CVE-2023-45727

CVE-2023-45727 affects Proself Enterprise/Standard Edition v5.62 and earlier, Proself Gateway Edition v1.65 and earlier, and Proself Mail Sanitize Edition v1.08 and earlier. A remote unauthenticated attacker can trigger an XML External Entity (XXE) processing flaw by sending carefully crafted XML...

CVE-2023-20598

The CVE concerns the AMD Radeon graphics driver where improper privilege management (insufficient access control) in IOCTL handling could allow an authenticated attacker to craft IOCTLs to access arbitrary hardware ports or physical addresses, potentially enabling arbitrary code execution. The is...

CVE-2023-20198

Cisco IOS XE Web UI vulnerabilities CVE-2023-20198 and CVE-2023-20273 allow authenticated attackers to escalate to root via the Web UI due to input validation weaknesses, enabling privilege escalation and potential remote code execution. Cisco has released fixed builds: 17.3.8a (for the 17.3 trai...

CVE-2023-45852

The CVE describes a remote code execution in Viessmann Vitogate 300 (version 2.1.3.0 and earlier) through /cgi-bin/vitogate.cgi. An unauthenticated attacker can bypass authentication and execute arbitrary commands by injecting shell metacharacters in the ipaddr field of the JSON data in a PUT req...

CVE-2023-39999

CVE-2023-39999 in WordPress Core enables exposure of sensitive information to an unauthorized actor across multiple versions (from 4.x to 6.3.x ranges listed). Connected advisories confirm vendors issued security updates and patches (e.g., WordPress 6.3.2 and later for WordPress Core; Debian book...

CVE-2023-32645

CVE-2023-32645 concerns Yifan YF325, v1.0_20221108, where a leftover httpd debug credentials feature enables authentication bypass via a crafted network request. The issue is reported as remote, with CVSS v3.1 base score 9.8 (CRITICAL; Network access, no user interaction; confidentiality, integri...

CVE-2023-36434

Technical details about CVE-2023-36434 are not provided in the connected documents. The materials mention the vulnerability in Windows IIS (Elevation of Privilege) but do not disclose affected products, root cause, exploit info, or fixes. Monitor for updates.

CVE-2023-36563

CVE-2023-36563 refers to a Microsoft WordPad Information Disclosure vulnerability. The connected materials confirm that exploitation could disclose NTLM hashes when a user opens a specially crafted file or if an attacker has access to the host, with signs of exploitation in the wild cited by Patc...

CVE-2023-36584

CVE-2023-36584 concerns a Windows Mark of the Web (MOTW) security feature bypass vulnerability. The MOTW bypass can cause a limited loss of integrity and availability of security features, as described by CISA KEV entries. The vulnerability is listed among known exploited vulnerabilities catalog ...

CVE-2023-41763

CVE-2023-41763 refers to an elevation of privilege vulnerability in Microsoft Skype for Business Server. The HackerOne report notes the Skype for Business installation on a remote host was missing security updates and that the flaw was actively exploited, enabling attackers to access some sensiti...

CVE-2023-34993

Fortinet FortiWLM is affected by an OS command injection in FortiWLM 8.6.0–8.6.5 and 8.5.0–8.5.4 due to improper neutralization of command elements. An unauthenticated attacker can remotely execute arbitrary commands by crafting specific HTTP GET parameters, potentially bypassing authentication a...

CVE-2023-4966

CVE-2023-4966 affects Citrix NetScaler ADC and NetScaler Gateway when configured as a Gateway or AAA virtual server. The issue stems from improper usage of snprintf/memory handling in the WebProc/auth pathways, causing memory disclosure via crafted responses and exposing sensitive data (e.g., aut...

CVE-2023-44487

CVE-2023-44487 – HTTP/2 Rapid Reset DoS Root cause: HTTP/2 stream resets can cause servers to continue processing, leading to unbounded resource consumption and potential DoS when clients rapidly cancel streams. What’s affected: Various HTTP/2 implementations and deployments, including servers, p...

CVE-2023-44467

LangChain Experimental (langchain_experimental) in LangChain versions before 0.0.306 is documented to bypass the prior CVE-2023-36258 fix and enable arbitrary code execution via import in Python code, not prohibited by pal_chain/base.py. Nessus notes even older builds (

CVE-2023-45311

CVE-2023-45311 affects fsevents releases prior to 1.2.11. The vulnerability arises because fsevents depends on the external URL fsevents-binaries.s3-us-west-2.amazonaws.com; if code distributed via that URL was obtained when the URL was controlled by an adversary, an attacker could execute arbitr...

CVE-2023-42824

CVE-2023-42824 is a kernel local privilege-escalation vulnerability in Apple iOS/iPadOS. The issue allows a local attacker to elevate privileges; Apple notes it may have been actively exploited on versions before iOS 16.6. It was addressed with improved checks and is fixed in iOS 16.7.1 and iPadO...

CVE-2023-22515

CVE-2023-22515 affects Atlassian Confluence Data Center and Server. The issue is a broken access control vulnerability that enables an unauthenticated attacker to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected, and ins...

CVE-2023-4911

CVE-2023-4911 is a buffer overflow in the GNU C Library ld.so when processing GLIBC_TUNABLES, enabling local privilege escalation via malicious GLIBC_TUNABLES values when launching binaries with SUID. Affected: glibc, with versions older than 2.38-6 (per CBLMARINER:34733) and older listings notin...

CVE-2023-4211

CVE-2023-4211 affects the Arm Mali GPU Kernel Driver. The issue is a use-after-free/resource management error in the Mali driver that allows a local, non-privileged user to perform improper GPU memory processing and access freed memory. Impact is limited to confidentiality (high impact) with no d...

CVE-2023-5285

CVE-2023-5285 concerns Tongda OA 2017. The vulnerability affects the file general/hr/recruit/recruitment/delete.php where manipulation of the RECRUITMENT_ID parameter enables SQL injection. Exploitation can be performed remotely, and public disclosure of the exploit is noted in the sources. A fix...