CVE-2023-38205

CVE-2023-38205 affects Adobe ColdFusion: versions 2018u18 and earlier, 2021u8 and earlier, and 2023u2 and earlier are vulnerable to an Improper Access Control flaw that enables an unauthenticated attacker to bypass security and access the administration CFM/CFC endpoints without user interaction....

CVE-2023-41011

CVE-2023-41011 describes a high-severity command-execution vulnerability in China Mobile Intelligent Home Gateway (model v.HG6543C4). The flaw resides in the shortcut_telnet.cg component, enabling a remote attacker to run arbitrary code. CVSS 3.1 base score is 9.8 (CRITICAL) with network attack v...

CVE-2023-41892

CVE-2023-41892 affects Craft CMS Versions 4.0.0-RC1 through 4.4.14. The vulnerability is an unauthenticated remote code execution (RCE) caused by a PHP object creation in the craft\controllers\ConditionsController that can escalate to arbitrary PHP code execution (context involves GuzzleHttp\Psr7...

CVE-2023-26369

Adobe Acrobat/Reader CVE-2023-26369 is an out-of-bounds write vulnerability that can enable arbitrary code execution in the context of the current user. Affected are Acrobat Reader 23.003.20284 and earlier, 20.005.30516 and earlier, and 20.005.30514 and earlier. Exploitation requires user interac...

CVE-2023-3710

The CVE-2023-3710 entry affects Honeywell PM43 printers (32‑bit ARM) and is due to Improper Input Validation in the printer web page modules, enabling Command Injection. Affected versions are PM43 before P10.19.050004; mitigation is to update to MR19.5 (e.g., P10.19.050006) or later firmware that...

CVE-2023-36761

CVE-2023-36761 is a Microsoft Word information disclosure vulnerability. Connected sources note exploitation in the wild and indicate NTLM relay as a possible attack outcome. Affected products include various Word/Office deployments (Microsoft Word/Office suite). The vulnerability is being tracke...

CVE-2023-36802

CVE-2023-36802 is an Elevation of Privilege vulnerability in the Microsoft Streaming Service Proxy (MSKSSRV.SYS). The connected documents identify the root cause as an object type confusion in the Windows kernel-mode driver, enabling local privilege escalation to SYSTEM on vulnerable Windows 10/1...

CVE-2023-4863

CVE-2023-4863 describes a heap buffer overflow in libwebp used by Google Chrome prior to 116.0.5845.187 and in libwebp 1.3.2. A remote attacker can cause an out-of-bounds memory write by presenting a crafted HTML page. The vulnerability is exploitable over the network and requires user interactio...

CVE-2023-41990

The CVE-2023-41990 issue affects Apple platforms (iOS, iPadOS, macOS, tvOS, watchOS) and was triggered by processing a font file, with the root cause tied to cache handling. It can lead to arbitrary code execution and is rated high severity (local access, user interaction required) per the report...

CVE-2023-35674

The CVE-2023-35674 issue affects the Android Framework, specifically an onCreate path in WindowState.java that can launch a background activity due to a logic error. This enables local elevation of privilege without extra execution privileges and without user interaction. The Android Security Bul...

CVE-2023-39780

CVE-2023-39780 affects ASUS RT‑AX55 devices (firmware 3.0.0.4.386.51598) where an authenticated attacker can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. The CVSSv3.1 base score is 8.8 (HIGH) with Network attack vector, Low attack complexity, Privileges Require...

CVE-2023-41064

CVE-2023-41064 (ImageIO WebP bug) is an Apple WebP decoding buffer-overflow vulnerability that enables arbitrary code execution via a malicious image. The CVE was fixed in iOS/iPadOS 16.6.1 and macOS updates (Monterey 12.6.9, Ventura 13.5.2, and other listed releases). Connected analysis details ...

CVE-2023-41061

CVE-2023-41061 is an Apple Wallet code execution vulnerability tied to parsing of PassKit attachments. The CVE’s context in the provided sources shows exploitation potential via a malicious PassKit attachment containing crafted images (notably WebP/MakerNote data) that triggers a heap/grooming se...

CVE-2023-20263

CVE-2023-20263 affects Cisco HyperFlex HX Data Platform, specifically the web-based management interface. The issue arises from improper input validation of HTTP request parameters, enabling an unauthenticated, remote attacker to persuade a user to click a crafted link and potentially redirect th...

CVE-2023-20269

Cisco ASA/FTD remote access VPN vulnerability CVE-2023-20269 allows an unauthenticated, remote attacker to perform brute force against credentials or, for older releases (

CVE-2023-37941

CVE-2023-37941 affects Apache Superset where an attacker with write access to the metadata database can persist a crafted Python object to achieve remote code execution on the web backend. The vulnerability hinges on the metadata DB, an internal component, being accessible with significant privil...

CVE-2023-39265

CVE-2023-39265 : Multiple connected documents describe a vulnerability in Apache Superset where SQLite database connections can be registered incorrectly when using alternative driver names (e.g., sqlite+pysqlite) or via database imports. This may allow arbitrary file creation on Superset webserv...

CVE-2023-4634

Summary of CVE-2023-4634 : The WordPress plugin Media Library Assistant (versions up to 3.09, fixed in 3.10) is vulnerable to Local File Inclusion and Remote Code Execution due to insufficient validation of file paths passed to the mla_stream_file parameter in includes/mla-stream-image.php, where...

CVE-2023-4762

CVE-2023-4762 is a Type Confusion in V8 affecting Google Chrome/Chromium prior to 116.0.5845.179 that allows remote code execution via a crafted HTML page. The vulnerability is documented in multiple sources (Chrome/Chromium release notes; Debian security advisory stating fixes in 116.0.5845.180 ...

CVE-2023-39361

CVE-2023-39361 affects Cacti (notably 1.2.24) via a SQL injection in graph_view.php. The vulnerability arises when guest users can access graph_view.php without authentication, enabling an attacker to inject SQL through the rfilter parameter (within the grow_right_pane_tree path) and potentially ...