Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2023-22796 |
Description: A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.
CVSS: LOW (0.0) EPSS Score: 0.16%
November 28th, 2024 (5 months ago)
|
|
CVE-2023-2232 |
|
|
CVE-2023-2178 |
Description: The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS: LOW (0.0) EPSS Score: 0.11%
November 28th, 2024 (5 months ago)
|
|
CVE-2023-21226 |
Description: In SAEMM_RetrieveTaiList of SAEMM_ContextManagement.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-240728187References: N/A
CVSS: LOW (0.0) EPSS Score: 0.08%
November 28th, 2024 (5 months ago)
|
|
CVE-2023-2068 |
Description: The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.
CVSS: LOW (0.0) EPSS Score: 83.95%
November 28th, 2024 (5 months ago)
|
|
CVE-2023-20575 |
Description:
A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a program’s execution inside an AMD SEV VM potentially resulting in a leak of sensitive information.
CVSS: LOW (0.0) EPSS Score: 0.06%
November 28th, 2024 (5 months ago)
|
|
CVE-2023-2032 |
Description: The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities.
CVSS: LOW (0.0) EPSS Score: 0.21%
November 28th, 2024 (5 months ago)
|
|
CVE-2023-1891 |
Description: The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting
CVSS: LOW (0.0) EPSS Score: 0.07%
November 28th, 2024 (5 months ago)
|
|
CVE-2023-1783 |
Description: OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF.
CVSS: MEDIUM (6.5) EPSS Score: 0.11%
November 28th, 2024 (5 months ago)
|
|
CVE-2023-1724 |
Description: Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the application. This occurs because the application is vulnerable to stored XSS.
CVSS: HIGH (7.3) EPSS Score: 0.08%
November 28th, 2024 (5 months ago)
|