CVE & Exploit Intelligence Database

CVE-2021-26737 5.5 MEDIUM EPSS 0.00

The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileges may be able to shutdown the Zscaler tunnel by exploiting a race condition.

CWE-346 Oct 23, 2023

CVE-2021-26735 6.7 MEDIUM EPSS 0.00

The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to execute code with SYSTEM privileges.

CWE-428 Oct 23, 2023

CVE-2023-44190 6.1 MEDIUM EPSS 0.00

An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016 devices allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device. This issue affects Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016: * All versions prior to 21.4R3-S5-EVO; * 22.1 versions prior to 22.1R3-S4-EVO; * 22.2 versions 22.2R1-EVO and later; * 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO; * 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO; * 23.2 versions prior to 23.2R1-S1-EVO, 23.2R2-EVO.

CWE-346 Oct 11, 2023

CVE-2023-44189 6.1 MEDIUM EPSS 0.00

An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10003 Series allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device. This issue affects Juniper Networks Junos OS Evolved on PTX10003 Series: * All versions prior to 21.4R3-S4-EVO; * 22.1 versions prior to 22.1R3-S3-EVO; * 22.2 version 22.2R1-EVO and later versions; * 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO; * 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO; * 23.2 versions prior to 23.2R2-EVO.

CWE-346 Oct 11, 2023

CVE-2023-3654 9.4 CRITICAL EPSS 0.00

cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a origin bypass via the host header in an HTTP request. This vulnerability can be triggered by an HTTP endpoint exposed to the network.

CWE-346 Oct 03, 2023

CVE-2023-2848 8.0 HIGH 1 Writeup EPSS 0.00

Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a missing header validation.

CWE-346 Sep 14, 2023

CVE-2023-29505 4.3 MEDIUM EPSS 0.00

An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cross-site WebSocket hijacking.

CWE-346 Aug 04, 2023

CVE-2023-4045 5.3 MEDIUM EPSS 0.00

Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

CWE-346 Aug 01, 2023

CVE-2022-4917 4.3 MEDIUM EPSS 0.00

Incorrect security UI in Notifications in Google Chrome on Android prior to 103.0.5060.53 allowed a remote attacker to obscure the full screen notification via a crafted HTML page. (Chromium security severity: Low)

CWE-346 Jul 29, 2023

CVE-2023-30949 4.3 MEDIUM EPSS 0.00

A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks.

CWE-346 Jul 26, 2023

CVE-2023-2850 4.7 MEDIUM 1 Writeup EPSS 0.00

NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.

CWE-346 Jul 25, 2023

CVE-2023-3581 6.2 MEDIUM EPSS 0.00

Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs.

CWE-346 Jul 17, 2023

CVE-2023-21260 5.5 MEDIUM EPSS 0.00

In notification access permission dialog box, malicious application can embedded a very long service label that overflow the original user prompt and possibly contains mis-leading information to be appeared as a system message for user confirmation.

CWE-346 Jul 13, 2023

CVE-2023-37210 6.5 MEDIUM EPSS 0.00

A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115.

CWE-346 Jul 05, 2023

CVE-2023-32223 8.8 HIGH EPSS 0.00

D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method.

CWE-346 Jun 28, 2023

CVE-2023-32553 5.3 MEDIUM EPSS 0.00

An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to disclose sensitive information on agents. This is similar to, but not identical to CVE-2023-32552.

CWE-346 Jun 26, 2023

CVE-2023-28191 5.5 MEDIUM EPSS 0.00

This issue was addressed with improved redaction of sensitive information. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. An app may be able to bypass Privacy preferences.

CWE-346 Jun 23, 2023

CVE-2022-46718 5.5 MEDIUM EXPLOITED 1 PoC Analysis EPSS 0.00

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, macOS Monterey 12.6.2. An app may be able to read sensitive location information

CWE-346 Jun 23, 2023

CVE-2022-42860 5.5 MEDIUM EPSS 0.00

This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Monterey 12.6.1, macOS Big Sur 11.7.1, macOS Ventura 13. An app may be able to modify protected parts of the file system

CWE-346 Jun 23, 2023

CVE-2023-29711 9.8 CRITICAL 1 Writeup EPSS 0.00

An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request.

CWE-346 Jun 22, 2023