CVE Arsenal Intel

CVE-2023-35082

🔥 KEV EPMM General ⚡ nuclei

10.0

CRITICAL

EPSS

94.4%

2023 1 PoC

An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.

nuclei -t CVE-2023-35082.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2023-3765

mlflow/mlflow General ⚡ nuclei

10.0

CRITICAL

EPSS

91.5%

2023 CWE-36 1 PoC

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.

nuclei -t CVE-2023-3765.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2023-40044

🔥 KEV WS_FTP Server General ⚡ nuclei

10.0

CRITICAL

EPSS

94.4%

2023 CWE-502 6 PoCs

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

nuclei -t CVE-2023-40044.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 ↗ PoC 5 ↗ PoC 6 🔍 GCVE ⚔ EDB

CVE-2023-2356

mlflow/mlflow General ⚡ nuclei

10.0

CRITICAL

EPSS

90.5%

2023 CWE-23 1 PoC

Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.

nuclei -t CVE-2023-2356.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2023-6018

mlflow/mlflow General ⚡ nuclei

10.0

CRITICAL

EPSS

91.3%

2023 CWE-78 0 PoCs

An attacker can overwrite any file on the server hosting MLflow without any authentication.

nuclei -t CVE-2023-6018.yaml ⎘

🔍 GCVE ⚔ EDB

CVE-2023-6977

mlflow/mlflow General ⚡ nuclei

10.0

CRITICAL

EPSS

83.0%

2023 CWE-29 1 PoC

This vulnerability enables malicious users to read sensitive files on the server.

nuclei -t CVE-2023-6977.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2023-35078

🔥 KEV Endpoint Manager Mobile General ⚡ nuclei

10.0

CRITICAL

EPSS

94.4%

2023 10 PoCs

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

nuclei -t CVE-2023-35078.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 ↗ PoC 5 ↗ PoC 6 +4 más 🔍 GCVE ⚔ EDB

CVE-2023-51409

AI Engine: ChatGPT Chatbot General ⚡ nuclei

10.0

CRITICAL

EPSS

92.9%

2023 CWE-434 4 PoCs

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 1.9.98.

nuclei -t CVE-2023-51409.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 🔍 GCVE ⚔ EDB

CVE-2023-22527

🔥 KEV Confluence Data Center General ⚡ nuclei

10.0

CRITICAL

EPSS

94.4%

2023 27 PoCs

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

nuclei -t CVE-2023-22527.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 ↗ PoC 5 ↗ PoC 6 +21 más 🔍 GCVE ⚔ EDB

CVE-2023-3710

PM23/43 General ⚡ nuclei

9.9

CRITICAL

EPSS

91.7%

2023 CWE-20 3 PoCs

Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).

nuclei -t CVE-2023-3710.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 🔍 GCVE ⚔ EDB

CVE-2023-48777

Elementor Website Builder General ⚡ nuclei

9.9

CRITICAL

EPSS

88.8%

2023 CWE-434 1 PoC

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor.Com Elementor Website Builder.This issue affects Elementor Website Builder: from 3.3.0 through 3.18.1.

nuclei -t CVE-2023-48777.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2023-2780

mlflow/mlflow General ⚡ nuclei

9.8

CRITICAL

EPSS

86.8%

2023 CWE-29 1 PoC

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.

nuclei -t CVE-2023-2780.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2023-0297

pyload/pyload General ⚡ nuclei

9.8

CRITICAL

EPSS

93.4%

2023 CWE-94 11 PoCs

Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.

nuclei -t CVE-2023-0297.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 ↗ PoC 5 ↗ PoC 6 +5 más 🔍 GCVE ⚔ EDB

CVE-2023-1671

🔥 KEV Sophos Web Appliance General ⚡ nuclei

9.8

CRITICAL

EPSS

94.3%

2023 6 PoCs

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.

nuclei -t CVE-2023-1671.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 ↗ PoC 5 ↗ PoC 6 🔍 GCVE ⚔ EDB

CVE-2023-37999

HT Mega General ⚡ nuclei

9.8

CRITICAL

EPSS

53.8%

2023 CWE-269 0 PoCs

Improper Privilege Management vulnerability in HasThemes HT Mega allows Privilege Escalation.This issue affects HT Mega: from n/a through 2.2.0.

nuclei -t CVE-2023-37999.yaml ⎘

🔍 GCVE ⚔ EDB

CVE-2023-34048

🔥 KEV VMware vCenter Server General ⚡ nuclei

9.8

CRITICAL

EPSS

93.2%

2023 1 PoC

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.

nuclei -t CVE-2023-34048.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2023-30869

Easy Digital Downloads General ⚡ nuclei

9.8

CRITICAL

EPSS

50.1%

2023 CWE-287 0 PoCs

Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1.

nuclei -t CVE-2023-30869.yaml ⎘

🔍 GCVE ⚔ EDB

CVE-2023-6329

iDSecure General ⚡ nuclei

9.8

CRITICAL

EPSS

92.5%

2023 CWE-287 1 PoC

An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a "passwordCustom" option that allows an unauthenticated attacker to compute valid credentials that can be used to bypass authentication and act as an administrative user.

nuclei -t CVE-2023-6329.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2023-38203

🔥 KEV ColdFusion General ⚡ nuclei

9.8

CRITICAL

EPSS

94.2%

2023 CWE-502 1 PoC

Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

nuclei -t CVE-2023-38203.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2023-32117

Integrate Google Drive General ⚡ nuclei

9.8

CRITICAL

EPSS

89.4%

2023 CWE-862 1 PoC

Missing Authorization vulnerability in SoftLab Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integrate Google Drive: from n/a through 1.1.99.

nuclei -t CVE-2023-32117.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB