146 matches found
CVE-2023-39429
Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary script via a crafted configuration. Affected products and versions are as follows: ACERA 1210 firmware ver.02.36 and earlier, ACERA 1150i firmware ver.01.35 a...
CVE-2023-39222
OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request. Affected products and versions are as follows:...
Ubuntu: Security Advisory (USN-6192-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2023-20242 · Ibm · Ibm Powervm Hypervisor
Name of the Vulnerable Software and Affected Versions: IBM PowerVM Hypervisor versions FW950.00 through FW950.71 IBM PowerVM Hypervisor versions FW1010.00 through FW1010.40 IBM PowerVM Hypervisor versions FW1020.00 through FW1020.20 IBM PowerVM Hypervisor versions FW1030.00 through FW1030.11...
CVE-2023-1020
creationtimestamp| type| source ---|---|--- 2023-04-24 22:19:40+00:00| seen| https://t.me/cibsecurity/62747 2023-07-26 14:24:11+00:00| published-proof-of-concept| https://t.me/codeb0ss/958 2025-02-22 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2025-02-22...
CVE-2023-1020
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...
CVE-2023-1020 Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated SQLi
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...
CVE-2023-1020 Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated SQLi
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...
CVE-2023-1020
The CVE-2023-1020 entry concerns the WordPress plugin Steveas WP Live Chat Shoutbox, affected in versions up to 1.4.2. The root cause is a SQL injection vulnerability caused by unsanitized/uncleaned parameters in an AJAX action accessible to unauthenticated users, enabling arbitrary SQL execution...
WordPress Steveas WP Live Chat Shoutbox Plugin <= 1.4.2 is vulnerable to SQL Injection
Software Steveas WP Live Chat Shoutbox Type Plugin Vulnerable versions = 1.4.2 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-1020 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 176c8169feb6 Credits Simone Onofri Donato Onofri Required...
Debian: Security Advisory (DSA-2303-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian: Security Advisory (DSA-2310-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2022-45163
An information-disclosure vulnerability exists on select NXP devices when configured in Serial Download Protocol SDP mode: i.MX RT 1010, i.MX RT 1015, i.MX RT 1020, i.MX RT 1050, i.MX RT 1060, i.MX 6 Family, i.MX 7Dual/Solo, i.MX 7ULP, i.MX 8M Quad, i.MX 8M Mini, and Vybrid. In a device...
CVE-2022-1020
CVE-2022-1020 affects the WordPress WooCommerce Product Table plugin prior to 3.1.2. The wpt_admin_update_notice_option AJAX action lacks proper authorization and CSRF checks and does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with none or ...
CVE-2022-1020 Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call
The Product Table for WooCommerce wooproducttable WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wptadminupdatenoticeoption AJAX action available to both unauthenticated and authenticated users, as well as does not validate the callback parameter, allowing...
CVE-2021-1020
creationtimestamp| type| source ---|---|--- 2021-12-15 22:40:01+00:00| seen| https://t.me/cibsecurity/34086...
CVE-2021-1020
In snoozeNotification of NotificationListenerService.java, there is a possible way to disable notification for an arbitrary user due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for...
CVE-2021-1020
CVE-2021-1020 affects Android 12 via snoozeNotification in NotificationListenerService.java, where improper input validation could allow disabling notifications for an arbitrary user, enabling local privilege escalation with user interaction required. In-text impact is described as local escalati...
Introducing the In-the-Wild Series
This is part 1 of a 6-part series detailing a set of vulnerabilities found by Project Zero being exploited in the wild. To read the other parts of the series, head to the bottom of this post. At Project Zero we often refer to our goal simply as “make 0-day hard”. Members of the team approach this...
CVE-2020-1020
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could...