| CVE-2022-45448 | | M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource /m4pdf/pdf.php uses templates to dynamically create documents. In the case that the template does not exist, the application will return a fixed document with a message in mpdf format. An attacker could exploit this vulnerability by inputting a valid HTML/CSS document as the value of the parameter. | 2023-09-22T19:33:00 | 2023-09-20T13:15:00 |
| CVE-2023-38876 | | A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'selector' parameter in '/reset-password'. | 2023-09-22T19:25:00 | 2023-09-20T21:15:00 |
| CVE-2023-41834 | | Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content into the HTTP response that is sent to the user's browser.
Users should upgrade to Apache Flink Stateful Functions version 3.3.0. | 2023-09-22T19:24:00 | 2023-09-19T13:16:00 |
| CVE-2023-3892 | | Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity Linking / XML External Entities Blowup.
In order to take advantage of this vulnerability, an attacker must
craft a malicious XML document, embed this document into specific 3rd
party private RTst metadata tags, transfer the now compromised
DICOM object to MIM, and force MIM to archive and load the data.
Users on either version are strongly encouraged to update to an unaffected version (7.2.11+, 7.3.4+).
This issue was found and analyzed by MIM Software's internal security team. We are unaware of any proof of concept or actual exploit available in the wild.
For more information, visit https://www.mimsoftware.com/cve-2023-3892 https://www.mimsoftware.com/cve-2023-3892
This issue affects MIM Assistant: 7.2.10, 7.3.3; MIM Client: 7.2.10, 7.3.3.
| 2023-09-22T19:23:00 | 2023-09-19T15:15:00 |
| CVE-2023-42321 | | Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admincp.php, members.admincp.php, and group.admincp.php files. | 2023-09-22T19:22:00 | 2023-09-20T21:15:00 |
| CVE-2023-42444 | | phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds. | 2023-09-22T19:22:00 | 2023-09-19T15:15:00 |
| CVE-2023-20594 | |
Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.
| 2023-09-22T19:16:00 | 2023-09-20T18:15:00 |
| CVE-2023-38346 | | An issue was discovered in Wind River VxWorks 6.9 and 7. The function ``tarExtract`` implements TAR file extraction and thereby also processes files within an archive that have relative or absolute file paths. A developer using the "tarExtract" function may expect that the function will strip leading slashes from absolute paths or stop processing when encountering relative paths that are outside of the extraction path, unless otherwise forced. This could lead to unexpected and undocumented behavior, which in general could result in a directory traversal, and associated unexpected behavior. | 2023-09-22T19:15:00 | 2023-09-22T19:15:00 |
| CVE-2023-43270 | | dst-admin v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the userId parameter at /home/playerOperate. | 2023-09-22T19:15:00 | 2023-09-22T19:15:00 |
| CVE-2023-41910 | | An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c. | 2023-09-22T19:15:00 | 2023-09-05T07:15:00 |