CVE-2023-22006

...

CVE-2023-22004

...

CVE-2023-3743

Summary: CVE-2023-3743 affects LeoTheme’s Ap Page Builder for Prestashop, with versions prior to 1.7.8.2 vulnerable to a SQL injection via the product_one_img parameter, allowing a remote attacker to retrieve data from the database. The root cause is improper handling of user-supplied input in th...

CVE-2023-37475

CVE-2023-37475 affects the Go library hamba/avro, where a crafted string passed to Unmarshal() can trigger uncontrolled memory allocation, leading to denial of service. Root cause: the Unmarshal() path uses input data to size allocations, allowing memory exhaustion and potential crash. A fix is i...

CVE-2023-35818

The CVE-2023-35818 issue affects Espressif ESP32 3.0 (ESP32_rev300 ROM). An EMFI attack on ECO3 allows an attacker to influence the program counter at CPU context level, independent of Secure Boot and Flash Encryption. This enables access to ROM download mode, potentially allowing reading of encr...

CVE-2023-37473

The CVE affects zenstruck/collections (PHP library). The vulnerability arises when user input is passed as a callable string (e.g., system) to EntityRepository::find() or query(), allowing arbitrary code execution. The issue has been fixed in commit f4b1c488206e1b1581b06fcd331686846f13f19c and re...

CVE-2023-32760

CVE-2023-32760 affects Archer Platform prior to version 6.13, with fixes in 6.12.0.6 and 6.13.0. An authenticated attacker could access sensitive information via API calls related to data feeds and data publication. The vulnerability’s impact and exact exploited components are described in the li...

CVE-2023-32759

CVE-2023-32759 (Archer Platform) : The affected product is Archer Platform, prior to version 6.13. The issue allows an authenticated attacker to obtain sensitive information through a crafted URL. The root cause is not detailed in the provided documents beyond this exposure path. A fixed version ...

CVE-2023-37224

Archer Platform has a vulnerability (CVE-2023-37224) causing information disclosure via log files in versions prior to 6.13. It is fixed in 6.12.0.6 and 6.13.0. Upgrade to 6.12.0.6 or later (6.13.0 or newer) to remediate. The advisory does not specify exploitation details beyond authenticated acc...

CVE-2023-3661

creationtimestamp| type| source ---|---|--- 2023-07-13 16:21:38+00:00| seen| https://t.me/cibsecurity/66658...

CVE-2022-24834

CVE-2022-24834 describes a heap overflow in Redis’s Lua cjson/cmsgpack libraries that could lead to heap corruption and potentially remote code execution. The vulnerability affects Redis with Lua scripting support (from version 2.6 onward) and requires authenticated/authorized access. Affected re...

data.nilfiskoutlet.co.uk Cross Site Scripting vulnerability OBB-3510707

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-34134

CVE-2023-34134 affects SonicWall GMS (9.3.2-SP1 and earlier) and Analytics (2.5.0.4-R7 and earlier): an authenticated attacker could read the administrator password hash via a web service call. Root cause is exposure of sensitive information. Remediation: update to SonicWall GMS 9.3.3 and Analyti...

CVE-2023-34133

CVE-2023-34133 is an SQL Injection affecting SonicWall GMS and Analytics (GMS 9.3.2-SP1 and earlier; Analytics 2.5.0.4-R7 and earlier). An unauthenticated attacker can extract data from the application database. Public materials reference SQLi in SonicWall GMS/Analytics and mention updated fixes;...

CVE-2023-34129

CVE-2023-34129 describes a Zip Slip path traversal in SonicWall GMS and Analytics. An authenticated attacker can traverse the filesystem and write arbitrary files via the Web Service, potentially achieving root-level impact. Affected versions: SonicWall GMS 9.3.2-SP1 and earlier; Analytics 2.5.0....

CVE-2023-31824

CVE-2023-31824 affects DELICIA v13.6.1 from DERICIA Co. Ltd. A remote attacker could access sensitive information via the channel access token in the miniapp DELICIA function. Reported across multiple feeds (Red Hat, NVD, CVE listings) with CVSSv3.1 base score 7.5 (Network, Low attack complexity,...

CVE-2023-31819

CVE-2023-31819 affects KEISEI STORE Co, Ltd. LIVRE KEISEI v13.6.1, where the miniapp function exposes the channel access token, enabling a remote attacker to access sensitive information. Root cause: improper protection/exposure of the access token in the miniapp flow. Impact: potential informati...

CVE-2023-31825

The CVE-2023-31825 entry concerns Inageya v13.4.1 where a remote attacker can disclose sensitive information via the channel access token in the miniapp Inageya function. The vulnerability is documented across multiple feeds (NVD/Red Hat and related sources) with a high-severity impact (CVSS v3.1...

CVE-2023-31822

CVE-2023-31822 affects Entetsu Store v13.4.1. The vulnerability allows a remote attacker to access sensitive information via the channel access token in the miniapp Entetsu Store function. The connected sources confirm the product and impact but do not provide explicit root-cause analysis, exploi...

CVE-2023-31820

CVE-2023-31820 affects Shizutetsu Store v.13.6.1. The issue enables a remote attacker to access sensitive information via the channel access token in the miniapp function, constituting an information disclosure vulnerability. Public references at Red Hat and NVD corroborate the same description. ...