Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal. CVSSv3.1 7.2 (HIGH) · EPSS 100th percentile
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries. CVSSv3.1 7.5 (HIGH) · EPSS 100th percentile
An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur. CVSSv3.1 9.8 (CRITICAL) · EPSS 79th percentile
The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in versions up to and including 3.2.7. CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5. CVSSv3.1 8.1 (HIGH) · EPSS 87th percentile
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configuration, the attacker is logged in as that user without access to a username/password pair which is the expected first form of authentication. This affects v CVSSv3.1 9.8 (CRITICAL) · EPSS 89th percentile
Windows Kerberos Remote Code Execution Vulnerability CVSSv3.1 8.1 (HIGH) · EPSS 82th percentile
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional. CVSSv3.1 9.8 (CRITICAL) · EPSS 88th percentile
An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted file. CVSSv3.1 9.8 (CRITICAL) · EPSS 79th percentile
An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file. CVSSv3.1 9.8 (CRITICAL) · EPSS 85th percentile
An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the input_id POST parameter in index.php. CVSSv3.1 9.8 (CRITICAL) · EPSS 94th percentile
Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template injection that leads to remote code execution. CVSSv3.1 8.8 (HIGH) · EPSS 87th percentile
libsixel before 1.10 is vulnerable to Buffer Overflow in libsixel/src/quant.c:867. CVSSv3.1 8.8 (HIGH)
libsixel 1.8.6 suffers from a Heap Use After Free vulnerability in in libsixel/src/dither.c:388. CVSSv3.1 8.8 (HIGH)
libsixel 1.8.6 is affected by Buffer Overflow in libsixel/src/quant.c:876. CVSSv3.1 8.8 (HIGH)
libsixel 1.10.0 is vulnerable to Use after free in libsixel/src/dither.c:379. CVSSv3.1 8.8 (HIGH)
Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling. CVSSv3.1 8.1 (HIGH) · EPSS 93th percentile
Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Missing Authentication. CVSSv3.1 8.8 (HIGH) · EPSS 60th percentile
Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to Plain text command over BLE. CVSSv3.1 8.8 (HIGH) · EPSS 60th percentile
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition. CVSSv3.1 6.5 (MEDIUM) · EPSS 98th percentile
Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages parameter. CVSSv3.1 9.8 (CRITICAL) · EPSS 66th percentile
A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function. CVSSv3.1 9.8 (CRITICAL) · EPSS 84th percentile
Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSION_ID is predictable. An attacker can hijack a valid session and conduct further malicious operations. CVSSv3.1 8.8 (HIGH) · EPSS 73th percentile
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without cookies. CVSSv3.1 9.8 (CRITICAL)
In totolink a3100r V5.9c.4577, the hard-coded telnet password can be discovered from official released firmware. An attacker, who has connected to the Wi-Fi, can easily telnet into the target with root shell if the telnet is function turned on. CVSSv3.1 8.8 (HIGH) · EPSS 64th percentile