported appliance |
| No SWA present, with complete asset and traffic evidence | Finding may be not applicable | Record the evidence and responsible owner |

Do not clear the finding from a desired-state declaration, an update-policy
setting, or one node in a redundant deployment. Capture the running version of
every physical appliance, virtual appliance, standby node, snapshot, template,
and disaster-recovery copy.

## How to determine exposure safely

1. Identify all SWA instances from CMDB, virtualization, network, DNS, proxy,
   certificate, firewall, backup, and disaster-recovery records.
2. Capture the running SWA version from the authenticated management interface
   or an approved inventory system. Record the appliance identity, serial or VM
   identifier, role, timestamp, and evidence source.
3. Confirm whether the appliance's update history proves installation of
   `4.3.10.4`. The historical default automatic-update setting is not evidence
   that the update completed, and the current EOL product no longer receives
   updates from Sophos.
4. Map every path by which an untrusted client could reach the appliance during
   the vulnerable period, including public NAT, proxy paths, VPNs, guest or
   partner networks, and compromised internal clients.
5. Preserve the relevant SWA, firewall, proxy, DNS, authentication, EDR, and
   virtualization logs before retention or maintenance changes them.

Do not send a crafted request to the `warn-proceed` handler. A safe exposure
decision comes from version and reachability evidence, not exploit validation.

## Immediate containment

For an affected or unknown appliance with untrusted reachability, prepare an
operator-approved change that blocks public and other untrusted access at the
closest reliable firewall, load balancer, proxy, or network control. Record the
rule, time, owner, affected traffic, expiry, and restoration criteria.

Sophos lists no workaround. This isolation follows its exposure-reduction
recommendation, but it is not a product workaround or fix, and isolation now
does not erase historical exposure. Notify the incident-response owner when an
affected appliance was reachable, logs are incomplete, or suspicious activity
exists. Preserve evidence before restarting, rebuilding, deleting files,
rotating credentials, or changing log settings.

## How to remediate CVE-2023-1671

1. Establish the service owner, incident-response owner, maintenance window,
   and authority for each appliance.
2. If an appliance does not have verified `4.3.10.4`, keep it isolated while
   the owner determines whether the organization retains a provenance-verified
   Sophos-supplied update or recovery artifact. Do not rely on the EOL
   appliance's updater, use a mirror or third-party package, or imply that
   Sophos still supplies SWA updates.
3. Back up only through the organization's established SWA recovery process.
   Keep forensic evidence separate from operational backups.
4. When an authorized owner has a provenance-verified Sophos artifact and a
   tested recovery plan, install and verify `4.3.10.4` on every in-scope node
   before restoring any permitted path. Keep stale snapshots, templates, and
   standby appliances from re-entering service. Treat this only as interim risk
   reduction on an unsupported product.
5. Create a dated retirement or migration change with a named owner. Replace
   SWA with a supported web-security control, validate policy equivalence and
   logging, migrate traffic in stages, and remove the unsupported appliance
   from routing, DNS, monitoring, backup, and recovery inventories.

If a provenance-verified Sophos update is unavailable, keep the appliance
isolated and escalate discontinuation and replacement. CISA's current KEV
action is to apply vendor mitigations or discontinue use when mitigations are
unavailable. Sophos's lifecycle page directs remaining customers to its
migration information and a Sophos partner for a supported replacement path.

## How to verify remediation

- Capture the running version `4.3.10.4` from every appliance and attach the
  evidence to the change record.
- Confirm update completion rather than relying only on the automatic-update
  configuration.
- Confirm public and other untrusted paths remain closed until both patch and
  incident-response decisions are complete.
- Run ordinary, authenticated proxy and policy health checks with benign test
  traffic. Do not exercise the vulnerable handler with attacker-controlled
  input.
- Verify that standby nodes, VM templates, snapshots, backups, and recovery
  procedures cannot restore an earlier release.
- Track the EOL retirement change separately; a fixed version does not make
  the platform supported.

When historical exposure existed, let incident response determine the required
log review, credential rotation, rebuild, or other eradication work. Absence of
an obvious indicator is not proof that exploitation did not occur.

