CVE-2023-44353

CVE-2023-44353 affects Adobe ColdFusion versions 2023.5 and earlier, and 2021.11 and earlier, due to a Deserialization of Untrusted Data vulnerability (WDDX) that could lead to arbitrary code execution without user interaction. Connected sources confirm the issue is a deserialization gadget class...

CVE-2023-44352

Adobe ColdFusion: Reflective XSS affecting 2023.5 (and earlier) and 2021.11 (and earlier). An unauthenticated user can lure a victim to a crafted URL that executes malicious JavaScript in the browser, potentially compromising session data. Affected component is the web interface that handles the ...

CVE-2023-43177

CrushFTP before 10.5.1 is affected by CVE-2023-43177 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). The issue allows unauthenticated remote code execution via manipulation of dynamically determined object attributes in the web interface, enabling arbitrary file ...

CVE-2023-6038

CVE-2023-6038 describes a Local File Inclusion in the h2o-3 REST API (ImportFiles and ParseSetup endpoints). An unauthenticated attacker can read arbitrary files on the server with the h2o-3 process’s user permissions. Affected version identified in sources is 3.40.0.4. The issue is severity high...

CVE-2023-6023

VertaAI ModelDB is affected by CVE-2023-6023 (Path Traversal/LFI). The Nuclei template identifies the vulnerable endpoint as /api/v1/artifact/getArtifact?artifact_path= with no validation or sanitization of artifact_path, enabling an attacker to read arbitrary files from the server filesystem. Im...

CVE-2023-48365

CVE-2023-48365 affects Qlik Sense Enterprise for Windows. The issue arises from improper validation of HTTP headers, enabling an unauthenticated remote attacker to tunnel HTTP requests and execute them on the backend server hosting the repository application (RCE potential). This vulnerability is...

CVE-2023-36025

CVE-2023-36025 is a Windows SmartScreen Security Feature Bypass vulnerability. Affected product context is Microsoft Windows (SmartScreen). Root cause and impact are described as bypass of SmartScreen with high severity (CVSS v3.1: 8.8, HIGH) affecting confidentiality, integrity, and availability...

CVE-2023-36033

CVE-2023-36033 is a local elevation-of-privilege flaw in the Windows DWM Core Library. Reported exploits in the wild and public disclosures indicate that an attacker with low privileges and no user interaction could escalate to SYSTEM on affected Windows 10/11 and server platforms. The vulnerabil...

CVE-2023-36036

CVE-2023-36036 is a Windows Elevation of Privilege in the Windows Cloud Files Mini Filter Driver. The flaw is a local, privilege-escalation bug (privileges required: low) that can grant SYSTEM-level access and has high impact on confidentiality, integrity, and availability. Public analyses report...

CVE-2023-36424

CVE-2023-36424 is documented as a Windows kernel-level out-of-bounds read vulnerability in the Common Log File System Driver (clfs.sys) that enables privilege escalation. Connected sources describe a pool overflow/record-validation flaw in clfs.sys (Windows Kernel pool management) exploited via c...

CVE-2023-45878

Gibbon LMS

CVE-2022-45835

The CVE-2022-45835 entry concerns the WordPress PhonePe Payment Solutions plugin, affected through version 1.0.15. The vulnerability is Server-Side Request Forgery (SSRF) that allows an attacker to have the server make requests to arbitrary domains, potentially exposing internal resources or enab...

CVE-2023-39796

WBCE CMS v1.6.0 suffers an unauthenticated SQL injection in the miniform module. The flaw is exposed via the DB_RECORD_TABLE parameter and a vulnerable DELETE query in /modules/miniform/ajax_delete_message.php, allowing remote code execution and potential full database takeover. Connected sources...

CVE-2023-47426

SysAid On-Premise (pre-23.3.36) is affected by a path-traversal vulnerability in the Tomcat web service that allowed uploading a WAR archive containing a WebShell to the webroot, enabling code execution. Post-exploitation activity included MeshAgent and GraceWire tooling. Mitigation: upgrade to S...

CVE-2023-47246

CVE-2023-47246 affects SysAid On-Premise prior to 23.3.36, where improper validation of user-supplied paths enables a path traversal leading to code execution by writing a file into the Tomcat webroot. Exploited in the wild during November 2023 (Lace Tempest activity) with reports of attackers de...

CVE-2023-47248

CVE-2023-47248 affects PyArrow IPC/Parquet readers (versions 0.14.0–14.0.0); unsafe deserialization allows arbitrary code execution when processing untrusted Arrow IPC/Feather/Parquet data. The NVD entry and multiple vendor advisories (IBM, CIRCL, Nuclei template) confirm remote code execution vi...

CVE-2023-47253

Summary: CVE-2023-47253 affects Qualitor up to version 8.20, enabling unauthenticated remote code execution through PHP code in the file path html/ad/adpesquisasql/request/processVariavel.php with the gridValoresPopHidden parameter. The CVE is widely documented across NVD, Nuclei templates, and r...

CVE-2023-41348

CVE-2023-41348 affects ASUS RT-AX55 devices and is caused by insufficient filtering of special characters in the code-authentication module of the authentication-related function. An authenticated remote attacker can exploit this to perform a Command Injection , leading to arbitrary command execu...

CVE-2023-41347

The CVE-2023-41347 entry relates to ASUS RT-AX55 routers, where the authentication check token module does not properly filter special characters. This enables an authenticated remote attacker to perform a Command Injection and execute arbitrary commands, potentially disrupting the system or term...

CVE-2023-41346

CVE-2023-41346 affects ASUS RT-AX55 routers. The token-refresh/authentication-related function fails to properly filter special characters, enabling an authenticated remote attacker to perform a Command Injection and execute arbitrary commands, potentially disrupting or terminating services. The ...