The Consensus Security Vulnerability Alert

Internet Storm Center Spotlight

Internet Storm Center Entries

Recent CVEs

CVE-2023-3519 - Unauthenticated remote code execution

CVE-2023-35078 - Ivanti Endpoint Manager Mobile (EPMM) allows remote attackers to bypass authentication and perform unauthorized actions, including accessing personal identifiable information (PII), adding an administrative account, and modifying the configuration.

cve-2023-35078 - new-ivanti-epmm-vulnerability

CVE-2023-34034 - Spring Security's use of "**" as a pattern in configuration for WebFlux leads to pattern matching mismatch with Spring WebFlux, allowing a security bypass.

CVE-2023-35311 - Microsoft Outlook Security Feature Bypass Vulnerability

CVE-2023-35189 - Iagona ScrutisWeb versions 2.1.37 and prior allow unauthenticated users to upload malicious payloads and execute remote code.

CVE-2023-30153 - Payplug module for PrestaShop versions 3.6.0 to 3.7.1 allows remote attackers to execute arbitrary SQL commands via ajax.php front controller.

CVE-2023-21974 - The vulnerability in Oracle Application Express (component: User Account) allows a low privileged attacker with HTTP network access to compromise the Application Express Team Calendar Plugin, potentially resulting in a takeover.

CVE-2023-21975 - The Application Express Customers Plugin product of Oracle Application Express has a vulnerability that allows a low privileged attacker to compromise the plugin and potentially impact additional products, resulting in a takeover of Application Express Customers Plugin.

CVE-2023-30799 - MikroTik RouterOS versions 6.49.7 and below have a privilege escalation vulnerability allowing remote attackers to execute arbitrary code by escalating privileges from admin to super-admin on the Winbox or HTTP interface.

CVE-2023-3638 - In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.

CVE-2023-3466 - Reflected Cross-Site Scripting (XSS)

CVE-2023-3467 - Privilege Escalation to root administrator (nsroot)

CVE-2023-37289 - InfoDoc Document On-line Submission and Approval System is vulnerable to an unrestricted file upload vulnerability, allowing unauthenticated attackers to upload and execute arbitrary files, enabling them to execute arbitrary commands or disrupt services.

CVE-2023-38203 - Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier), and 2023u1 (and earlier) can be exploited by an Untrusted Data Deserialization vulnerability, allowing for arbitrary code execution without user interaction.

CVE-2023-37471 - OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses, allowing attackers to impersonate any OpenAM user, including the administrator.

CVE-2023-37292 - HGiga iSherlock 4.5 and HGiga iSherlock 5.5 are vulnerable to OS Command Injection prior to specific versions.

CVE-2023-32478 - Dell PowerStore versions prior to 3.5.0.1 allow high privileged malicious users to disclose sensitive information via insertion into log files.

CVE-2023-35086 - ASUS RT-AX56U V2 & RT-AC86U routers are vulnerable to remote arbitrary code execution and system disruption due to a format string vulnerability in the logmessage_normal function of the do_detwan_cgi module in httpd, caused by directly using input as a format string when calling syslog.

CVE-2023-35087 - ASUS RT-AX56U V2 & RT-AC86U are vulnerable to a format string vulnerability that enables unauthenticated remote attackers to execute arbitrary code or disrupt services.

CVE-2023-37903 -  vm2 is vulnerable to remote code execution due to an exploit in the Node.js custom inspect function for versions up to and including 3.9.19, with no available patches or workarounds, necessitating the use of alternative software.

CVE-2022-41793 - Open Babel 3.1.1 and master commit 530dbfa3 allows arbitrary code execution via a specially crafted CSR format title file.

CVE-2022-42885 - Open Babel 3.1.1 and master commit 530dbfa3 allow arbitrary code execution via a specially crafted malformed file due to an uninitialized pointer vulnerability in the GRO format res functionality.