## Agent prompt

~~~markdown
You are remediating exactly CVE-2023-1671 in a Sophos Web Appliance estate.
Return either a reviewer-ready change set or TRIAGE.md.

1. Inventory every active, standby, virtual, snapshot, template, backup, and
   disaster-recovery copy. Record the running version and evidence source.
2. Map historical and current untrusted reachability without sending an active
   probe or crafted request.
3. If 4.3.10.4 is not verified, prepare owner-approved isolation, backup,
   rollback, and per-node verification. Use an update only when it is a
   provenance-verified Sophos artifact; otherwise escalate discontinuation and
   migration because the EOL appliance no longer receives updates.
4. Preserve logs and hand exposed or uncertain systems to incident response.
   Do not claim that patching proves no compromise.
5. Create a named, dated migration or retirement action because SWA reached
   end of life on 2023-07-20.

Do not execute an exploit, scan public systems, alter production network state,
restart an appliance, delete evidence, rotate credentials, or deploy an update
without the responsible owner's approval. Do not download software from a
third-party source.

Stop with TRIAGE.md when the version, fleet scope, update provenance, exposure
history, logs, rollback, ownership, or replacement path cannot be proven.
TRIAGE.md must name the missing evidence, affected assets, current containment,
responsible owner, and next authorized decision.
~~~

## Rollback and stop conditions

Rollback must use the approved SWA recovery procedure and recorded pre-change
state. Do not restore an affected release to an untrusted network. If an update
must be rolled back, maintain isolation and escalate replacement immediately.

Stop and write `TRIAGE.md` when:

- any appliance identity, running version, standby copy, or historical network
  path is unknown;
- the official `4.3.10.4` update or its provenance cannot be verified;
- logs do not cover an affected period of untrusted reachability;
- suspicious activity or an integrity discrepancy is found;
- production isolation, update, migration, or retirement lacks an authorized
  owner; or
- verification would require exploit-like traffic.

## Output contract

Return one reviewer-ready change scoped to CVE-2023-1671, or `TRIAGE.md`. The
change must include fleet inventory, before/after versions, update provenance,
historical reachability, evidence-preservation disposition, safe health checks,
rollback, residual risk, and a named EOL retirement owner and date. Never claim
remediation from configuration intent alone.

## Primary references

- [Sophos Web Appliance 4.3.10.4 security advisory](https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce)
- [GitHub Advisory GHSA-5f37-m2hf-qphr](https://github.com/advisories/GHSA-5f37-m2hf-qphr)
- [Sophos product lifecycle](https://www.sophos.com/en-us/content/product-lifecycle)
- [CISA Known Exploited Vulnerabilities entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-1671)
- [NVD record for CVE-2023-1671](https://nvd.nist.gov/vuln/detail/CVE-2023-1671)

## Related workflow

- [CVE Intelligence Intake Gate]({{< relref "/recipes/general/cve-intelligence-intake-gate" >}})
- [How to remediate vulnerabilities with AI agents]({{< relref "/security-remediation" >}})

description: Remediate CVE-2023-1671 Sophos Web Appliance command injection. GHAD vulnerabilities empty. NVD CPE excludes 4.3.10.4.

maturity: stable

model: GPT-5.6 Codex

title: CVE-2023-1671: Sophos Web Appliance command injection

vendor: sophos

quality: curated

recipe_kind: markdown-override

summary: A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.


product: tang

product: Red Hat Enterprise Linux 8

vendor: Red Hat

product: Red Hat Enterprise Linux 9

product: Fedora

vendor: Fedora

summary: A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host.


product: School Registration and Fee System

summary: A vulnerability was found in SourceCodester School Registration and Fee System 1.0 and classified as critical. This issue affects some unknown processing of the file /bilal final/login.php of the component POST Parameter Handler. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224231.


summary: A vulnerability was found in SourceCodester School Registration and Fee System 1.0. It has been classified as critical. Affected is an unknown function of the file /bilal final/edit_stud.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224232.


product: DriverGenius

product: drivergenius

vendor: drivergenius

summary: A vulnerability was found in DriverGenius 9.70.0.346. It has been declared as critical. Affected by this vulnerability is the function 0x9C402088 in the library mydrivers64.sys of the component IOCTL Handler. The manipulation leads to memory corruption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-224233 was assigned to this vulnerability.


