4076 matches found
CVE-2023-34127
CVE-2023-34127 describes an OS Command Injection in SonicWall GMS and SonicWall Analytics. An authenticated attacker can execute arbitrary code with root privileges. Affected products/versions: SonicWall GMS 9.3.2-SP1 and earlier; SonicWall Analytics 2.5.0.4-R7 and earlier. The available descript...
CVE-2023-34126
CVE-2023-34126 describes a vulnerability in SonicWall GMS and Analytics where an authenticated attacker can upload files to the underlying filesystem with root privileges. Root cause: insufficient restrictions on uploaded files. Affected versions are SonicWall GMS 9.3.2-SP1 and earlier, and Analy...
CVE-2023-34125
CVE-2023-34125 describes a path traversal vulnerability in SonicWall’s Global Management System (GMS) and Analytics. An authenticated attacker could read arbitrary files from the underlying filesystem with root privileges by exploiting directory-path restrictions. Affected versions include SonicW...
CVE-2023-34124
CVE-2023-34124 affects SonicWall Global Management System (GMS) and Analytics Web Services. The root cause is insufficient authentication checks that allow bypass, impacting GMS versions up to 9.3.2-SP1 and Analytics up to 2.5.0.4-R7 and earlier. The issue enables unauthorized access; multiple co...
CVE-2023-34123
CVE-2023-34123 describes a hard-coded cryptographic key vulnerability in SonicWall GMS (versions up to 9.3.2-SP1) and SonicWall Analytics (up to 2.5.0.4-R7). Connected PT-Security advisory notes the issue and recommends upgrading to fixed builds; The THN and NCSC/NV references indicate fixes exis...
CVE-2023-29300
CVE-2023-29300 is an Adobe ColdFusion deserialization of untrusted data vulnerability affecting ColdFusion 2018u16 and earlier, 2021u6 and earlier, and 2023.0.0.330468 and earlier. The flaw allows arbitrary code execution without user interaction, via a network vector (CVSS v3.1: AV:N/AC:L/PR:N/U...
CVE-2023-29298
Adobe ColdFusion is affected by CVE-2023-29298, a unauthenticated Improper Access Control vulnerability that could bypass security features to reach the administration CFM/CFC endpoints. Affected versions include ColdFusion 2018u16 and earlier, 2021u6 and earlier, and 2023.0.0.330468 and earlier....
CVE-2023-36884
CVE-2023-36884 is a Windows/Office RCE via Windows Search (.search-ms) triggered by specially crafted OOXML documents; active exploitation was noted (Storm-0978 campaign) and Microsoft released a patch/Defense in Depth mitigations in August 2023 to break the exploitation chain. Public PoCs/exploi...
CVE-2023-35311
Technical details about CVE-2023-35311 are not publicly available in the provided connected documents. The sources confirm a Microsoft Outlook security feature bypass but do not specify root cause, affected versions, or fixes. Monitor for updates.
CVE-2023-36874
CVE-2023-36874 is a Windows Error Reporting Service privilege-escalation vulnerability. The root cause described in the sources is a filesystem/relative-path handling flaw: WER may invoke wermgr.exe using a relative path and does not validate symbolic links, allowing a non-system executable to be...
CVE-2023-32049
CVE-2023-32049 is a Windows SmartScreen Security Feature Bypass vulnerability. The issue allows an attacker to bypass the Open File - Security Warning prompt by convincing a user to click a specially crafted URL, enabling potential code execution on the affected system. Public sources indicate ac...
CVE-2023-32046
CVE-2023-32046 is a Windows MSHTML Platform Elevation of Privilege vulnerability. The MSHTML engine (used by Windows, Office, Outlook, etc.) contains a flaw that enables local privilege escalation when a user opens a specially crafted file delivered via email or web page. Exploitation requires us...
CVE-2023-3608
CVE-2023-3608 affects Ruijie BCR810W 2.5.10, specifically the Tracert Page component, with OS command injection as the underlying issue. Multiple connected sources corroborate remote-exploitation potential and public disclosure. JVNDB notes exploitation attempts and identifies a fix: firmware BCO...
CVE-2023-24489
Summary of CVE-2023-24489 : A vulnerability in Citrix ShareFile StorageZones Controller (customer-managed) allows unauthenticated remote compromise due to improper access control. CVSS v3.1 base score 9.8 (CRITICAL) with network attack vector, no user interaction, and high impact to confidentiali...
CVE-2023-24488
CVE-2023-24488 is a cross-site scripting vulnerability affecting Citrix ADC and Citrix Gateway. Public data show that versions before 13.1 and the listed sub-versions (13.1-45.61, 13.0-90.11, 12.1-65.35) contain a flaw due to improper input/URL parameter validation that can cause script execution...
CVE-2023-3606
TamronOS (IPTV) contains a remote OS command injection in the /api/ping endpoint, caused by manipulation of the host parameter. Affects TamronOS versions up to 20230703; exploitation can be remote and the vulnerability has been publicly disclosed (CVE-2023-3606). The CVE entry notes no fix detail...
CVE-2023-2796
The EventON WordPress plugin (before 2.1.2) has a vulnerability in the eventon_ics_download AJAX action that lacks authentication/authorization, allowing unauthenticated visitors to access private and password-protected events by guessing the numeric event_id. Impact is unauthorized access to eve...
CVE-2023-34192
CVE-2023-34192 affects Zimbra Collaboration Suite (ZCS) v8.8.15. A cross-site scripting (XSS) vulnerability exists in the /h/autoSaveDraft function that an authenticated remote attacker can exploit by sending a crafted script, allowing arbitrary script execution in the victim’s browser and potent...
CVE-2023-36934
MOVEit Transfer web application (versions 12.1.11, 13.0.9, 13.1.7, 14.0.7, 14.1.8, 15.0.4 and earlier) is affected by a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit database by sending a crafted payload to an application endpoi...