Threat and Vulnerability Intelligence Database

RSS Feed

Example Searches:

CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited

CVE-2023-2605
WP Brutal AI < 2.0.1 - Admin+ Reflected XSS
Description: The wpbrutalai WordPress plugin before 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.

CVSS: LOW (0.0)

EPSS Score: 0.19%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-2601
WP Brutal AI < 2.0.0 - SQL Injection via CSRF
Description: The wpbrutalai WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin via CSRF.

CVSS: LOW (0.0)

EPSS Score: 0.7%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-2592
FormCraft Premium < 3.9.7 - Admin+ SQLi
Description: The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

CVSS: LOW (0.0)

EPSS Score: 0.09%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-25656
notation-go has excessive memory allocation on verification
Description: notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will be killed, and thus availability is impacted. The problem has been patched in the release v1.0.0-rc.3. Some workarounds are available. Users can review their own trust policy file and check if the identity string contains `=#`. Meanwhile, users should only put trusted certificates in their trust stores referenced by their own trust policy files, and make sure the `authenticity` validation is set to `enforce`.

CVSS: HIGH (7.5)

EPSS Score: 0.1%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-25652
"git apply --reject" partially-controlled arbitrary file write
Description: Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists.

CVSS: HIGH (7.5)

EPSS Score: 0.58%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-25521
Description: NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause execution with unnecessary privileges by leveraging a weakness whereby proper input parameter validation is not performed. A successful exploit of this vulnerability may lead to denial of service, information disclosure, and data tampering.

CVSS: HIGH (7.5)

EPSS Score: 0.04%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-25433
Description: libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV.

CVSS: LOW (0.0)

EPSS Score: 0.07%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-25304
Description: An issue in Prism Launcher up to v6.1 allows attackers to perform a directory traversal via importing a crafted .mrpack file.

CVSS: LOW (0.0)

EPSS Score: 0.06%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-2482
Responsive CSS EDITOR <= 1.0 - Admin+ SQLi
Description: The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admin.

CVSS: LOW (0.0)

EPSS Score: 0.1%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-24734
Description: An arbitrary file upload vulnerability in the camera_upload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a crafted image file.

CVSS: LOW (0.0)

EPSS Score: 0.4%

Source: CVE
November 28th, 2024 (6 months ago)