CVE-2023-36258

LangChain prior to 0.0.236 is affected by CVE-2023-36258, enabling an attacker to execute arbitrary Python code via os.system, eval, or exec. The issue affects LangChain’s Python usage and the root cause relates to unsafe code execution functions; updating to 0.0.236 or later is recommended to re...

CVE-2023-36144

Intelbras Switch SG 2404 MR (firmware 1.00.54) is affected by an authentication bypass that lets an unauthenticated attacker download the device backup file, exposing configuration data (credentials, network settings). The vulnerability is documented across multiple sources (CVE-2023-36144) with ...

CVE-2023-21237

CVE-2023-21237 affects Android Framework UI logic in NotificationContentInflater.java (applyRemoteView) that can hide a foreground service notification due to misleading or insufficient UI, enabling local information disclosure without extra privileges. Public sources confirm impact on Android 13...

CVE-2023-36661

CVE-2023-36661 affects Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider. The underlying issue is a server-side request forgery (SSRF) via a crafted KeyInfo element in XML signatures. This yields unauthenticated SSRF risk with impact on availability (per CVE ...

CVE-2023-32409

CVE-2023-32409 is a WebKit sandbox-escape vulnerability in WebKit’s handling of web content. The issue allowed a remote attacker to break out of the Web Content sandbox and was addressed by improved bounds checks. Fixes are included in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iP...

CVE-2023-32373

CVE-2023-32373 is a use-after-free in WebKitGTK/WebKit related to processing malicious web content. Connected advisories confirm this vulnerability affects WebKitGTK/WebKit components and note exploitation activity. The issue is fixed in WebKitGTK/WebKit updates (e.g., webkitgtk4 packages) across...

CVE-2023-32435

CVE-2023-32435 is a memory corruption vulnerability in WebKit-based components affecting Apple platforms. The connected sources specify that processing web content could lead to arbitrary code execution and that the issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, and ...

CVE-2023-28204

CVE-2023-28204 is an out-of-bounds read in WebKit caused by improper input handling while processing web content. It affects WebKit-based components and was fixed in multiple vendor advisories: Apple updates (watchOS/macOS/iOS/iPadOS/Safari) and WebKitGTK/WPE WebKit packages (e.g., webkitgtk4 2.3...

CVE-2023-32439

CVE-2023-32439 is a type confusion vulnerability in Apple’s WebKit used by iOS, iPadOS, macOS and Safari. The issue allows arbitrary code execution when processing malicious web content and is fixed in iOS 16.5.1/iPadOS 16.5.1, iOS 15.7.7/iPadOS 15.7.7, macOS Ventura 13.4.1, and Safari 16.5.1. Ea...

CVE-2023-32434

CVE-2023-32434 is an Apple kernel vulnerability in the XNU VM layer causing an integer overflow that could allow an app to execute code with kernel privileges. Public documentation confirms fixed in multiple OS versions (watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 / iPadOS 15.7.7, macOS Monte...

CVE-2023-30258

CVE-2023-30258 affects MagnusBilling magnusbilling 6.x and 7.x with an unauthenticated remote command injection in lib/icepay/icepay.php via the democ parameter. An attacker can craft a request to run arbitrary OS commands, enabling full system compromise as indicated by connected templates and e...

CVE-2023-2533

CVE-2023-2533 affects PaperCut NG/MF with a CSRF vulnerability that could allow an attacker to alter security settings or, under certain conditions, execute arbitrary code. Exploitation requires an admin with an active session and typically involves luring the admin to click a crafted link. Nessu...

CVE-2023-35885

CloudPanel 2.x versions before 2.3.1 are vulnerable due to insecure file-manager cookie authentication, enabling remote code execution as root (CVSS 3.1: 9.8). Public disclosures and proof-of-concept tooling exist (Nuclei template for CVE-2023-35885; GitHub exploit). Affected product: CloudPanel;...

CVE-2023-27992

CVE-2023-27992 affects Zyxel NAS326 (firmware before V5.21(AAZF.14)C0), NAS540 (before V5.21(AATB.11)C0), and NAS542 (before V5.21(ABAG.11)C0). It is a pre-authentication command-injection vulnerability allowing an unauthenticated attacker to remotely execute OS commands via crafted HTTP requests...

CVE-2023-2359

CVE-2023-2359 affects the Slider Revolution WordPress plugin up to version 6.6.12. The vulnerability arises from not validating image files on import, enabling an arbitrary file upload that may lead to Remote Code Execution in certain server configurations. Affected component: Slider Revolution p...

CVE-2023-35844

Lightdash

CVE-2023-35813

Sitecore CVE-2023-35813 affects Experience Manager, Experience Platform, and Experience Commerce up to version 10.3. The root cause is remote code execution via the XAML parser triggered by injecting malicious ASP.NET markup, enabling unauthenticated arbitrary code execution on Sitecore servers a...

CVE-2023-30625

Rudder-server (RudderStack CDP) prior to version 1.3.0-rc.1 is affected by an SQL injection that can lead to remote code execution because the postgres user rutde_rudder is granted superuser privileges by default. Affected component: rudder-server in RudderStack; vulnerability is triggered via SQ...

CVE-2023-34659

CVE-2023-34659 affects Jeecg-Boot 3.5.0 and 3.5.1. The vulnerability is a SQL injection in the id parameter of the /jeecg-boot/jmreport/show interface, caused by improper input handling (CWE-89). Impact per sources includes potential arbitrary SQL execution, data leakage or manipulation. Remediat...

CVE-2023-30150

CVE-2023-30150 affects PrestaShop’s leocustomajax module (versions 1.0 and 1.0.0). The connected documents describe a SQL Injection vulnerability that exploitable via the file path modules/leocustomajax/leoajax.php, caused by unsafely constructed SQL in that endpoint. Impact is severe (consequenc...