Design/Logic Flaw

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install...

CVE-2023-36097

CVE-2023-36097 affects FunAdmin v3.3.2 and v3.3.3. The issue is an insecure file upload in the plugin installation process, caused by insufficient validation/restrictions on uploaded plugin files. This vulnerability allows an attacker to upload malicious files via the local install mechanism, pot...

Ubuntu: Security Advisory (USN-6170-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-2784

Mattermost fails to verify if the requestor is a sysadmin or not, before allowing install requests to the Apps allowing a regular user send install requests to the Apps...

Code injection

Mattermost fails to verify if the requestor is a sysadmin or not, before allowing install requests to the Apps allowing a regular user send install requests to the Apps...

CVE-2023-2784

Mattermost suffers from an authorization issue in the Apps install flow: the server does not verify whether the requestor is a sysadmin before accepting install requests to Apps, enabling regular users to initiate installation via the Apps API endpoint. This is documented across multiple sources ...

CVE-2023-2784 Apps Framework allows install requests from regular members via an internal path

Mattermost fails to verify if the requestor is a sysadmin or not, before allowing install requests to the Apps allowing a regular user send install requests to the Apps...

CVE-2023-2784 Apps Framework allows install requests from regular members via an internal path

Mattermost fails to verify if the requestor is a sysadmin or not, before allowing install requests to the Apps allowing a regular user send install requests to the Apps...

CVE-2023-2784 Apps Framework allows install requests from regular members via an internal path

Mattermost fails to verify if the requestor is a sysadmin or not, before allowing install requests to the Apps allowing a regular user send install requests to the Apps...

KLA50362 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in WebRTC can be exploited to cause denial of service or...

Microsoft Security Advisory CVE-2023-33126: .NET Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2023-33126: .NET Remote Code Execution Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update thei...

.NET Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2023-33128: .NET Remote Code Execution Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0. This advisory also provides guidance on what developers can do to update their application...

Ricoh Printer Driver Packager NX 数据伪造问题漏洞

Ricoh Printer Driver Packager NX is a tool for IT managers at Ricoh Japan to customize and package printer drivers. A security vulnerability exists in Ricoh Printer Driver Packager NX versions v1.0.02 through v1.1.25, which originated when administrator privileges are required for the installatio...

CVE-2023-2280

The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajaxpublic' function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete or change plugin...

CVE-2023-0832

The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incorrect nonce validation on the installweglot function called via the adminactioninstallweglot action. This makes it possible for...

CVE-2023-0832

The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incorrect nonce validation on the installweglot function called via the adminactioninstallweglot action. This makes it possible for...

Cross site request forgery (csrf)

The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incorrect nonce validation on the installweglot function called via the adminactioninstallweglot action. This makes it possible for...

CVE-2023-0832 Under Construction <= 3.96 - Cross-Site Request Forgery via admin_action_install_weglot

The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incorrect nonce validation on the installweglot function called via the adminactioninstallweglot action. This makes it possible for...

Fedora: Security Advisory for curl (FEDORA-2023-8ed627bb04)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-36719

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lpccaddonsactions function. This makes it possible for unauthenticated attacker...