CVE-2023-4613

LG LED Assistant is affected by CVE-2023-4613, a path traversal vulnerability in the /api/settings/upload endpoint. The flaw stems from inadequate validation of a user-supplied path used in file operations, enabling remote attackers to execute arbitrary code in the current user context. Public de...

CVE-2023-30683

CVE-2023-30683 is an improper access-control issue affecting Samsung Mobile devices (Telecom stack) where a local attacker can call the endCall API without permission. Connected sources corroborate the Samsung patch context: the vulnerability is listed among fixes in Samsung’s SMR Aug-2023 Releas...

CVE-2023-3300

HashiCorp Nomad and Nomad Enterprise expose a vulnerability (CVE-2023-3300) where the HTTP search API can reveal names of available CSI plugins to unauthenticated users or those without the plugin:read policy. Affected versions are Nomad/Nomad Enterprise 0.11.0 through 1.5.6 and 1.4.1. The issue ...

CVE-2024-56690

CVE-2024-56690 : Linux kernel crypto: pcrypt fix for -EBUSY/-EAGAIN. After commit 8f4f68e7, padata_do_parallel() may return -EAGAIN for pcrypt encrypt/decrypt when CPUs go online/offline, triggering a WARN/panic under panic_on_warn. The remediation is to call the crypto layer directly (no paralle...

CVE-2023-41301

CVE-2023-41301 describes a vulnerability in the PMS module enabling unauthorized API access, with exploitation potentially causing features to behave abnormally. The NVD entry lists a CVSS v3.1 base score of 7.5 (HIGH), with network attack vector, no privileges required, no user interaction, and ...

CVE-2023-4616

CVE-2023-4616 concerns a path traversal in LG LED Assistant’s /api/thumbnail endpoint. The vulnerability stems from insufficient validation of a user-supplied path before performing file operations, enabling an unauthenticated attacker to read sensitive information in the context of the current u...

CVE-2023-37916

CVE-2023-37916: KubePi (github.com/KubeOperator/kubepi) had a leak in /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 that exposed password hashes for any user (including admin). The root cause is a leaking endpoint returning password hashes; no workaround is documented. The issue has been fix...

CVE-2023-5296

The CVE-2023-5296 entry applies to Xinhu RockOA (versions 1.1–2.3.2 and 15.X3amdi) and concerns the Password Handler component. Affected functionality is within api.php?m=reimplat&a=index, where manipulation enables weak password recovery. The issue is exploitable remotely and can impact confiden...

CVE-2023-20223

CVE-2023-20223 affects Cisco DNA Center. Affected component: Cisco DNA Center API with insufficient access control, enabling an unauthenticated remote attacker to read/modify data in an internal service repository via crafted API requests. Impact: data exposure and modification on the device; no ...

CVE-2023-31012

CVE-2023-31012 affects NVIDIA DGX H100 BMC: the REST service suffers from improper input validation in the BMC REST interface, enabling potential privilege escalation and information disclosure. CVSSv3.1 base score 8.8 (HIGH) per NVD; Red Hat, NVD and NVIDIA bulletins corroborate issues tied to t...

CVE-2023-3264

CVE-2023-3264 affects CyberPower PowerPanel Enterprise DCIM (and is listed with a CVSS 3.1 vector of 6.7). The vulnerability is described as Use of Hard-coded Credentials, enabling authentication bypass in the CyberPower PowerPanel Enterprise component. The Trellix/TRELLIX blog and related Red Ha...

CVE-2023-2850

CVE-2023-2850 affects NodeBB and is a Cross-Site WebSocket Hijacking vulnerability caused by missing validation of the request origin. The issue can lead to leakage of certain user information. Publicly documented details identify affected NodeBB lines as NodeBB 2.x before 2.8.13 and 3.x before 3...

CVE-2025-32728

CVE-2025-32728 affects OpenSSH sshd prior to 10.0: the DisableForwarding directive does not fully disable X11 and agent forwarding as documented, potentially enabling unintended access under certain configurations. Multiple advisories indicate OpenSSH vulnerabilities across platforms (AIX, Amazon...

CVE-2023-2848

Movim prior to version 0.22 is affected by a Cross‑Site WebSocket Hijacking vulnerability due to missing header validation. This is documented across multiple sources (NVD entry confirms the issue and impact; connected references point to Movim commits related to the vulnerability). Affected comp...

CVE-2023-36635

CVE-2023-36635 concerns Fortinet FortiSwitchManager. Affected: FortiSwitchManager versions 7.2.0–7.2.2 and 7.0.0–7.0.1. Root cause: improper access control allowing a remote authenticated read-only user to modify interface settings via the API. Impact: ability to alter interface configurations (a...

CVE-2023-39394

CVE-2023-39394 describes an API privilege-escalation vulnerability in Huawei HarmonyOS’s wifienhance module. According to the NVD entry, successful exploitation could allow modification of the ARP list, implying impact to ARP cache integrity (high with I:H, network attack vector, no user interact...

CVE-2023-38691

CVE-2023-38691 affects matrix-appservice-bridge. The issue: the bridge does not verify that the servername in the OpenID sub claim matches the target server, allowing a malicious Matrix server to impersonate users via the provisioning API. Affected versions are 4.0.0 up to 8.1.1 and 9.0.0; patch ...

CVE-2023-38503

Directus (real-time API/dashboard for SQL data) has an authentication/authorization flaw in GraphQL subscriptions. From version 10.3.0 up to, but not including, 10.5.0, permission filters like user_created IS $CURRENT_USER are not properly enforced for subscription events, allowing unauthorized u...

CVE-2023-3076

CVE-2023-3076 affects the MStore API WordPress plugin (pre-3.9.9). The wholesale REST API endpoint allows unauthenticated visitors to create user accounts with a role of their choice, enabling privilege escalation, and this attack is conditioned on the site owner purchasing pro features. The NVD/...

CVE-2023-31718

CVE-2023-31718 affects the open-source web-based visualization tool FUXA up to version 1.1.12 . The vulnerability is described as a Local File Inclusion via the endpoint /api/download . The connected documents confirm the affected product and the specific attack vector, but do not provide concret...

CVE-2023-31011

CVE-2023-31011 affects NVIDIA DGX H100 BMC REST service due to improper input validation in the REST interface. The Red Hat advisory and NVIDIA security bulletin confirm the root cause is input validation weaknesses, enabling an attacker to escalate privileges and disclose information. The issue ...

CVE-2023-30684

Samsung Telecom contains an improper access control vulnerability that allows local attackers to call acceptRingingCall without permission on versions prior to SMR Aug-2023 Release 1. The issue is described across multiple sources (including PT-2023-22882) as a local-privilege concern affecting S...

CVE-2023-30682

The CVE-2023-30682 issue affects Samsung Telecom prior to SMR Aug-2023 Release 1, caused by improper access control that allows a local attacker to call the silenceRinger API without permission. The vulnerability is pursued within Samsung’s patch track for SMR Aug-2023 Release 1, with remediation...

CVE-2023-37497

Summary: CVE-2023-37497 affects the HCL Unica Platform API that accepts arbitrary XML. The root cause is vulnerability to XML External Entity (XXE) processing, enabling an authenticated attacker with certain privileges to perform XXE against the backend. Documents indicate high-severity impact ( ...

CVE-2023-26449

CVE-2023-26449 affects Open-Xchange AppSuite’s OX Chat web service, where not specifying a media-type when handling responses from external resources enables potential cross-site script execution within the victim’s context. This could lead to session hijacking or unauthorized actions via the web...

CVE-2023-38489

CVE-2023-38489 – Kirby Insufficient Session Expiration (modeled across multiple sources) Kirby CMS versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 are affected. The vulnerability arises because old sessions were not invalidated when a user’s password was changed, allowing a previo...

CVE-2022-46902

CVE-2022-46902 relates to Vocera Report Server/Voice Server 5.x–5.8. The issue is a path traversal vulnerability in an unzip operation used during a ZIP-based database restore via the Vocera Report Console’s websocket function. During extraction, the code uses file paths from the ZIP without suff...

CVE-2024-27040

CVE-2024-27040 concerns a NULL pointer dereference in the Linux kernel DRM AMD display code. Specifically, edp_set_replay_allow_active() may dereference replay when replay is NULL after the conditional that checks replay in the first if. The vulnerability occurs if link->replay_settings.replay...

CVE-2023-31719

CVE-2023-31719 affects FUXA versions ≤ 1.1.12, with a SQL Injection vulnerability exploitable via the /api/signin endpoint. The Red Hat, GHSA, and OSV listings corroborate the same flaw and its association to FUXA’s signin API. The core impact is high (CVE metrics show P t high across confidentia...

CVE-2023-41317

Summary. CVE-2023-41317 affects Apollo Router (Rust) v1.28.0, v1.28.1, and v1.29.0, where an anonymous GraphQL subscription can trigger a DoS panic if the supergraph defines a subscription type and subscriptions are enabled in config. The vulnerability requires all four conditions to be met: impa...

CVE-2023-38422

CVE-2023-38422 affects Walchem Intuition 9 firmware versions prior to v4.21. The issue is missing authentication for some API routes of the management web server, allowing an attacker to download/export sensitive data. CVSS v3 base score is 7.5 (Network, Low complexity, No privileges required). M...

CVE-2023-0551

The CVE CVE-2023-0551 affects the WordPress plugin REST API TO MiniProgram (through 4.6.1). The vulnerability is due to missing authorization checks and CSRF protection in an AJAX action, allowing any authenticated user (e.g., subscriber) to call and delete arbitrary attachments. Connected source...

CVE-2023-26440

CVE-2023-26440 concerns the Open-Xchange AppSuite cacheservice API, where parameters could be injected with SQL syntax due to insufficient sanitization when creating new cache groups. The vulnerability allows attackers with access to a local or restricted network to perform arbitrary SQL queries....

CVE-2023-26439

The CVE-2023-26439 issue affects the Open-Xchange AppSuite, specifically the cacheservice API. A SQL injection vulnerability arises from insufficient sanitization of parameters in API calls, enabling attackers with local or restricted network access to execute arbitrary SQL queries and potentiall...

CVE-2023-3779

The CVE-2023-3779 entry affects the WordPress plugin “Essential Addons for Elementor” (WPDeveloper) for WordPress, indicating that versions up to and including 5.8.1 disclose MailChimp API keys via source code added to pages using the MailChimp block. Root cause: unauthenticated disclosure of API...

CVE-2023-37277

XWiki Platform is vulnerable to cross-site request forgery via the REST API. The flaw allows remote code execution through script macros when a user with programming rights interacts with crafted POST requests using content types such as text/plain, multipart/form-data, or application/www-form-ur...

CVE-2023-37486

Summary : CVE-2023-37486 corresponds to an information-disclosure issue in SAP Commerce (OCC API). The affected components are SAP Commerce Cloud/Hybris with OCC API endpoints HY_COM 2105, HY_COM 2205, and COM_CLOUD 2211. According to the provided documents, under certain conditions these endpoin...

CVE-2023-34235

Strapi (pre-4.10.8) is vulnerable to information disclosure due to a Knex query that allows changing the default field prefix (t(number)). If the t-number prefix is used, private fields like password can be exposed, as t1.password is not protected. The issue can lead to filtering attacks affectin...

CVE-2023-31461

CVE-2023-31461 is a path-traversal vulnerability in SteelSeries GG (version 36.0.0) with an open API listener that can be abused to create a sub-application execute automatically from a controlled location. Affected product: SteelSeries GG 36.0.0. Root cause: path traversal via the open API liste...

CVE-2023-37300

Connected document EUVD-2023-41205 (BIT-MEDIAWIKI-2023-37300) confirms CVE-2023-37300 relates to the CheckUserLog API in the MediaWiki CheckUser extension, with an incorrect access control that leaks visibility of hidden users. Affected scope: MediaWiki with the CheckUser extension up to at least...

CVE-2023-39264

CVE-2023-39264 affects Apache Superset up to version 2.1.0. The root cause is that error handling defaulted to emitting stack traces, which exposes internal traces via REST API endpoints. The vulnerability enables potential disclosure of internal information and is categorized with network exposu...

CVE-2023-38487

CVE-2023-38487 – HedgeDoc : Prior to 1.9.9, the HedgeDoc API allows creating a note with an alias equal to an existing note ID via POST /new/ when freeURL is enabled. The system does not verify the alias against existing IDs, so a new note can shadow the original; access may be redirected to the ...

CVE-2023-33368

CVE-2023-33368 affects Control ID IDSecure 4.7.26.0 and earlier. The issue concerns API routes that exfiltrate sensitive information and passwords to users accessing those routes. Impact: information disclosure (Confidentiality HIGH per CVSS). No fix version is publicly documented in the provided...

CVE-2023-38350

CVE-2023-38350 affects PNP4Nagios (versions 0.6.26 through 81ebfc5) where stored XSS exists in the AJAX controller via the basket API and filters. The issue is caused by insufficient input handling in the affected AJAX endpoints, enabling cross-site scripting. Affected components are the web inte...

CVE-2025-21660

Technical details for CVE-2025-21660 are not provided in the supplied documents. No affected products, root cause, or remediation are disclosed here; monitor for updates from official advisories.

CVE-2024-53160

CVE-2024-53160 : The MiracleLinux advisory confirms a Linux kernel data-race in rcu/kvfree between __mod_timer/kvfree_call_rcu and kfree_rcu_monitor. The fix acquires krcp->lock in kfree_rcu_monitor to ensure both functions do not race when updating krcp->monitor_work.timer.expires, address...

CVE-2023-4615

CVE-2023-4615 affects LG LED Assistant. Root cause: missing validation of a user-supplied path in /api/download/updateFile, enabling directory traversal. Impact: unauthenticated remote disclosure of sensitive information in the current user context over the network. Affected product: LG LED Assis...

CVE-2023-39522

goauthentik (open‑source Identity Provider) contains a vulnerability in affected versions using a recovery flow with an identification stage that allows an attacker to determine whether a username exists, enabling username/email enumeration. The issue affects setups with the recovery flow and can...

CVE-2023-40579

OpenFGA OpenFGA v1.3.0 and earlier contains an authorization bypass in the ListObjects API when models include expressions of type rel1 from type1. The root cause is mis-evaluation of results for ListObjects under those models, enabling access to unauthorized objects. The issue has been fixed in ...

CVE-2023-3947

CVE-2023-3947 affects the WordPress plugin “Video Conferencing with Zoom”. A hardcoded encryption key in vczapi_encrypt_decrypt allows unauthenticated attackers to decrypt and view meeting IDs and passwords for versions up to and including 4.2.1. A fix is available in 4.2.2 (per PatchStack) and i...