CVE-2023-33193

Emby Server Authentication Bypass (CVE-2023-33193): A proxy-header spoofing flaw allows login without a password or viewing accounts if reverse-proxy headers are mishandled, affecting publicly accessible servers with weak admin login settings. Root cause: spoofed headers misclassify local/non-loc...

CVE-2023-32315

Openfire (Ignite Realtime) is affected by a path traversal vulnerability in the web-based Admin Console exposed via the unauthenticated Setup Environment, permitting access to admin pages in an already configured Openfire instance. Affected versions are Openfire releases since April 2015 starting...

CVE-2023-2825

CVE-2023-2825 is a path-traversal vulnerability in GitLab CE/EE that affects GitLab 16.0.0, allowing an unauthenticated attacker to read arbitrary server files when an attachment exists in a public project nested within at least five groups. Public PoCs and exploits available online demonstrate e...

CVE-2023-2868

CVE-2023-2868 affects Barracuda Email Security Gateway (ESG) Appliance versions 5.1.3.001–9.2.0.006. It is due to incomplete sanitization of a user-supplied .tar archive, enabling remote command execution via Perl's qx with the appliance privileges. Barracuda fixed it in patch BNSF-36456 (auto-ap...

CVE-2023-33246

CVE-2023-33246 affects Apache RocketMQ 5.1.0 and earlier. The vulnerability arises from leakage of NameServer, Broker, and Controller on the extranet with insufficient permission verification, allowing an attacker to trigger remote code execution by using the update configuration function or by f...

CVE-2023-33009

CVE-2023-33009 is a buffer-overflow vulnerability in the notification function across Zyxel firewall/NGFW families (ATP, USG FLEX, VPN, ZyWALL/USG) with affected firmware ranges roughly 4.60–5.36 Patch 1 (and ZyWALL/USG 4.60–4.73 Patch 1). An unauthenticated attacker could trigger denial-of-servi...

CVE-2023-33010

CVE-2023-33010 is a high-severity (CVSS 3.1: 9.8) buffer overflow in the ID processing function of Zyxel firewalls (ATP, USG FLEX, USG, ZyWALL/VPN) that can be exploited without authentication to cause DoS and remote code execution. Affected firmware ranges include Zyxel ATP 4.32–5.36 Patch 1, US...

CVE-2023-29919

SolarView Compact

CVE-2023-2806

CVE-2023-2806 affects Weaver e-cology up to v9.0, specifically the API component’s function RequestInfoByXml . The issue is an XML External Entity (XXE) reference caused by improper restrictions on XML links to external objects, enabling a malicious XML request to read, modify, or delete data. Mu...

CVE-2023-2745

CVE-2023-2745 — WordPress Core

CVE-2023-1698

CVE-2023-1698 refers to a remote, unauthenticated command-execution vulnerability in multiple WAGO products that use Web-based management. The issue permits an attacker to create new users and alter device configuration, potentially resulting in unintended behavior, Denial of Service, and full sy...

CVE-2023-32784

KeePass 2.x before 2.54 is vulnerable to master password exposure from memory dumps (KeePass process dumps, pagefile.sys, hibernation files, or RAM). The first character cannot be recovered, but subsequent characters may be revealed due to memory handling in KeePass. KeePass 2.54 introduces mitig...

CVE-2023-32243

CVE-2023-32243 affects the WordPress plugin Essential Addons for Elementor Lite (versions 5.4.0–5.7.1). The root cause is improper authentication that enables unauthenticated privilege escalation by abusing the password reset flow, allowing an attacker to reset an administrator’s password and tak...

CVE-2023-2648

CVE-2023-2648 affects Weaver E-Office 9.5. The vulnerability resides in /inc/jquery/uploadify/uploadify.php, where manipulating the Filedata parameter enables unrestricted file upload. This can be triggered remotely and has been publicized (VDB-228777). Connected sources additionally describe it ...

CVE-2023-30194

CVE-2023-30194 concerns Prestashop posstaticfooter

CVE-2023-24932

CVE-2023-24932 is a Secure Boot bypass vulnerability. It involves a Microsoft-signed UEFI application using the IhisiParamBuffer NVRAM variable to bypass Security2 verification, potentially allowing execution of unsigned binaries during early boot. Affected components include DT Research’s DtBios...

CVE-2023-29336

CVE-2023-29336 is a Win32k elevation-of-privilege vulnerability in Windows. Public material in the connected docs confirms a local, low-complexity exploit path that can grant SYSTEM privileges, typically via a crafted interaction with Win32k components (notably NtUserEnableMenuItem/MenuItemState ...

CVE-2023-24955

CVE-2023-24955 affects Microsoft SharePoint Server and is a remote code execution vulnerability. The CISA/KEV records describe it as a code injection flaw that can be exploited by an authenticated attacker with Site Owner privileges to execute code remotely, indicating attacker-controlled code ex...

CVE-2023-31478

GL.iNet devices prior to firmware version 3.216 are affected by CVE-2023-31478. An API endpoint (mesh status) reveals Wi‑Fi configuration data, including SSID and password, potentially enabling unauthenticated access to the wireless network. The Nuclei template and related sources corroborate thi...

CVE-2023-32235

CVE-2023-32235 affects Ghost CMS up to version 5.42.0 (pre-5.42.1). A path-traversal vulnerability in frontend/web/middleware/static-theme.js allows remote attackers to read arbitrary files within the active theme’s folder by traversing directories via /assets/built%2F..%2F..%2F/. The CVE is well...