Security Vulnerabilities - CVEs Published In 2023
Dell NetWorker Virtual Edition versions 19.8 and below contain the use of deprecated cryptographic algorithms in the SSH component. A remote unauthenticated attacker could potentially exploit this vulnerability leading to some information disclosure.
CVSS Score
5.3
EPSS Score
0.004
Published
2023-12-18
Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Post Type Page Template.This issue affects Custom Post Type Page Template: from n/a through 1.1.
CVSS Score
4.3
EPSS Score
0.003
Published
2023-12-18
Cross-Site Request Forgery (CSRF) vulnerability in Tribe Interactive Caddy – Smart Side Cart for WooCommerce.This issue affects Caddy – Smart Side Cart for WooCommerce: from n/a through 1.9.7.
CVSS Score
5.4
EPSS Score
0.003
Published
2023-12-18
Cross-Site Request Forgery (CSRF) vulnerability in BinaryCarpenter Menu Bar Cart Icon For WooCommerce By Binary Carpenter.This issue affects Menu Bar Cart Icon For WooCommerce By Binary Carpenter: from n/a through 1.49.3.
CVSS Score
6.5
EPSS Score
0.003
Published
2023-12-18
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.
CVSS Score
4.6
EPSS Score
0.008
Published
2023-12-18
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.
CVSS Score
9.6
EPSS Score
0.008
Published
2023-12-18
The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server.
CVSS Score
3.9
EPSS Score
0.007
Published
2023-12-18
An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server.
CVSS Score
6.8
EPSS Score
0.009
Published
2023-12-18
The api /api/snapshot and /api/get_log_file would allow unauthenticated access.
It could allow a DoS attack or get arbitrary files from FE node.
Please upgrade to 2.0.3 to fix these issues.
CVSS Score
8.2
EPSS Score
0.009
Published
2023-12-18
Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.
CVSS Score
4.8
EPSS Score
0.004
Published
2023-12-18