summary: A vulnerability was found in DriverGenius 9.70.0.346. It has been rated as problematic. Affected by this issue is the function 0x9c40a0c8/0x9c40a0dc/0x9c40a0e0/0x9c40a0d8/0x9c4060d4/0x9c402004/0x9c402088/0x9c40208c/0x9c4060d0/0x9c4060cc/0x9c4060c4/0x9c402084 in the library mydrivers64.sys of the component IOCTL Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-224234 is the identifier assigned to this vulnerability.


summary: A vulnerability classified as critical has been found in DriverGenius 9.70.0.346. This affects the function 0x9C40A0D8/0x9C40A0DC/0x9C40A0E0 in the library mydrivers64.sys of the component IOCTL Handler. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224235.


summary: A vulnerability classified as critical was found in DriverGenius 9.70.0.346. This vulnerability affects the function 0x9C406104/0x9C40A108 in the library mydrivers64.sys of the component IOCTL Handler. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224236.


product: CMS

vendor: Xunrui

product: xunruicms

vendor: xunruicms

summary: A vulnerability, which was classified as problematic, has been found in Xunrui CMS 4.61. This issue affects some unknown processing of the file /dayrui/My/View/main.html. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224237 was assigned to this vulnerability.


summary: A vulnerability, which was classified as problematic, was found in Xunrui CMS 4.61. Affected is an unknown function of the file /config/myfield/test.php. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-224238 is the identifier assigned to this vulnerability.


summary: A vulnerability has been found in Xunrui CMS 4.61 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dayrui/My/Config/Install.txt. The manipulation leads to direct request. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224239.


summary: A vulnerability was found in Xunrui CMS 4.61 and classified as problematic. Affected by this issue is some unknown functionality of the file /dayrui/Fcms/View/system_log.html. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224240.


product: HadSky

product: hadsky

vendor: hadsky

summary: A vulnerability was found in HadSky 7.7.16. It has been classified as problematic. This affects an unknown part of the file upload/index.php?c=app&a=superadmin:index. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224241 was assigned to this vulnerability.


summary: A vulnerability was found in HadSky up to 7.11.8. It has been declared as critical. This vulnerability affects unknown code of the file /install/index.php of the component Installation Interface. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-224242 is the identifier assigned to this vulnerability.


product: Young Entrepreneur E-Negosyo System

summary: A vulnerability was found in SourceCodester Young Entrepreneur E-Negosyo System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file bsenordering/admin/category/index.php of the component GET Parameter Handler. The manipulation of the argument view with the input <script>alert(233)</script> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224243.


product: Simple Task Allocation System

summary: A vulnerability classified as problematic has been found in SourceCodester Simple Task Allocation System 1.0. Affected is an unknown function of the file LoginRegistration.php?a=register_user. The manipulation of the argument Fullname leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-224244.


product: Earnings and Expense Tracker App

summary: A vulnerability classified as problematic has been found in SourceCodester Earnings and Expense Tracker App 1.0. This affects an unknown part of the file Master.php?a=save_expense. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-224307.


summary: A vulnerability classified as problematic was found in SourceCodester Earnings and Expense Tracker App 1.0. This vulnerability affects unknown code of the file Master.php?a=save_earning. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-224308.


summary: A vulnerability, which was classified as problematic, has been found in SourceCodester Earnings and Expense Tracker App 1.0. This issue affects some unknown processing of the file LoginRegistration.php?a=register_user. The manipulation of the argument fullname leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-224309 was assigned to this vulnerability.


product: HarmonyOS

vendor: Huawei

product: EMUI

product: emui

vendor: huawei

product: harmonyos

summary: Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.


summary: The window management module lacks permission verification.Successful exploitation of this vulnerability may affect confidentiality.


summary: The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality.

title: Huawei Emui security vulnerability


title: Vulnerability of failures to capture exceptions in the communication framework


summary: The multimedia video module has a vulnerability in data processing.Successful exploitation of this vulnerability may affect availability.


product: Junos OS

vendor: Juniper Networks

product: junos

vendor: juniper

summary: An Improper Handling of Missing Values vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause a dcpfe process core and thereby a Denial of Service (DoS). Continued receipt of these specific frames will cause a sustained Denial of Service condition. This issue occurs when a specific malformed ethernet frame is received. This issue affects Juniper Networks Junos OS on QFX10000 Series, PTX1000 Series Series: All versions prior to 19.4R3-S10; 20.1 version 20.1R1 and later versions; 20.2 versions prior to 20.2R3-S6; 20.3 versions prior to 20.3R3-S6; 20.4 versions prior to 20.4R3-S5; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S3; 21.3 versions prior to 21.3R3-S3; 21.4 versions prior to 21.4R3-S1; 22.1 versions prior to 22.1R2-S1, 22.1R3; 22.2 versions prior to 22.2R1-S2, 22.2R2.