CVE-2022-43467 -  Open Babel 3.1.1 and master commit 530dbfa3 allows arbitrary code execution via a specially crafted PQS format coord_file.

CVE-2022-44451 - Open Babel 3.1.1 and master commit 530dbfa3 is vulnerable to an uninitialized pointer issue in its MSI format atom functionality, allowing arbitrary code execution via a specially crafted file.

CVE-2022-46280 - Open Babel 3.1.1 and master commit 530dbfa3 are vulnerable to an uninitialized pointer vulnerability in the PQS format pFormat, allowing arbitrary code execution via a specially crafted file.

CVE-2022-46289 - Open Babel 3.1.1 and master commit 530dbfa3 allows arbitrary code execution through the ORCA format nAtoms functionality when a specially-crafted malformed file is provided, due to multiple out-of-bounds write vulnerabilities, including a wrap-around calculation leading to a small buffer allocation.

CVE-2022-46290 - Open Babel 3.1.1 and master commit 530dbfa3 contain multiple out-of-bounds write vulnerabilities in the ORCA format nAtoms functionality, which allows arbitrary code execution via a specially-crafted malformed file provided by an attacker.

CVE-2022-46291 - Open Babel 3.1.1 and master commit 530dbfa3 are vulnerable to multiple out-of-bounds write vulnerabilities when parsing translationVectors in supported formats, allowing arbitrary code execution via a malicious file, particularly affecting the MSI format.

CVE-2022-46292 - Open Babel 3.1.1 and master commit 530dbfa3 have multiple out-of-bounds write vulnerabilities in their translationVectors parsing functionality, which can allow arbitrary code execution by providing a specially-crafted malformed file, specifically affecting the MOPAC file format in the Unit Cell Translation section.

CVE-2022-46293 - Open Babel 3.1.1 and master commit 530dbfa3 allow arbitrary code execution via specially-crafted malformed MOPAC files.

CVE-2022-46294 - Open Babel 3.1.1 and master commit 530dbfa3 are vulnerable to multiple out-of-bounds write vulnerabilities in translationVectors parsing, allowing arbitrary code execution by exploiting a specially-crafted malformed file, specifically impacting the MOPAC Cartesian file format.

CVE-2022-46295 - Open Babel 3.1.1 and master commit 530dbfa3 contains multiple out-of-bounds write vulnerabilities in the translationVectors parsing functionality, allowing arbitrary code execution via a specially-crafted Gaussian file.

CVE-2023-37917 - KubePi allows any user to become an admin by editing the `isadmin` value in the request, leading to unauthorized administrative control.

CVE-2023-26045 - NodeBB forum software allows arbitrary execution of local javascript files on the disk, due to a path traversal vulnerability combined with a specially crafted payload, in versions 2.5.0 to 2.8.6.

CVE-2023-3046 - Biltay Technology Scienta before 20230630.1953 is vulnerable to SQL Injection.

CVE-2023-35066 - Infodrom Software E-Invoice Approval System before v.20230701 allows SQL Injection.

CVE-2023-35067 - Infodrom Software E-Invoice Approval System before v.20230701 allows reading sensitive strings within an executable due to plaintext storage of a password vulnerability.

CVE-2023-35980 - Aruba's access point management protocol (PAPI) is vulnerable to buffer overflow flaws, enabling unauthenticated remote code execution with arbitrary privileges.

CVE-2023-35981 - Aruba's access point management protocol (PAPI) is vulnerable to buffer overflow flaws, enabling unauthenticated remote code execution with arbitrary privileges.

CVE-2023-35982 -  Aruba's access point management protocol (PAPI) is vulnerable to buffer overflow flaws, enabling unauthenticated remote code execution with arbitrary privileges.

CVE-2023-38606 - Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify sensitive kernel state.

CVE-2023-37450 - Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that can allow an attacker to execute code when processing web content.

CVE-2023-32409 - Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox.