#ExploitObserverAlert
CVE-2023-38677
DESCRIPTION: Exploit Observer has 1 entries related to CVE-2023-38677. FPE in paddle.linalg.eig in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
CVE-2023-38677
DESCRIPTION: Exploit Observer has 1 entries related to CVE-2023-38677. FPE in paddle.linalg.eig in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
#ExploitObserverAlert
CVE-2023-52302
DESCRIPTION: Exploit Observer has 1 entries related to CVE-2023-52302. Nullptr in paddle.nextafter in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
CVE-2023-52302
DESCRIPTION: Exploit Observer has 1 entries related to CVE-2023-52302. Nullptr in paddle.nextafter in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
#ExploitObserverAlert
CVE-2023-52307
DESCRIPTION: Exploit Observer has 1 entries related to CVE-2023-52307. Stack overflow in paddle.linalg.lu_unpack in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage.
CVE-2023-52307
DESCRIPTION: Exploit Observer has 1 entries related to CVE-2023-52307. Stack overflow in paddle.linalg.lu_unpack in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage.
#ExploitObserverAlert
CVE-2023-7068
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-7068. The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on theprint_packinglist action in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to export orders which can contain sensitive information.
CVE-2023-7068
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-7068. The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on theprint_packinglist action in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to export orders which can contain sensitive information.
#ExploitObserverAlert
CVE-2023-5879
DESCRIPTION: Exploit Observer has 1 entries related to CVE-2023-5879. Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below) on Android Devices. This allows the attacker, with access to the android device, to potentially retrieve users' clear text authentication credentials.
CVE-2023-5879
DESCRIPTION: Exploit Observer has 1 entries related to CVE-2023-5879. Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below) on Android Devices. This allows the attacker, with access to the android device, to potentially retrieve users' clear text authentication credentials.
#ExploitObserverAlert
GHSA-xgpm-q3mq-46rq
DESCRIPTION: Exploit Observer has 3 entries related to GHSA-XGPM-Q3MQ-46RQ. Some event attributes are not detected by the isCleanHTML method
GHSS: 8.1
GHSA-xgpm-q3mq-46rq
DESCRIPTION: Exploit Observer has 3 entries related to GHSA-XGPM-Q3MQ-46RQ. Some event attributes are not detected by the isCleanHTML method
GHSS: 8.1
#ExploitObserverAlert
CVE-2023-38675
DESCRIPTION: Exploit Observer has 1 entries related to CVE-2023-38675. FPE in paddle.linalg.matrix_rank in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
CVE-2023-38675
DESCRIPTION: Exploit Observer has 1 entries related to CVE-2023-38675. FPE in paddle.linalg.matrix_rank in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
#ExploitObserverAlert
CVE-2023-52322
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-52322. ecrire/public/assembler.php in SPIP before 4.1.3 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as alphanumerics.
CVE-2023-52322
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-52322. ecrire/public/assembler.php in SPIP before 4.1.3 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as alphanumerics.
#ExploitObserverAlert
CVE-2023-6733
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-6733. The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmem_field shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including user emails, password hashes, usernames, and more.
CVE-2023-6733
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-6733. The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmem_field shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including user emails, password hashes, usernames, and more.
#ExploitObserverAlert
CVE-2023-46740
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-46740. CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates new users, it creates a piece of sensitive information for the user called the “accessKey”. To create the "accesKey", CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user. An attacker could leverage the predictable random string generator and guess a users access key and impersonate the user to obtain higher privileges. The issue has been fixed in v3.3.1. There is no other mitigation than to upgrade.
CVE-2023-46740
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-46740. CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates new users, it creates a piece of sensitive information for the user called the “accessKey”. To create the "accesKey", CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user. An attacker could leverage the predictable random string generator and guess a users access key and impersonate the user to obtain higher privileges. The issue has been fixed in v3.3.1. There is no other mitigation than to upgrade.
#ExploitObserverAlert
GHSA-8x6f-956f-q43w
DESCRIPTION: Exploit Observer has 3 entries related to GHSA-8X6F-956F-Q43W. There is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the preserveComments directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output.
GHSS: 6.1
GHSA-8x6f-956f-q43w
DESCRIPTION: Exploit Observer has 3 entries related to GHSA-8X6F-956F-Q43W. There is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the preserveComments directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output.