title: Juniper Junos security vulnerability


product: Compact Controller CC100

vendor: WAGO

product: Edge Controller

product: Touch Panel 600 Advanced Line

product: Touch Panel 600 Marine Line

product: Touch Panel 600 Standard Line

vendor: wago

summary: In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.

title: Wago Compact Controller 100 Firmware security vulnerability


product: Nexpose

product: nexpose

summary: Rapid7 Nexpose versions 6.6.186 and below suffer from a forced browsing vulnerability. This vulnerability allows an attacker to manipulate URLs to forcefully browse to and access administrative pages. This vulnerability is fixed in version 6.6.187.


product: pimcore/pimcore

vendor: pimcore

product: pimcore

summary: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20.


summary: Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.


title: Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20


summary: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.


product: F|One SmartEdge Agent

vendor: Forcepoint

vendor: forcepoint

summary: Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escalation, Functionality Bypass.This issue affects F|One SmartEdge Agent: before 1.7.0.230330-554.

title: Forcepoint One Smartedge Agent security vulnerability


vendor: HP Inc.

version: See HP Security Bulletin reference for affected versions.

vendor: hp

summary: Certain HP Enterprise LaserJet and HP LaserJet Managed Printers are potentially vulnerable to information disclosure when IPsec is enabled with FutureSmart version 5.6.

title: Hp Futuresmart 5 security vulnerability


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copied from clipboard, allowing unexpected commands to be executed on victim machine.

title: Gitlab security vulnerability


vendor: Siemens

product: Teamcenter Visualization

product: Library APDFL

vendor: Datalogics

vendor: siemens

summary: Datalogics Library APDFLThe v18.0.4PlusP1e and prior contains a stack-based buffer overflow due to documents containing corrupted fonts, which could allow an attack that causes an unhandled crash during the rendering process.

title: Siemens Jt2Go security vulnerability


summary: A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 prior to 15.10.1 allows an attacker to view the count of internal notes for a given issue.

title: Gitlab security vulnerability


product: FOXMAN-UN

vendor: Hitachi Energy

version: FOXMAN-UN R16A

version: FOXMAN-UN R15B

version: FOXMAN-UN R15A

version: FOXMAN-UN R14B

version: FOXMAN-UN R14A

version: FOXMAN-UN R11B

version: FOXMAN-UN R11A

version: FOXMAN-UN R10C

version: FOXMAN-UN R9C

product: UNEM

version: UNEM R16A

version: UNEM R15B

version: UNEM R15A

version: UNEM R14B

version: UNEM R14A

version: UNEM R11B

version: UNEM R11A

version: UNEM R10C

version: UNEM R9C

product: foxman-un

vendor: hitachienergy

product: unem

summary: A vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that use remote authentication to the network elements. If exploited an attacker could obtain confidential information. List of CPEs: * cpe:2.3:a:hitachienergy:foxman_un:R9C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman_un:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman_un:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman_un:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman_un:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman_un:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman_un:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman_un:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman_un:R16A:*:*:*:*:*:*:* * * cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy: unem :R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy: unem :R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy: unem :R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy: unem :R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy: unem :R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy: unem :R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy: unem :R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy: unem :R16A:*:*:*:*:*:*:*

title: Hitachienergy Foxman-Un security vulnerability


product: deepset-ai/haystack

vendor: deepset-ai

version: unspecified

product: haystack

vendor: deepset

summary: Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack prior to 0.1.30.


summary: Insecure temporary file creation in bitrix/modules/crm/lib/order/import/instagram.php in Bitrix24 22.0.300 hosted on Apache HTTP Server allows remote authenticated attackers to execute arbitrary code via uploading a crafted ".htaccess" file.

title: Bitrix24 security vulnerability


summary: Unsafe variable extraction in bitrix/modules/main/classes/general/user_options.php in Bitrix24 22.0.300 allows remote authenticated attackers to execute arbitrary code via (1) appending arbitrary content to existing PHP files or (2) PHAR deserialization.

