CVE-2023-2533
PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Today's curated brief highlights 2 critical vulnerabilities and 27 high-priority updates requiring immediate attention.
PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability - Active in CISA KEV catalog.
Cisco Identity Services Engine Injection Vulnerability - Active in CISA KEV catalog.
Cisco Identity Services Engine Injection Vulnerability - Active in CISA KEV catalog.
N-able N-Central Command Injection Vulnerability - Active in CISA KEV catalog.
N-able N-Central Insecure Deserialization Vulnerability - Active in CISA KEV catalog.
D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability - Active in CISA KEV catalog.
D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability - Active in CISA KEV catalog.
D-Link DNR-322L Download of Code Without Integrity Check Vulnerability - Active in CISA KEV catalog.
RARLAB WinRAR Path Traversal Vulnerability - Active in CISA KEV catalog.
Microsoft Office Excel Remote Code Execution Vulnerability - Active in CISA KEV catalog.
Microsoft Internet Explorer Resource Management Errors Vulnerability - Active in CISA KEV catalog.
The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.0. This is due to the plugin ...
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API end...
The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint in all versions up to, and including, 1
The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via several parameters across multiple AJAX action in all versions up to, and including, 93
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 67
The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the homework
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to unauthorized admin account creation in all versions up to, and including, 67
The Soledad theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8
The The Soledad theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8
Firebird is a relational database
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Vertical scroll slideshow gallery v2 allows Blind SQL Injection
A vulnerability was identified in Tenda AC20 16
Cross-Site Request Forgery (CSRF) vulnerability in iThemes ServerBuddy by PluginBuddy
A vulnerability has been found in Tenda AC20 16
A vulnerability was found in Tenda AC20 16
A vulnerability was determined in Tenda AC20 16
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Risk Yazılım Teknolojileri Ltd
A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability
A maliciously crafted DGN file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability
A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force a Memory Corruption vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS)
Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing
HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries
A vulnerability was found in code-projects Online Medicine Guide 1
A vulnerability has been found in projectworlds Visitor Management System 1
A vulnerability was found in projectworlds Travel Management System 1
A vulnerability was determined in projectworlds Travel Management System 1
A vulnerability was identified in projectworlds Travel Management System 1
A vulnerability has been found in projectworlds Travel Management System 1