CVE & Exploit Intelligence Database

CVE-2023-32615 6.5 MEDIUM EPSS 0.00

A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to arbitrary file creation or overwrite. An attacker can send a sequence of requests to trigger this vulnerability.

CWE-610 Sep 05, 2023

CVE-2023-4749 6.3 MEDIUM EPSS 0.00

A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page leads to file inclusion. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-238638 is the identifier assigned to this vulnerability.

CWE-73 Sep 04, 2023

CVE-2023-20234 4.4 MEDIUM EPSS 0.00

A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to create a file or overwrite any file on the filesystem of an affected device, including system files. The vulnerability occurs because there is no validation of parameters when a specific CLI command is used. An attacker could exploit this vulnerability by authenticating to an affected device and using the command at the CLI. A successful exploit could allow the attacker to overwrite any file on the disk of the affected device, including system files. The attacker must have valid administrative credentials on the affected device to exploit this vulnerability.

CWE-732 Aug 23, 2023

CVE-2023-35384 5.4 MEDIUM EPSS 0.00

Windows HTML Platforms Security Feature Bypass Vulnerability

CWE-73 Aug 08, 2023

CVE-2023-4191 6.3 MEDIUM EPSS 0.00

A vulnerability, which was classified as critical, has been found in SourceCodester Resort Reservation System 1.0. Affected by this issue is some unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-236234 is the identifier assigned to this vulnerability.

CWE-73 Aug 06, 2023

CVE-2023-3643 7.3 HIGH NUCLEI EPSS 0.19

A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. The manipulation of the argument path leads to file inclusion. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-233889 was assigned to this vulnerability.

CWE-73 Jul 12, 2023

CVE-2023-35308 6.5 MEDIUM EPSS 0.01

Windows MSHTML Platform Security Feature Bypass Vulnerability

CWE-73 Jul 11, 2023

CVE-2023-3256 8.8 HIGH EPSS 0.00

Advantech R-SeeNet versions 2.4.22 allows low-level users to access and load the content of local files.

CWE-610 Jun 22, 2023

CVE-2023-28603 7.7 HIGH EPSS 0.00

Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions.

CWE-73 Jun 13, 2023

CVE-2023-0008 4.4 MEDIUM EPSS 0.00

A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition.

CWE-610 May 10, 2023

CVE-2023-29324 6.5 MEDIUM EXPLOITED 1 PoC Analysis EPSS 0.02

Windows MSHTML Platform Security Feature Bypass Vulnerability

CWE-73 May 09, 2023

CVE-2023-2554 7.2 HIGH 1 Writeup EPSS 0.01

External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0.

CWE-73 May 05, 2023

CVE-2023-30943 6.5 MEDIUM 3 PoCs Analysis NUCLEI EPSS 0.16

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.

CWE-610 May 02, 2023

CVE-2023-2152 5.3 MEDIUM 1 Writeup EPSS 0.00

A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226273 was assigned to this vulnerability.

CWE-610 Apr 18, 2023

CVE-2023-1105 8.1 HIGH 1 Writeup EPSS 0.00

External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.

CWE-73 Mar 01, 2023

CVE-2023-1070 7.1 HIGH 1 Writeup EPSS 0.00

External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22.

CWE-73 Feb 27, 2023

CVE-2022-39952 9.8 CRITICAL EXPLOITED 6 PoCs Analysis NUCLEI EPSS 0.94

A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.

CWE-668 Feb 16, 2023

CVE-2023-21566 7.8 HIGH EPSS 0.04

Visual Studio Elevation of Privilege Vulnerability

CWE-73 Feb 14, 2023

CVE-2023-21800 7.8 HIGH EPSS 0.01

Windows Installer Elevation of Privilege Vulnerability

CWE-73 Feb 14, 2023

CVE-2023-0003 6.5 MEDIUM EPSS 0.01

A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.

CWE-610 Feb 08, 2023