Live feed · cooey

2023-08-21 NVD CVE

CVE-2023-39808: N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a hardcoded root CRITICAL

N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a hardcoded root password that allows attackers to login with root privileges via the SSH service. The cleartext password corresponding to the...

2023-08-21 NVD CVE

CVE-2023-39807: N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a SQL injection CRITICAL

N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a SQL injection vulnerability via the a_passwd parameter at /portal/user-register.php.

2023-08-21 NVD CVE

CVE-2023-39809: N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain an OS command in CRITICAL

N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain an OS command injection vulnerability via shell metacharacters in the system_hostname parameter at /manage/network-basic.php.

2023-08-21 NVD CVE

CVE-2020-28715: An issue was discovered in kdmserver service in LeEco LeTV X43 version V2401RCN0 CRITICAL

An issue was discovered in kdmserver service in LeEco LeTV X43 version V2401RCN02C080080B04121S, allows attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS).

2023-08-16 NVD CVE

CVE-2023-38894: A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remo CRITICAL

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.

2023-08-16 NVD CVE

CVE-2020-26037: Directory Traversal vulnerability in Server functionalty in Even Balance Punkbus CRITICAL

Directory Traversal vulnerability in Server functionalty in Even Balance Punkbuster version 1.902 before 1.905 allows remote attackers to execute arbitrary code.

2023-08-14 NVD CVE

CVE-2023-37847: novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability. CRITICAL

novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability.

2023-08-14 NVD CVE

CVE-2023-30187: An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 CRITICAL

An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.

2023-08-14 NVD CVE

CVE-2023-30186: A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3 CRITICAL

A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.

2023-08-10 NVD CVE

CVE-2023-39806: iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bak CRITICAL

iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function.

2023-08-10 NVD CVE

CVE-2023-39805: iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the whe CRITICAL

iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php.

2023-08-09 NVD CVE

CVE-2023-39004: Insecure permissions in the configuration directory (/conf/) of OPNsense Communi CRITICAL

Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password)...

2023-08-09 NVD CVE

CVE-2023-33468: KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.13 CRITICAL

KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This vulnerability involves extracting the connection...

2023-08-08 NVD CVE

CVE-2023-36903: Windows System Assessment Tool Elevation of Privilege Vulnerability HIGH

Windows System Assessment Tool Elevation of Privilege Vulnerability

2023-08-08 NVD CVE

CVE-2023-38186: Windows Mobile Device Management Elevation of Privilege Vulnerability HIGH

Windows Mobile Device Management Elevation of Privilege Vulnerability

2023-08-05 NVD CVE

CVE-2023-36095: An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arb CRITICAL

An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.

2023-08-03 NVD CVE

CVE-2023-38951: ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authentica CRITICAL

ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a...

2023-08-03 NVD CVE

CVE-2023-37679: A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 a CRITICAL

A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.

2023-08-03 NVD CVE

CVE-2023-36082: An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote att CRITICAL

An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to gain privileges via the LDAP and SMTP credentials.

2023-08-03 NVD CVE

CVE-2023-38954: ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerabil CRITICAL

ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability.

2023-08-01 NVD CVE

CVE-2023-34960: A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11 CRITICAL

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.

2023-07-31 NVD CVE

CVE-2023-34842: Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote att CRITICAL

Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /dede/tpl.php.

2023-07-31 NVD CVE

CVE-2023-37647: SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id p CRITICAL

SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php.

2023-07-25 NVD CVE

CVE-2023-35078: An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users CRITICAL ◈ 2 sources · orig. NVD CVE

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

2023-07-19 NVD CVE

CVE-2023-3519: Unauthenticated remote code execution CRITICAL ◈ 2 sources · orig. NVD CVE

Unauthenticated remote code execution

2023-07-12 NVD CVE

CVE-2023-33668: DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attac CRITICAL

DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access PII and takeover accounts on shared computers.

2023-07-11 NVD CVE

CVE-2023-3617: A vulnerability was found in SourceCodester Best POS Management System 1.0. It h HIGH

A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been classified as critical. This affects an unknown part of the file admin_class.php of the component Login Page. The manipulation...

2023-06-19 NVD CVE

CVE-2023-29534: Different techniques existed to obscure the fullscreen notification in Firefox a CRITICAL

Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential user confusion and spoofing attacks. *This bug only affects Firefox and Focus...

2023-06-16 NVD CVE

CVE-2023-34832: TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow CRITICAL

TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8 - 0x132B4.

2023-06-14 NVD CVE

CVE-2023-34752: bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the CRITICAL

bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit.

2023-06-13 NVD CVE

CVE-2023-34944: An arbitrary file upload vulnerability in the /fileUpload.lib.php component of C CRITICAL

An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file.

2023-06-13 NVD CVE

CVE-2023-27997: A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 an CRITICAL ◈ 2 sources · orig. NVD CVE

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version...

2023-06-13 NVD CVE

CVE-2023-31541: A unrestricted file upload vulnerability was discovered in the ‘Browse and uploa CRITICAL

A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server.

2023-06-06 NVD CVE

CVE-2023-33532: There is a command injection vulnerability in the Netgear R6250 router with Firm CRITICAL

There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker gains web management privileges, they can inject commands into the post request parameters,...

2023-06-06 NVD CVE

CVE-2023-31569: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command inje CRITICAL

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function.

2023-05-18 NVD CVE

CVE-2023-31729: TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cs CRITICAL

TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi.

2023-05-12 NVD CVE

CVE-2023-27823: An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the CRITICAL

An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.

2023-05-11 NVD CVE

CVE-2023-29863: Medical Systems Co. Medisys Weblab Products v19.4.03 was discovered to contain a CRITICAL

Medical Systems Co. Medisys Weblab Products v19.4.03 was discovered to contain a SQL injection vulnerability via the tem:statement parameter in the WSDL files.

2023-05-08 NVD CVE

CVE-2023-30185: CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerabil CRITICAL

CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php.

2023-05-05 NVD CVE

CVE-2023-30242: NS-ASG v6.3 was discovered to contain a SQL injection vulnerability via the comp CRITICAL

NS-ASG v6.3 was discovered to contain a SQL injection vulnerability via the component /admin/add_ikev2.php.