GHSS: 6.1
#ExploitObserverAlert
CVE-2023-6004
DESCRIPTION: Exploit Observer has 3 entries related to CVE-2023-6004. A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.
CVE-2023-6004
DESCRIPTION: Exploit Observer has 3 entries related to CVE-2023-6004. A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.
#ExploitObserverAlert
CVE-2023-50092
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-50092. APIIDA API Gateway Manager for Broadcom Layer7 v2023.2 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-50092
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-50092. APIIDA API Gateway Manager for Broadcom Layer7 v2023.2 is vulnerable to Cross Site Scripting (XSS).
#ExploitObserverAlert
CVE-2016-4385
DESCRIPTION: Exploit Observer has 9 entries related to CVE-2016-4385. The RMI service in HP Network Automation Software 9.1x, 9.2x, 10.0x before 10.00.02.01, and 10.1x before 10.11.00.01 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) and Commons BeanUtils libraries.
FIRST-EPSS: 0.070670000
NVD-IS: 3.4
NVD-ES: 3.9
CVE-2016-4385
DESCRIPTION: Exploit Observer has 9 entries related to CVE-2016-4385. The RMI service in HP Network Automation Software 9.1x, 9.2x, 10.0x before 10.00.02.01, and 10.1x before 10.11.00.01 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) and Commons BeanUtils libraries.
FIRST-EPSS: 0.070670000
NVD-IS: 3.4
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2023-49639
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-49639. Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'customer_details' parameter of the buyer_invoice_submit.php resource does not validate the characters received and they are sent unfiltered to the database.
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2023-49639
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-49639. Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'customer_details' parameter of the buyer_invoice_submit.php resource does not validate the characters received and they are sent unfiltered to the database.
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2018-17240
DESCRIPTION: Exploit Observer has 4 entries related to CVE-2018-17240. There is a memory dump vulnerability on Netwave IP camera devices at //proc/kcore that allows an unauthenticated attacker to exfiltrate sensitive information from the network configuration (e.g., username and password).
FIRST-EPSS: 0.002190000
NVD-IS: 3.6
NVD-ES: 3.9
CVE-2018-17240
DESCRIPTION: Exploit Observer has 4 entries related to CVE-2018-17240. There is a memory dump vulnerability on Netwave IP camera devices at //proc/kcore that allows an unauthenticated attacker to exfiltrate sensitive information from the network configuration (e.g., username and password).
FIRST-EPSS: 0.002190000
NVD-IS: 3.6
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2021-3287
DESCRIPTION: Exploit Observer has 6 entries related to CVE-2021-3287. Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.
FIRST-EPSS: 0.373730000
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2021-3287
DESCRIPTION: Exploit Observer has 6 entries related to CVE-2021-3287. Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.
FIRST-EPSS: 0.373730000
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2023-51154
DESCRIPTION: Exploit Observer has 1 entries related to CVE-2023-51154. Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php.
CVE-2023-51154
DESCRIPTION: Exploit Observer has 1 entries related to CVE-2023-51154. Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php.
#ExploitObserverAlert
CVE-2023-49633
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-49633. Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'buyer_address' parameter of the buyer_detail_submit.php resource does not validate the characters received and they are sent unfiltered to the database.
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2023-49633
DESCRIPTION: Exploit Observer has 2 entries related to CVE-2023-49633. Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'buyer_address' parameter of the buyer_detail_submit.php resource does not validate the characters received and they are sent unfiltered to the database.
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2020-4589
DESCRIPTION: Exploit Observer has 5 entries related to CVE-2020-4589. IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 184585.
FIRST-EPSS: 0.004210000
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2020-4589
DESCRIPTION: Exploit Observer has 5 entries related to CVE-2020-4589. IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 184585.
FIRST-EPSS: 0.004210000
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
GHSA-5pq7-52mg-hr42
DESCRIPTION: Exploit Observer has 4 entries related to GHSA-5PQ7-52MG-HR42. I found "multipart/form-data request tampering vulnerability" caused by Content-Disposition "filename" lack of escaping in httparty.
GHSS: 6.5
GHSA-5pq7-52mg-hr42
DESCRIPTION: Exploit Observer has 4 entries related to GHSA-5PQ7-52MG-HR42. I found "multipart/form-data request tampering vulnerability" caused by Content-Disposition "filename" lack of escaping in httparty.
GHSS: 6.5