[CVE_SUBSCRIPTIONS]

Receive alerts for specific vendors, products, or severities
📡 [FLUX RSS CVE]

Subscribe to the CVE feed

7 derniers jours

> FILTERS

> Last 7 Days

STATISTIQUES

Total CVE: 425103
> CVE-2024-22817 [HIGH 8.8]
[PUBLISHED: 2024-01-18] [EPSS 0.32%]
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_conf_updagte
AFFECTED_PRODUCTS: Flycms Project Flycms
> CVE-2024-22603 [HIGH 8.8]
[PUBLISHED: 2024-01-18] [EPSS 0.33%]
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/links/add_link
AFFECTED_PRODUCTS: Flycms Project Flycms
> CVE-2024-22601 [HIGH 8.8]
[PUBLISHED: 2024-01-18] [EPSS 0.24%]
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/scorerule_save
AFFECTED_PRODUCTS: Flycms Project Flycms
> CVE-2023-28901 [MEDIUM 5.3]
[PUBLISHED: 2024-01-18] [EPSS 0.51%]
The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mileage, fuel consumption, average and maximum speed, and other information of Skoda Connect service users by specifying an arbitrary vehicle VIN number.
> CVE-2023-28900 [MEDIUM 5.3]
[PUBLISHED: 2024-01-18] [EPSS 0.38%]
The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing to obtain nicknames and other user identifiers of Skoda Connect service users by specifying an arbitrary vehicle VIN number.
> CVE-2024-22699 [HIGH 8.8]
[PUBLISHED: 2024-01-18] [EPSS 0.35%]
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/update_group_save.
AFFECTED_PRODUCTS: Flycms Project Flycms
> CVE-2024-0607 [MEDIUM 6.6]
[PUBLISHED: 2024-01-18] [EPSS 0.26%]
A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes are written, but `dst` is an array of u32, so each element only has space for 4 bytes....
AFFECTED_PRODUCTS: Linux Linux Kernel, Linux Linux Kernel, Red Hat Enterprise Linux ... (+2)
> CVE-2024-0409 [HIGH 7.8]
[PUBLISHED: 2024-01-18] [EPSS 0.36%]
A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.
AFFECTED_PRODUCTS: Red Hat Enterprise Linux, Red Hat Enterprise Linux, Red Hat Enterprise Linux ... (+12)
> CVE-2024-0408 [MEDIUM 5.5]
[PUBLISHED: 2024-01-18] [EPSS 0.32%]
A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as...
AFFECTED_PRODUCTS: Red Hat Enterprise Linux, Red Hat Enterprise Linux, Red Hat Enterprise Linux ... (+12)
> CVE-2024-22593 [HIGH 8.8]
[PUBLISHED: 2024-01-18] [EPSS 0.32%]
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/add_group_save
AFFECTED_PRODUCTS: Flycms Project Flycms
> CVE-2024-22592 [HIGH 8.8]
[PUBLISHED: 2024-01-18] [EPSS 0.32%]
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_update
AFFECTED_PRODUCTS: Flycms Project Flycms
> CVE-2024-22591 [HIGH 8.8]
[PUBLISHED: 2024-01-18] [EPSS 0.32%]
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_save.
AFFECTED_PRODUCTS: Flycms Project Flycms
> CVE-2024-22568 [HIGH 8.8]
[PUBLISHED: 2024-01-18] [EPSS 0.29%]
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/del.
AFFECTED_PRODUCTS: Flycms Project Flycms
> CVE-2024-22549 [MEDIUM 5.4]
[PUBLISHED: 2024-01-18] [EPSS 0.38%]
FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the email settings of the website settings section.
AFFECTED_PRODUCTS: Flycms Project Flycms
> CVE-2024-22548 [MEDIUM 5.4]
[PUBLISHED: 2024-01-18] [EPSS 0.44%]
FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the system website settings website name section.
AFFECTED_PRODUCTS: Flycms Project Flycms
> CVE-2023-7153 [MEDIUM 6.1]
[PUBLISHED: 2024-01-18] [EPSS 0.31%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Macroturk Software and Internet Technologies Macro-Bel allows Reflected XSS.This issue affects Macro-Bel: before V.1.0.1.
AFFECTED_PRODUCTS: Macroturk Macro Bel
> CVE-2023-40052 [HIGH 7.5]
[PUBLISHED: 2024-01-18] [EPSS 0.57%]
This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0 .  An attacker who can produce a malformed web request may cause the crash of a PASOE agent potentially disrupting the thread activ...
AFFECTED_PRODUCTS: Progress Openedge, Progress Openedge, Progress Openedge Innovation
> CVE-2023-40051 [CRITICAL 9.1]
[PUBLISHED: 2024-01-18] [EPSS 0.56%]
This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0. An attacker can formulate a request for a WEB transport that allows unintended file uploads to a server directory path on the system ru...
AFFECTED_PRODUCTS: Progress Openedge, Progress Openedge, Progress Openedge Innovation
> CVE-2021-33631 [MEDIUM 5.5]
[PUBLISHED: 2024-01-18] [EPSS 0.37%]
Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from 5.10.0-60.18.0 before 5.10.0-183.0.0.
AFFECTED_PRODUCTS: Openatom Openeuler, Openatom Openeuler
> CVE-2021-33630 [MEDIUM 5.5]
[PUBLISHED: 2024-01-18] [EPSS 0.34%]
NULL Pointer Dereference vulnerability in openEuler kernel on Linux (network modules) allows Pointer Manipulation. This vulnerability is associated with program files net/sched/sch_cbs.C. This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3.
AFFECTED_PRODUCTS: Openatom Openeuler
> CVE-2024-22317 [CRITICAL 9.1]
[PUBLISHED: 2024-01-18] [EPSS 1.03%]
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.24 and 12.0.1.0 through 12.0.11.0 could allow a remote attacker to obtain sensitive information or cause a denial of service due to improper restriction of excessive authentication attempts. IBM X-Force ID: 279143.
AFFECTED_PRODUCTS: IBM App Connect Enterprise, IBM App Connect Enterprise
> CVE-2024-0669 [MEDIUM 6.3]
[PUBLISHED: 2024-01-18] [EPSS 0.29%]
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element.
AFFECTED_PRODUCTS: Plone Plone
> CVE-2023-5806 [CRITICAL 9.8]
