‼ CVE-2023-30535 ‼
📖 Read
via "National Vulnerability Database".
Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Users of the Snowflake JDBC driver were vulnerable to a command injection vulnerability. An attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. The vulnerability was patched on March 17, 2023 as part of Snowflake JDBC driver Version 3.13.29. All users should immediately upgrade the Snowflake JDBC driver to the latest version: 3.13.29.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29091 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding an SIP URI.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22669 ‼
📖 Read
via "National Vulnerability Database".
Parsing of DWG files in Open Design Alliance Drawings SDK before 2023.6 lacks proper validation of the length of user-supplied XRecord data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27571 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in DG3450 Cable Gateway AR01.02.056.18_041520_711.NCS.10. The troubleshooting_logs_download.php log file download functionality does not check the session cookie. Thus, an attacker can download all log files.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43696 ‼
📖 Read
via "National Vulnerability Database".
OX App Suite before 7.10.6-rev20 allows XSS via upsell ads.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43697 ‼
📖 Read
via "National Vulnerability Database".
OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27572 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in CommScope Arris DG3450 Cable Gateway AR01.02.056.18_041520_711.NCS.10. A reflected XSS vulnerability was discovered in the https_redirect.php web page via the page parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47522 ‼
📖 Read
via "National Vulnerability Database".
The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point (such as authentication frames or re-association frames) to remove the target's original security context. This behavior occurs because the specifications do not require an access point to purge its transmit queue before removing a client's pairwise encryption key.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43699 ‼
📖 Read
via "National Vulnerability Database".
OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain (found in the host part of an e-mail address).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48177 ‼
📖 Read
via "National Vulnerability Database".
X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records Model field (model parameter). This vulnerability allows attackers to create malicious JavaScript that will be executed by the victim user's browser.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-45030 ‼
📖 Read
via "National Vulnerability Database".
A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with secure-file-priv).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43698 ‼
📖 Read
via "National Vulnerability Database".
OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22670 ‼
📖 Read
via "National Vulnerability Database".
A heap-based buffer overflow exists in the DXF file reading procedure in Open Design Alliance Drawings SDK before 2023.6. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of the length of user-supplied XRecord data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24607 ‼
📖 Read
via "National Vulnerability Database".
Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26463 ‼
📖 Read
via "National Vulnerability Database".
strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. There is initially incorrect access control, later followed by an expired pointer dereference. One attack vector is sending an untrusted client certificate during EAP-TLS. A server is affected only if it loads plugins that implement TLS-based EAP methods (EAP-TLS, EAP-TTLS, EAP-PEAP, or EAP-TNC). This is fixed in 5.9.10.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46880 ‼
📖 Read
via "National Vulnerability Database".
x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate chain is sometimes discarded.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48178 ‼
📖 Read
via "National Vulnerability Database".
X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an index.php/actions/update URI.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2096 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in SourceCodester Vehicle Service Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/service_requests/manage_inventory.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226104.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2094 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been found in SourceCodester Vehicle Service Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/mechanics/manage_mechanic.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-226102 is the identifier assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2095 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in SourceCodester Vehicle Service Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/maintenance/manage_category.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226103.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2092 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, has been found in SourceCodester Vehicle Service Management System 1.0. Affected by this issue is some unknown functionality of the file view_service.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226100.📖 Read
via "National Vulnerability Database".