Do Son CVE-2022-41223 and CVE-2022-40765 can be exploited by a remote authenticated attacker to execute arbitrary code on the system.
Vulnerability
The serious flaw, CVE-2023-20858, carries a CVSS severity score of 9.1, adding to the urgency for organizations to apply available patches.
Horizon3.ai has made public a PoC exploit for CVE-2022-39952 that allows an attacker to create a reverse shell.
Apache Tomcat was vulnerable to Apache Commons FileUpload flaw CVE-2023-24998 as there was no limit to the number of request parts processed
An attacker could exploit the CVE-2022-27677 vulnerability to execute arbitrary code with higher privileges on the system.
Tracked as CVE-2023-23947 (CVSS score of 9.1), the bug exists due to improper authorization, was introduced in Argo CD version v2.3.0-rc1
CVE-2022-39952 could allow unauthenticated threat actors to execute unauthorized code or commands via specifically crafted HTTP requests
A technical analysis of the CVE-2022-44666 bug was published and a PoC exploit has now been created on the Github page.
CVE-2023-0662 is a remote unauthenticated Denial of Service vulnerability and affects the default/production configuration.
an authenticated attacker could exploit the CVE-2023-20009 vulnerability to execute arbitrary commands as root.
Tracked as CVE-2023-20032 with a CVSS score of 9.8, the critical bug exists because of improper bounds checking
RCE Security has been credited with discovering and reporting the bug on January 13 that's been assigned the identifier CVE-2023-0291
An attacker could exploit CVE-2023-25725 to bypass HAProxy's headers processing, thus, could smuggle HTTP requests to the backend server
By executing a specially-crafted program, an authenticated attacker could exploit CVE-2023-21823 to gain SYSTEM privileges.
CVE-2023-23529, the issue has been described by the tech giant as a type confusion issue in the WebKit browser engine
Two security researchers Andrea Pierini & Antonio Cocomazzi announced the release of PoC exploits code targeting the CVE-2023-21746 flaw
CVE-2023-20076 (CVSS score of 7.2) exists because of incomplete sanitization of parameters passed in for activation of an application
Tracked as CVE-2023-25194, Apache Kafka could allow a remote authenticated attacker to execute arbitrary code on the system
Discovered by the security researcher, Erol Guven, CVE-2023-25727 is an XSS attack and affects phpMyAdmin versions prior to 4.9.11 and 5.2.1
CVE-2023-24813 could allow a remote attacker to execute arbitrary code on the system, caused by the unsafe deserialization of data.
The flaw, tracked as CVE-2023-0286, has been described as a type confusion in X.509 GeneralName that allow an attacker to read memory contents
CVE-2023-0669 is described as a remote code injection that requires access to the administrative console of the application.