CVE-2023-33107

CVE-2023-33107 is an integer overflow/memory-corruption vulnerability in Graphics Linux affecting Qualcomm display components. The flaw occurs when assigning a shared virtual memory region during an IOCTL, enabling local attacker access with low complexity and no user interaction; impact is rated...

CVE-2023-33106

CVE-2023-33106 is a memory corruption vulnerability in Qualcomm graphics drivers, caused by an out-of-range pointer offset when submitting a large list of sync points to IOCTL_KGSL_GPU_AUX_COMMAND. Affected component is Qualcomm chipsets’ graphics subsystem (KGSL driver). The issue is locally exp...

CVE-2023-33063

CVE-2023-33063 is a Use-After-Free/memory corruption issue in Qualcomm DSP Services triggered by a remote call from HLOS to DSP. Affected: Qualcomm chipsets with DSP Services; root cause: memory corruption leading to potential unintended behavior. Documents indicate high impact (confidentiality, ...

CVE-2023-40088

CVE-2023-40088 is a memory corruption via a use-after-free in Android’s Bluetooth stack (callback_thread_event in com_android_bluetooth_btservice_AdapterService.cpp). The issue could allow remote code execution with no privileges and no user interaction, limited to proximal/nearby Bluetooth range...

CVE-2023-42917

CVE-2023-42917 is a memory corruption vulnerability in Apple WebKit that may allow arbitrary code execution when processing web content. It is fixed in iOS 17.1.2, iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1.2. The CVE entry notes that exploitation may have occurred on iOS versions before...

CVE-2023-42916

Technical details about CVE-2023-42916 are not provided in the connected documents. Please monitor for updates from official advisories.

CVE-2023-6360

The CVE-2023-6360 entry refers to the WordPress My Calendar plugin, affected versions before 3.4.22, with an unauthenticated SQL injection in the from and to parameters of the /my-calendar/v1/events REST route. The vulnerability can enable arbitrary SQL queries against the database and is categor...

CVE-2023-40600

Affected software: WordPress EWWW Image Optimizer plugin ≤ 7.2.0. Vulnerability: Sensitive information exposure via the debug_log function, allowing unauthenticated access to sensitive debug data when debug logging is enabled. Root cause/vector: debug_log writes internal data to logs accessible t...

CVE-2021-35975

CVE-2021-35975 describes an absolute path traversal in Systematica Radius components (Systematica SMTP Adapter up to v2.0.1.101; Radius up to v3.9.256.777) allowing remote attackers to read arbitrary files via a full pathname in the GET parameter file. Related affected components in the same prod...

CVE-2023-6345

CVE-2023-6345 is an integer overflow in the Skia graphics library used by Google Chrome prior to 119.0.6045.199. The vulnerability allows a renderer-compromised attacker to potentially escape the sandbox via a malicious file. Affected product: Google Chrome (Skia component). Root cause: integer o...

CVE-2023-4220

Summary (CVE-2023-4220, Chamilo LMS) Chamilo LMS

CVE-2023-3368

CVE-2023-3368 corresponds to an unauthenticated command injection in Chamilo LMS, exploited via the endpoint /main/webservices/additional_webservices.php. The public details state that Chamilo LMS

CVE-2023-48022

This CVE impacts Anyscale Ray versions 2.6.3 and 2.8.0, where the remote code execution (RCE) arises from an insecure job submission API. The vulnerability enables unauthenticated remote code execution if an attacker can reach the Ray Dashboard API over the network, as Ray’s API lacks proper auth...

CVE-2023-6329

CVE-2023-6329 affects Control iD iDSecure (v4.7.32.0 and earlier) where iDS-Core.dll’s login routine contains a passwordCustom option that enables an unauthenticated attacker to compute valid credentials and bypass authentication to gain administrative access. The impact is authenticated-remote a...

CVE-2023-5815

The News & Blog Designer Pack WordPress plugin (

CVE-2023-5822

CVE-2023-5822 affects the WordPress plugin Drag and Drop Multiple File Upload – Contact Form 7. Vulnerability: arbitrary file upload due to insufficient file type validation in dnd_upload_cf7_upload, enabling unauthenticated attackers to upload arbitrary files if a multiple-file upload form field...

CVE-2023-6209

CVE-2023-6209 corresponds to a parsing vulnerability where relative URLs starting with three slashes and a "/../" path could override the specified host, potentially enabling security issues on affected sites. The issue is documented for Firefox and Thunderbird, with affected versions cited as Fi...

CVE-2023-49105

ownCloud (owncloud/core) versions 10.6.0 through 10.13.0 are affected by an authentication bypass in the WebDAV API. Pre-signed URLs are accepted even when no signing-key is configured for the file owner (the default case), allowing an unauthenticated attacker to access, modify, or delete any fil...

CVE-2023-49103

The CVE-2023-49103 vulnerability affects ownCloud graphapi in versions 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The issue stems from a third‑party GetPhpInfo.php that returns a phpinfo() output, exposing the PHP environment and webserver variables (potentially including admin passwords, mail cr...

CVE-2023-1434

Odoo prior to 16.0 is vulnerable to CVE-2023-1434 due to an incorrect Content-Type on an API endpoint, enabling Cross-Site Scripting. The NUCLEI template notes the issue affects versions before 16.0 and describes the root cause as a mis-set content type in an API handler. Impactally, successful e...