NVD disclosure day
CVE-2023-34944
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An arbitrary file upload vulnerability exists in Chamilo's file upload component, allowing unauthenticated attackers to execute arbitrary code by uploading a crafted SVG file. This could compromise the confidentiality, integrity, and availability of the learning management system.
CVE-2023-31541
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in a CKEditor plugin for Redmine allows unrestricted file uploads to the server. If the vulnerable feature is accessible, attackers could upload arbitrary files, potentially leading to server compromise. The primary concern is to determine if this plugin is deployed within Redmine environments.
CVE-2023-20867
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability in VMware Tools may affect the confidentiality and integrity of guest virtual machines. An attacker with root access to a compromised ESXi host could bypass authentication for host-to-guest operations. This presents a risk to guest data.
CVE-2023-35064
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An external attacker could exploit a security flaw in Satos Mobile to gain unauthorized access to the system's database. This could allow them to extract sensitive customer information or user credentials, creating a risk of data exposure.
CVE-2023-3050
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An external attacker can exploit TMT Lockcell by tampering with login data to bypass security and impersonate authorized users. This allows them to gain unauthorized access to sensitive administrative dashboards and organizational data.
CVE-2023-3049
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An external attacker can bypass file security in TMT Lockcell to execute unauthorized commands, potentially gaining full control over the host server. This access exposes sensitive data and threatens the integrity of our core business operations.
CVE-2023-3048
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A critical flaw in TMT Lockcell firmware lets anyone bypass security, potentially gaining full control. Update immediately to protect your physical access systems.
CVE-2023-3047
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical flaw in TMT Lockcell allows unauthorized access and control by injecting malicious commands. This vulnerability could let attackers steal sensitive data or take over your systems remotely.
CVE-2023-27997
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Certain versions of Fortinet SSL-VPN are affected by a heap-based buffer overflow vulnerability, allowing remote attackers to execute arbitrary code or commands. This poses a significant risk of unauthorized system compromise and data access for affected organizations.