Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-26 06:29Z
2023-06-02
2023-06-02 17:15Z
HIGH

CVE-2023-29541 — Mozilla Firefox: did not properly handle downloads of files ending in <code>.desktop</code>, which can be

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-29541

Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVSSv3.1 8.8 (HIGH) · EPSS 51th percentile

CWECWE 116VNDMozillaVNDFirefoxTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-06-02
2023-06-02 17:15Z
HIGH

CVE-2023-29539 — Mozilla Firefox: When handling the filename directive in the Content-Disposition header, the filename would be truncated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-29539

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVSSv3.1 8.8 (HIGH) · EPSS 51th percentile

CWECWE 476VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-06-02
2023-06-02 17:15Z
HIGH

CVE-2023-29536 — Mozilla Firefox: An attacker could cause the memory manager to incorrectly free a pointer that addresses

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-29536

An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile

CWECWE 416VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-06-02
2023-06-02 17:15Z
HIGH

CVE-2023-28176 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-28176

Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. CVSSv3.1 8.8 (HIGH) · EPSS 53th percentile

CWECWE 787VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-06-02
2023-06-02 17:15Z
HIGH

CVE-2023-28162 — Mozilla Firefox: While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-28162

While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially exploitable crash. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. CVSSv3.1 8.8 (HIGH) · EPSS 52th percentile

CWECWE 843CWECWE 704VNDMozillaVNDAudioworkletsTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-06-02
2023-06-02 17:15Z
HIGH

CVE-2023-25746 — Mozilla Firefox_esr: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-25746

Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 102.8 and Firefox ESR < 102.8. CVSSv3.1 8.8 (HIGH) · EPSS 51th percentile

CWECWE 787VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-06-02
2023-06-02 17:15Z
HIGH

CVE-2023-25744 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-25744

Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 110 and Firefox ESR < 102.8. CVSSv3.1 8.8 (HIGH) · EPSS 51th percentile

CWECWE 787VNDMozillaVNDMmemoryTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2023-06-02
2023-06-02 17:15Z
HIGH

CVE-2023-25739 — Mozilla Firefox: Module load requests that failed were not being checked as to whether or not

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-25739

Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoadContext</code>. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVSSv3.1 8.8 (HIGH) · EPSS 52th percentile

CWECWE 416VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-06-02
2023-06-02 17:15Z
HIGH

CVE-2023-25737 — Mozilla Firefox: An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-25737

An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVSSv3.1 8.8 (HIGH) · EPSS 52th percentile

CWECWE 704VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-06-02
2023-06-02 17:15Z
HIGH

CVE-2023-25735 — Mozilla Firefox: Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-25735

Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVSSv3.1 8.8 (HIGH) · EPSS 53th percentile

CWECWE 416VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-06-02
2023-06-02 17:15Z
HIGH

CVE-2023-25734 — Mozilla Firefox: After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-25734

After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system. This also had the potential to leak NTLM credentials to the resource.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVSSv3.1 8.1 (HIGH) · EPSS 55th percentile

CWECWE 601VNDMozillaTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2023-06-02
2023-06-02 17:15Z
HIGH

CVE-2023-25732 — Mozilla Firefox: When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-25732

When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated potentially leading to an out of bounds memory write. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVSSv3.1 8.8 (HIGH) · EPSS 54th percentile

CWECWE 787VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-06-02
2023-06-02 17:15Z
HIGH

CVE-2023-23605 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-23605

Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox ESR 102.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7. CVSSv3.1 8.8 (HIGH) · EPSS 52th percentile

CWECWE 787VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-06-02
2023-06-02 17:15Z
HIGH

CVE-2023-0767 — Mozilla Firefox: An attacker could construct a PKCS 12 cert bundle in such a way that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-0767

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVSSv3.1 8.8 (HIGH) · EPSS 56th percentile

VNDMozillaVNDPkcsTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-06-02
2023-06-02 08:15Z
CRIT

CVE-2023-3000 — Erikogluteknoloji Energy_monitoring: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-3000

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Erikoglu Technology ErMon allows Command Line Execution through SQL Injection, Authentication Bypass.This issue affects ErMon: before 230602. CVSSv3.1 9.8 (CRITICAL) · EPSS 7th percentile

CWECWE 89VNDErikogluteknolojiTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-06-02
2023-06-02 04:15Z
HIGH

CVE-2023-2201 — Salephpscripts Web_directory_free: The Web Directory Free for WordPress is vulnerable to SQL Injection via the ‘post_id’

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-2201

The Web Directory Free for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.6.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSSv3.1 8.8 (HIGH) · EPSS 59th percentile

CWECWE 89VNDSalephpscriptsVNDWebTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-06-01
2023-06-01 13:15Z
HIGH

CVE-2023-22648 — Suse Rancher: A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-22648

A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: from >= 2.6.7 before < 2.6.13 CVSSv3.1 8.0 (HIGH) · EPSS 38th percentile

CWECWE 271TYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2023-06-01
2023-06-01 13:15Z
CRIT

CVE-2023-22647 — Suse Rancher: When this operation was followed-up by other specially crafted commands, it could result in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-22647

An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this operation was followed-up by other specially crafted commands, it could result in the user gaining access to tokens belonging to service accounts in the local cluster. This issue af CVSSv3.1 9.9 (CRITICAL) · EPSS 53th percentile

CWECWE 267TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2023-06-01
2023-06-01 13:15Z
HIGH

CVE-2022-43760 — Suse Rancher: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-43760

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is executed within another user's browser, allowing the attacker to steal sensitive information, manipulate web content, or perform other malicious activities on behalf of the victims. This could result in a user with write access to the affected areas being able to act on behalf of an a CVSSv3.1 8.4 (HIGH) · EPSS 53th percentile

CWECWE 79TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2023-05-31
2023-05-31 03:15Z
CRIT

CVE-2023-2987 — Wordapp Wordapp: The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-2987

The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wa_pdx_op_config_set' function in versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to the plugin to change the 'validation_token' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escalatio CVSSv3.1 9.8 (CRITICAL) · EPSS 39th percentile

CWECWE 345VNDWordappTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2023-05-31
2023-05-31 00:00Z
HIGH

Upping the Ante: Detecting In-Memory Threats with Kernel Call Stacks

Elastic Security Labs·elastic.co

Elastic Security Labs released kernel call stack-based detection capabilities in Elastic Security 8.8, enabling real-time visibility into function execution sequences for in-memory threats. The update includes 30+ detection rules targeting advanced evasion techniques including direct syscalls, callback-based evasion, module stomping, and unbacked memory execution. Call stack enrichment allows defenders to correlate suspicious behaviors with their execution context, reducing false positives and closing evasion gaps in process hollowing and injection scenarios.

SRFApplicationSRFOsTACTA0005TACTA0002SWElastic SecurityVNDElasticTYPResearchSTGDefense Evasion
72
Edit Score
2023-05-30
2023-05-30 14:15Z
MED

CVE-2023-2650 — Openssl Openssl: Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-2650

Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of CVSSv3.1 6.5 (MEDIUM) · EPSS 100th percentile

CWECWE 770VNDOpensslTYPVulnerability
6.5
CVSS v3.1
100
Edit Score
2023-05-30
2023-05-30 08:15Z
HIGH

CVE-2023-2288 — Themeisle Otter: This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar://

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-2288

The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper. CVSSv3.1 8.8 (HIGH) · EPSS 97th percentile

CWECWE 502VNDThemeisleVNDOtterTYPVulnerability
8.8
CVSS v3.1
99
Edit Score
2023-05-26
2023-05-26 17:15Z
HIGH

CVE-2023-33779 — Xuxueli Xxl-job: A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-33779

A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/. CVSSv3.1 8.8 (HIGH) · EPSS 62th percentile

CWECWE 863VNDXuxueliTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2023-05-25
2023-05-25 14:15Z
CRIT

CVE-2023-2851 — Agtteknik Ceppatron: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-2851

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AGT Tech Ceppatron allows Command Line Execution through SQL Injection, SQL Injection.This issue affects all versions of the sofware also EOS when CVE-ID assigned. CVSSv3.1 9.8 (CRITICAL) · EPSS 28th percentile

CWECWE 89VNDAgtteknikTYPVulnerability
9.8
CVSS v3.1
99
Edit Score