title: Bitrix24 security vulnerability


summary: A logic error when using mb_strpos() to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags at the begining of the payload.

title: Bitrix24 security vulnerability


ecosystem: javascript/npm

summary: Cross-site scripting (XSS) vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege.

title: Bitrix24 security vulnerability


summary: Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.

title: Bitrix24 security vulnerability


summary: Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause denial-of-service via a crafted "tmp_url".

title: Bitrix24 security vulnerability


summary: Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialised variables.

title: Bitrix24 security vulnerability


summary: Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via uploading a crafted HTML file through /desktop_app/file.ajax.php?action=uploadfile.

title: Bitrix24 security vulnerability


product: Yoga Class Registration System

vendor: Yoga Class Registration System

summary: Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators.


title: Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server


product: Mobile Assistant

vendor: Veragroup

vendor: vegayazilim

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veragroup Mobile Assistant allows SQL Injection. This issue affects Mobile Assistant: before 21.S.2343.

title: Vegayazilim Mobile Assistant security vulnerability


product: Faveo Helpdesk

vendor: Ladybirdweb

vendor: ladybirdweb

summary: Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the application. This occurs because the application is vulnerable to stored XSS.


product: Project Management System

vendor: Infoline

vendor: infoline-tr

summary: Server-Side Request Forgery (SSRF) vulnerability in Infoline Project Management System allows Server Side Request Forgery. This issue affects Project Management System: before 4.09.31.125.


product: OBS

vendor: Proliz

vendor: prolizyazilim

summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Proliz OBS allows Stored XSS for an authenticated user. This issue affects OBS: before 23.04.01.

title: Prolizyazilim Student Affairs Information System security vulnerability


product: LMS

vendor: Fernus Informatics

vendor: fernus

summary: Unrestricted Upload of File with Dangerous Type vulnerability in Fernus Informatics LMS allows OS Command Injection, Server Side Include (SSI) Injection. This issue affects LMS: before 23.04.03.

title: Fernus Learning Management Systems security vulnerability


product: LibRaw

version: LibRaw 0.21.1

product: libraw

vendor: libraw

product: fedora

vendor: fedoraproject

vendor: redhat

summary: A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to an application crash.

title: A flaw was found in LibRaw


product: SupportCandy

vendor: Unknown

product: supportcandy

vendor: supportcandy

summary: The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks

title: Supportcandy security vulnerability


product: LTOS

vendor: Meinberg

vendor: meinbergglobal

summary: In Meinbergs LTOS versions prior to V7.06.013, the configuration file upload function would not correctly validate the input, which would allow an remote authenticated attacker with high privileges to execute arbitrary commands.

title: Meinbergglobal Lantime Firmware security vulnerability


product: CIRCL

vendor: Cloudflare

product: circl

vendor: cloudflare

summary: When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read() returns an error. In rare deployment cases (error thrown by the Read() function), this could lead to a predictable shared secret. The tkn20 and blindrsa components did not check whether enough randomness was returned from the user provided randomness source. Typically the user provides crypto/rand.Reader, which in the vast majority of cases will always return the right number random bytes. In the cases where it does not, or the user provides a source that does not, the blinding for blindrsa is weak and integrity of the plaintext is not ensured in tkn20.

title: Cloudflare Circl security vulnerability


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.10.1.

title: Gitlab security vulnerability


product: Young Entrepreneur E-Negosyo System

vendor: SourceCodester

summary: A vulnerability classified as critical has been found in SourceCodester Young Entrepreneur E-Negosyo System 1.0. Affected is an unknown function of the file admin/products/controller.php?action=add. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. VDB-224622 is the identifier assigned to this vulnerability.


summary: A vulnerability classified as critical was found in SourceCodester Young Entrepreneur E-Negosyo System 1.0. Affected by this vulnerability is an unknown functionality of the file passwordrecover.php. The manipulation of the argument phonenumber leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-224623.


summary: A vulnerability, which was classified as critical, has been found in SourceCodester Young Entrepreneur E-Negosyo System 1.0. Affected by this issue is some unknown functionality of the file cart/controller.php?action=add. The manipulation of the argument PROID leads to sql injection. The identifier of this vulnerability is VDB-224624.


summary: A vulnerability, which was classified as critical, was found in SourceCodester Young Entrepreneur E-Negosyo System 1.0. This affects an unknown part of the file login.php. The manipulation of the argument U_USERNAME leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-224625 was assigned to this vulnerability.


summary: A vulnerability has been found in SourceCodester Young Entrepreneur E-Negosyo System 1.0 and classified as critical. This vulnerability affects unknown code of the file index.php?q=product. The manipulation of the argument search leads to sql injection. The attack can be initiated remotely. VDB-224626 is the identifier assigned to this vulnerability.


summary: A vulnerability was found in SourceCodester Simple and Beautiful Shopping Cart System 1.0 and classified as critical. This issue affects some unknown processing of the file upload.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224627.


product: Air Cargo Management System

summary: A vulnerability was found in SourceCodester Air Cargo Management System 1.0. It has been classified as critical. Affected is an unknown function of the file admin/user/manage_user.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224628.


product: jeecg-boot

vendor: jeecg

summary: A vulnerability was found in jeecg-boot 3.5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file SysDictMapper.java of the component Sleep Command Handler. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224629 was assigned to this vulnerability.


product: IBOS

product: ibos

vendor: ibos

summary: A vulnerability was found in IBOS 4.5.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /?r=report/api/getlist of the component Report Search. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-224630 is the identifier assigned to this vulnerability.

title: A vulnerability was found in IBOS 4.5.5


product: Grade Point Average GPA Calculator

summary: A vulnerability classified as problematic has been found in SourceCodester Grade Point Average GPA Calculator 1.0. This affects an unknown part of the file index.php. The manipulation of the argument page leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224631.


summary: A vulnerability classified as critical was found in IBOS 4.5.5. This vulnerability affects unknown code of the component htaccess Handler. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224632.


product: KMPlayer

product: kmplayer

vendor: pandora

summary: A vulnerability, which was classified as problematic, has been found in KMPlayer 4.2.2.73. This issue affects some unknown processing in the library SHFOLDER.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-224633 was assigned to this vulnerability.


product: Dreamer CMS

vendor: iteachyou

summary: A vulnerability, which was classified as problematic, was found in Dreamer CMS up to 3.5.0. Affected is an unknown function of the component File Upload Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-224634 is the identifier assigned to this vulnerability.


summary: A vulnerability has been found in IBOS up to 4.5.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /?r=email/api/mark&op=delFromSend. The manipulation of the argument emailids leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.5.5 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-224635.


product: Smart Alarm NXAL-100

vendor: Nexx

product: Smart Plug NXPG-100W

product: Garage Door Controller NXG-100B, NXG-200

vendor: getnexx

summary: The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the affected firmware could view the credentials and access the MQ Telemetry Server (MQTT) server and the ability to remotely control garage doors or smart plugs for any customer.


summary: The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could send API requests that the affected devices would execute.


summary: The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could retrieve device history, set device settings, and retrieve device information.


summary: The listed versions of Nexx Smart Home devices use a WebSocket server that does not validate if the bearer token in the Authorization header belongs to the device attempting to associate. This could allow any authorized user to receive alarm information and signals meant for other devices which leak a deviceId.

title: Getnexx Nxal-100 Firmware security vulnerability


summary: The listed versions of Nexx Smart Home devices could allow any user to register an already registered alarm or associated device with only the device’s MAC address.


product: thorsten/phpmyfaq

vendor: thorsten

product: phpmyfaq

vendor: phpmyfaq

summary: Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


summary: Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


summary: Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


summary: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


title: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12


summary: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

title: Phpmyfaq security vulnerability


summary: Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


summary: Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


product: Canon IJ NW Tool

vendor: Canon Inc.

version: Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),Ver.4.7.3 and earlier (supported OS: OS…

vendor: canon

summary: Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 10.7.5-OS X 10.8) allows an attacker to acquire sensitive information on the Wi-Fi connection setup of the printer from the software.

title: Canon Ij Network Tool security vulnerability


summary: Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 10.7.5-OS X 10.8) allows an attacker to acquire sensitive information on the Wi-Fi connection setup of the printer from the communication of the software.


product: Panon

vendor: Akbim Computer

product: panon

vendor: akbim

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Akbim Computer Panon allows SQL Injection. This issue affects Panon: before 1.0.2.

title: Akbim Panon security vulnerability


summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Akbim Computer Panon allows Reflected XSS. This issue affects Panon: before 1.0.2.

title: Akbim Panon security vulnerability


product: Snyk Advisor

vendor: Snyk

product: advisor

vendor: snyk

summary: The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README file containing XSS-able HTML tags. Upon Snyk Advisor importing the package, the XSS would run each time an end user browsed to the package's page on Snyk Advisor.


product: Checkmk

product: checkmk

vendor: checkmk

summary: Inappropriate error handling in Tribe29 Checkmk <= 2.1.0p25, <= 2.0.0p34, <= 2.2.0b3 (beta), and all versions of Checkmk 1.6.0 causes the symmetric encryption of agent data to fail silently and transmit the data in plaintext in certain configurations.

title: Checkmk security vulnerability


summary: A vulnerability, which was classified as problematic, was found in SourceCodester Grade Point Average GPA Calculator 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page with the input php://filter/read=convert.base64-encode/resource=grade_table leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-224670 is the identifier assigned to this vulnerability.


summary: A vulnerability has been found in SourceCodester Grade Point Average GPA Calculator 1.0 and classified as critical. Affected by this vulnerability is the function get_scale of the file Master.php. The manipulation of the argument perc leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224671.


summary: A vulnerability was found in SourceCodester Grade Point Average GPA Calculator 1.0 and classified as problematic. Affected by this issue is the function get_scale of the file Master.php. The manipulation of the argument perc leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224672.


product: DataGear

product: datagear

vendor: datagear

summary: A vulnerability was found in DataGear up to 4.5.1. It has been classified as problematic. This affects an unknown part of the component Diagram Type Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224673 was assigned to this vulnerability.


product: Rockoa

product: rockoa

vendor: rockoa

summary: A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of the component Configuration File Handler. The manipulation leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-224674 is the identifier assigned to this vulnerability.


product: Mattermost

vendor: Mattermost

vendor: mattermost

summary: When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel.

title: Mattermost Mattermost Server security vulnerability


summary: When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.


summary: Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file.


summary: Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.


product: Data Security Firewall

vendor: GajShield

vendor: gajshield

summary: This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default credentials which allows remote attacker to login as superuser by using default username/password via web-based management interface and/or exposed SSH port thereby enabling remote attackers to execute arbitrary commands with administrative/superuser privileges on the targeted systems. The vulnerability has been addressed by forcing the user to change their default password to a new non-default password.

title: Gajshield Data Security Firewall Firmware security vulnerability


vendor: MB Connect Line

vendor: Helmholz

vendor: mbconnectline

summary: Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual in versions <=2.13.3 allow an authorized remote attacker with low privileges to view a limited amount of another accounts contact information.

title: Mbconnectline Mbconnect24 security vulnerability


product: Companion Sitemap Generator

vendor: Unknown

vendor: codeermeneer

summary: The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

title: Codeermeneer Companion Sitemap Generator security vulnerability


platforms:
64 bit
32 bit
x86
ARM
MacOS
Windows
Linux

product: Nomad

vendor: HashiCorp

product: Nomad Enterprise

product: nomad

vendor: hashicorp

summary: HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3.

title: Hashicorp Nomad security vulnerability


product: Orangescrum

vendor: Orangescrum

product: orangescrum

vendor: orangescrum

summary: OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF.


product: jeecg-boot

vendor: jeecg

summary: A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Documentation. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224699.


product: Earnings and Expense Tracker App

vendor: SourceCodester

summary: A vulnerability was found in SourceCodester Earnings and Expense Tracker App 1.0. It has been classified as critical. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-224700.


product: cloud-init

vendor: Canonical Ltd.

vendor: canonical

product: fedora

vendor: fedoraproject

summary: Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A search timeout could be triggered if a specific HTML payload was used in the issue description.

title: Gitlab security vulnerability


product: firefly-iii/firefly-iii

vendor: firefly-iii

summary: Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.


summary: Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.


product: Simple Task Allocation System

summary: A vulnerability, which was classified as problematic, was found in SourceCodester Simple Task Allocation System 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224724.


summary: A vulnerability has been found in SourceCodester Simple Task Allocation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224743.


product: Simple Mobile Comparison Website

summary: A vulnerability was found in SourceCodester Simple Mobile Comparison Website 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/fields/manage_field.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224744.