CVE-2023-41345

The CVE-2023-41345 issue affects ASUS RT-AX55 devices in the token-generated authentication flow. The vulnerability is described as insufficient filtering of special characters within the token-generated module, allowing an authenticated remote attacker to perform a Command Injection attack to ex...

CVE-2023-22518

CVE-2023-22518 (Confluence DC/Server): An improper authorization vulnerability allowed an unauthenticated attacker to reset Confluence and create an instance administrator, enabling full admin control and potential data loss. Affected products include Confluence Data Center (all versions) and Con...

CVE-2023-5360

CVE-2023-5360 affects the WordPress plugin Royal Elementor Addons and Templates, specifically versions before 1.3.79. The vulnerability is an unauthenticated arbitrary file upload flaw in the upload handling (AJAX endpoint at /wp-admin/admin-ajax.php) that allows an attacker to upload files (e.g....

CVE-2023-24000

CVE-2023-24000 affects the WordPress GamiPress plugin up to version 2.5.7. Root cause: insufficient escaping of user-supplied input and inadequate SQL statement preparation, enabling unauthenticated SQL injection. Impact: attackers can append or inject additional SQL into existing queries to extr...

CVE-2023-5830

ColumbiaSoft Document Locator WebTools login endpoint /api/authentication/login is affected by an improper authentication vulnerability (CVE-2023-5830) in versions prior to 7.2 SP4 and 2021.1. Root cause: manipulation of the Server argument leads to improper authentication. Impact: remote attacke...

CVE-2023-46604

CVE-2023-46604 – Apache ActiveMQ OpenWire deserialization RCE has concrete details in connected sources: the Java OpenWire protocol marshaller is vulnerable to remote code execution. A remote attacker with network access to a Java-based OpenWire broker or client can execute arbitrary shell comman...

CVE-2023-46748

CVE-2023-46748 is an authenticated SQL injection vulnerability in F5 BIG-IP’s Configuration utility. An attacker with network access via the BIG-IP management port and/or self IPs can execute arbitrary system commands through the vulnerable Configuration utility. Affected BIG-IP versions include ...

CVE-2023-46747

CVE-2023-46747 is an unauthenticated remote code execution flaw in F5 BIG-IP TMUI (management port/self IP). Public linked PoCs/exploits demonstrate unauthenticated RCE by targeting TMUI to create or leverage a user/token flow and execute commands on vulnerable devices; CVSS v3.1 = 9.8 (CRITICAL)...

CVE-2023-43208

NextGen Healthcare Mirth Connect (before 4.4.1) is affected by a deserialization of untrusted data vulnerability that allows unauthenticated remote code execution. Root cause: an incomplete patch of CVE-2023-37679 left a gadget chain bypassing the original deny list, enabling RCE via crafted HTTP...

CVE-2023-34056

CVE-2023-34056 affects VMware vCenter Server, with a partial information disclosure vulnerability where a remote attacker with non-administrative privileges can access data they should not see. Affected versions are vCenter Server 7.0 before 7.0U3o and 8.0 before 8.0U2. The root cause is improper...

CVE-2023-34048

CVE-2023-34048 affects VMware vCenter Server and Cloud Foundation via an out-of-bounds write in the DCERPC implementation that can lead to remote code execution when a attacker with network access sends a crafted request. The vulnerability is rated CVSS v3.1 base score 9.8 (CRITICAL) with network...

CVE-2023-46347

The CVE-2023-46347 entry concerns the PrestaShop module ndk_steppingpack (Step by Step products Pack) up to version 1.5.6. Affected component: NdkSpack::getPacks() performs sensitive SQL calls, enabling unauthenticated SQL injection via a trivial HTTP request. Impact is high (CVE metrics list Con...

CVE-2023-43795

CVE-2023-43795 concerns GeoServer, where the Web Processing Service (WPS) vulnerability allows unauthenticated SSRF via GET/POST requests. The issue stems from how WPS processes external URLs, enabling an attacker to make arbitrary HTTP requests and reach internal resources. Patched in GeoServer ...

CVE-2023-20273

CVE-2023-20273 concerns Cisco IOS XE Software Web UI. A vulnerability in the Web UI input validation allows an authenticated, remote attacker to inject commands with root privileges, potentially compromising the underlying OS. CVSS v3.1 base score 7.2 (HIGH); attack vector NETWORK, privileges req...

CVE-2023-46574

The vulnerability CVE-2023-46574 affects TOTOLINK A3700R (v9.1.2u.6165_20211012). Affected component: UploadFirmwareFile function; root cause: lack of input sanitization in the FileName parameter, enabling remote code execution by an unauthenticated attacker. Impact: remote execution leading to f...

CVE-2023-45802

CVE-2023-45802 describes a memory‑leak condition in HTTP/2 handling: when a client resets a stream, memory deallocation is deferred until connection close, allowing a connection to accumulate memory usage over time. Astra Linux security notes reproduce the issue description and cite a fix in Apac...

CVE-2023-5683

CVE-2023-5683 affects Byzoro Smart S85F Management Platform (up to 20231010). The vulnerability stems from processing /sysmanage/importconf.php and specifically the btn_file_renew parameter, which enables an OS command injection. The description indicates remote initiation potential and public di...

CVE-2023-38192

CVE-2023-38192: SuperWebMailer 9.00.0.01710 contains a cross-site scripting (XSS) flaw in superadmincreate.php that can be triggered by crafted incorrect passwords. The issue is documented as an XSS risk with potential impact including unauthorized access or data theft per related sources. The pr...

CVE-2023-46229

LangChain before 0.0.317 is affected by an SSRF in document_loaders/recursive_url_loader.py, enabling crawling from an external server to an internal server. The issue impacts the LangChain Python library (

CVE-2023-5631

CVE-2023-5631 affects Roundcube Webmail. The issue is a stored XSS via an HTML e-mail message containing a crafted SVG, caused by logic in Roundcube’s rcube_washtml.php. Affected versions are Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4. Successful exploitation could allow ...