CVE-2023-50919

Public exploit
An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.
Max CVSS
9.8
EPSS Score
0.11%
Published
2024-01-12
Updated
2024-01-24

CVE-2023-46805

Known exploited
Public exploit
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
Max CVSS
8.2
EPSS Score
96.43%
Published
2024-01-12
Updated
2024-01-22
CISA KEV Added
2024-01-10

CVE-2023-36085

Public exploit
The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect users to arbitrary or malicious locations. This can lead to phishing attacks, malware distribution, and unauthorized access to sensitive resources.
Max CVSS
6.1
EPSS Score
0.05%
Published
2023-10-25
Updated
2024-02-05

CVE-2023-34124

Public exploit
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Max CVSS
9.8
EPSS Score
1.54%
Published
2023-07-13
Updated
2023-09-08

CVE-2023-32479

Public exploit
Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 contain privilege escalation vulnerability due to improper ACL of the non-default installation directory. A local malicious user could potentially exploit this vulnerability by replacing binaries in installed directory and taking reverse shell of the system leading to Privilege Escalation.
Max CVSS
7.8
EPSS Score
0.04%
Published
2024-02-06
Updated
2024-02-13

CVE-2023-28503

Public exploit
Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypass authentication checks and execute OS commands as the root user.
Max CVSS
9.8
EPSS Score
1.34%
Published
2023-03-29
Updated
2023-04-12

CVE-2023-28121

Public exploit
An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.
Max CVSS
9.8
EPSS Score
93.81%
Published
2023-04-12
Updated
2023-12-18

CVE-2023-27350

Known exploited
Public exploit
Used for ransomware
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
Max CVSS
9.8
EPSS Score
97.20%
Published
2023-04-20
Updated
2023-06-07
CISA KEV Added
2023-04-21

CVE-2023-26360

Known exploited
Public exploit
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
Max CVSS
9.8
EPSS Score
96.24%
Published
2023-03-23
Updated
2023-05-01
CISA KEV Added
2023-03-15

CVE-2023-23752

Known exploited
Public exploit
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
Max CVSS
5.3
EPSS Score
95.21%
Published
2023-02-16
Updated
2024-01-09
CISA KEV Added
2024-01-08

CVE-2023-21839

Known exploited
Public exploit
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Max CVSS
7.5
EPSS Score
95.85%
Published
2023-01-18
Updated
2023-06-12
CISA KEV Added
2023-05-01

CVE-2023-7028

Public exploit
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
Max CVSS
10.0
EPSS Score
80.72%
Published
2024-01-12
Updated
2024-03-04

CVE-2023-6538

Public exploit
SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in Storage, Server or combined Server+Storage administrative roles are able to access SMU configuration backup, that would normally be barred to those specific administrative roles.
Max CVSS
7.6
EPSS Score
0.74%
Published
2023-12-11
Updated
2023-12-14

CVE-2023-5808

Public exploit
SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a Storage administrative role are able to access HNAS configuration backup and diagnostic data, that would normally be barred to that specific administrative role.
Max CVSS
7.6
EPSS Score
0.05%
Published
2023-12-05
Updated
2023-12-12

CVE-2022-37393

Public exploit
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.
Max CVSS
7.8
EPSS Score
0.11%
Published
2022-08-16
Updated
2022-08-18

CVE-2022-37042

Known exploited
Public exploit
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
Max CVSS
9.8
EPSS Score
97.54%
Published
2022-08-12
Updated
2022-10-28
CISA KEV Added
2022-08-11

CVE-2022-22956

Public exploit
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.
Max CVSS
9.8
EPSS Score
0.21%
Published
2022-04-13
Updated
2023-04-19

CVE-2022-3229

Public exploit
Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage this now-unauthenticated access to run code of the attacker's choosing.
Max CVSS
9.8
EPSS Score
2.38%
Published
2023-02-06
Updated
2023-02-15

CVE-2022-3218

Public exploit
Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution.
Max CVSS
9.8
EPSS Score
91.64%
Published
2022-09-19
Updated
2022-10-01

CVE-2022-0824

Public exploit
Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.
Max CVSS
9.0
EPSS Score
97.22%
Published
2022-03-02
Updated
2022-11-21

CVE-2022-0492

Public exploit
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
Max CVSS
7.8
EPSS Score
9.52%
Published
2022-03-03
Updated
2023-12-07

CVE-2021-40539

Known exploited
Public exploit
Used for ransomware
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
Max CVSS
9.8
EPSS Score
97.50%
Published
2021-09-07
Updated
2021-11-29
CISA KEV Added
2021-11-03

CVE-2021-38648

Known exploited
Public exploit
Open Management Infrastructure Elevation of Privilege Vulnerability
Max CVSS
7.8
EPSS Score
96.24%
Published
2021-09-15
Updated
2023-12-28
CISA KEV Added
2021-11-03

CVE-2021-38647

Known exploited
Public exploit
Used for ransomware
Open Management Infrastructure Remote Code Execution Vulnerability
Max CVSS
9.8
EPSS Score
97.47%
Published
2021-09-15
Updated
2023-12-28
CISA KEV Added
2021-11-03

CVE-2021-34523

Known exploited
Public exploit
Used for ransomware
Microsoft Exchange Server Elevation of Privilege Vulnerability
Max CVSS
9.8
EPSS Score
72.23%
Published
2021-07-14
Updated
2024-02-13
CISA KEV Added
2021-11-03
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!