[PUBLISHED: 2024-01-18] [EPSS 0.53%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mergen Software Quality Management System allows SQL Injection.This issue affects Quality Management System: before v1.2.
AFFECTED_PRODUCTS: Mergentech Quality Management System
> CVE-2023-51464 [MEDIUM 5.4]
[PUBLISHED: 2024-01-18] [EPSS 0.38%]
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brows...
AFFECTED_PRODUCTS: Adobe Experience Manager
> CVE-2023-51463 [MEDIUM 5.4]
[PUBLISHED: 2024-01-18] [EPSS 0.38%]
Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the vi...
AFFECTED_PRODUCTS: Adobe Experience Manager
> CVE-2024-0580 [MEDIUM 6.5]
[PUBLISHED: 2024-01-18] [EPSS 0.49%]
Omission of user-controlled key authorization in the IDMSistemas platform, affecting the QSige product. This vulnerability allows an attacker to extract sensitive information from the API by making a request to the parameter '/qsige.locator/quotePrevious/centers/X', where X supports values 1,2,3, et...
AFFECTED_PRODUCTS: Idmsistemas Sinergia
> CVE-2024-0381 [MEDIUM 6.4]
[PUBLISHED: 2024-01-18] [EPSS 0.58%]
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of the 'tag' attribute in the wprm-recipe-name, wprm-recipe-date, and wprm-recipe-counter shortcodes in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers with...
AFFECTED_PRODUCTS: Bootstrapped Wp Recipe Maker
> CVE-2023-6970 [MEDIUM 6.1]
[PUBLISHED: 2024-01-18] [EPSS 0.67%] [🎯 NUCLEI]
The WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘Referer' header in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...
AFFECTED_PRODUCTS: Bootstrapped Wp Recipe Maker
> CVE-2023-6958 [MEDIUM 6.4]
[PUBLISHED: 2024-01-18] [EPSS 0.34%]
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers w...
AFFECTED_PRODUCTS: Bootstrapped Wp Recipe Maker
> CVE-2023-6816 [CRITICAL 9.8]
[PUBLISHED: 2024-01-18] [EPSS 2.11%]
A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading t...
AFFECTED_PRODUCTS: Debian Debian Linux, Red Hat Enterprise Linux Desktop, Fedoraproject Fedora ... (+4)
> CVE-2024-0655 [MEDIUM 5.5]
[PUBLISHED: 2024-01-18] [EPSS 0.71%]
A vulnerability has been found in Novel-Plus 4.3.0-RC1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /novel/bookSetting/list. The manipulation of the argument sort leads to sql injection. The exploit has been disclosed to the public and may be use...
AFFECTED_PRODUCTS: Xxyopen Novel Plus
> CVE-2023-48359 [MEDIUM 4.4]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In autotest driver, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with System execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android, Google Android
> CVE-2023-48358 [MEDIUM 4.4]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In drm driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android, Google Android
> CVE-2023-48357 [MEDIUM 4.4]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In vsp driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android, Google Android
> CVE-2023-48356 [MEDIUM 4.4]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In jpg driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android, Google Android
> CVE-2023-48355 [MEDIUM 4.4]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In jpg driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android, Google Android
> CVE-2023-48354 [MEDIUM 5.5]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In telephone service, there is a possible improper input validation. This could lead to local information disclosure with no additional execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android, Google Android
> CVE-2023-48353 [MEDIUM 4.4]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In vsp driver, there is a possible use after free due to a logic error. This could lead to local denial of service with System execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android, Google Android
> CVE-2023-48352 [MEDIUM 5.5]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In phasecheckserver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android, Google Android
> CVE-2023-48351 [MEDIUM 5.5]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android
> CVE-2023-48350 [MEDIUM 5.5]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android
> CVE-2023-48349 [MEDIUM 5.5]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android
> CVE-2023-48348 [MEDIUM 5.5]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In video decoder, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android
> CVE-2023-48347 [MEDIUM 5.5]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android
> CVE-2023-48346 [MEDIUM 5.5]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In video decoder, there is a possible improper input validation. This could lead to local denial of service with no additional execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android
> CVE-2023-48345 [MEDIUM 5.5]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android
> CVE-2023-48344 [MEDIUM 5.5]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android
> CVE-2023-48343 [MEDIUM 5.5]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In video decoder, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android
> CVE-2023-48342 [MEDIUM 4.4]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In media service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android, Google Android
> CVE-2023-48341 [MEDIUM 5.5]
[PUBLISHED: 2024-01-18] [EPSS 0.08%]
In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
AFFECTED_PRODUCTS: Google Android, Google Android