KLA62389 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Security Update. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, gain privileges, overwrite arbitrary files, cause denial of service, spoof user interface. Below is a...

About the security content of tvOS 17.2

About the security content of tvOS 17.2 This document describes the security content of tvOS 17.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

Information Disclosure

Mattermost is vulnerable to Information Disclosure. The vulnerability is due to the exposure of channel IDs in the metrics endpoint response. This could allow an attacker to expose sensitive information that they are not explicitly authorized to have access to...

CVE-2023-6459 Public endpoint /metrics of Calls plugin reveals channel IDs

Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint is revealing channelIDs...

SUSE CVE-2023-42456

Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout has passed will the user have to...

iDSecure Auth Bypass Privilege Escalation

The vulnerability of the iDSecure access control system is related to deficiencies in the authentication process when processing the passwordCustom parameter for the uploaded iDS-Core.dll library. Exploiting this vulnerability allows an attacker to bypass the authentication process, gain...

CVE-2023-33041

Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids...

Design/Logic Flaw

Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids...

CVE-2023-33041: Reachable Assertion

Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids...

PT-2023-24157 · Unknown · Wlan Firmware

Name of the Vulnerable Software and Affected Versions: WLAN Firmware affected versions not specified Description: The issue arises under certain scenarios where the WLAN Firmware reaches an assertion due to state confusion while looking up peer ids. There is no information provided about the...

Mattermost Information Disclosure Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an information disclosure vulnerability that stems from the inability to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint, which can be exploited by...

CVE-2023-6329: Improper Authentication

An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a "passwordCustom" option that allows an unauthenticated attacker to compute valid credentials that can be used to bypass authentication and act as an administrative use...

Design/Logic Flaw

Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This iss...

CVE-2023-4677 Unauthenticated Admin Account Takeover Via Cron Log File Backups

Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This iss...

CVE-2023-4677: Improper Authentication

Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This iss...

PT-2023-29977 · Prestashop · Motivationsale

Name of the Vulnerable Software and Affected Versions: motivationsale module for PrestaShop versions prior to 3.5.0 Description: The issue concerns a SQL injection flaw in the motivationsaleDataModel::getProductsByIds method, allowing a guest to execute sensitive SQL calls with a simple HTTP...

Survey Maker Plugin SQLi

The vulnerability of the Survey Maker plugin of the WordPress content management system is related to the lack of protection for the SQL query structure when processing the surveysids parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

Understanding the Phobos affiliate structure and activity

Cisco Talos recently identified the most prolific Phobos variants, common affiliate tactics, techniques and procedures TTPs, and characteristics of the Phobos affiliate structure, based on observed Phobos activity and analysis of over 1,000 Phobos samples from VirusTotal dating back to 2019. We...

shadow-utils security and bug fix update

2:4.6-19 - gpasswd: fix password leak. Resolves: 2215947 2:4.6-18 - Update patch to close label to reset libselinux state. Resolves: 1984740 - useradd: check if subid range exists for user. Resolves: 2012929 - findnewguid: Skip over IDs that are reserved for legacy reasons. Resolves: 1994269...

Elementor Addon Elements < 1.12.8 - Unauthenticated Post ID/Tile Disclosure

Description The plugin does not have authorisation in its ajaxeaepostdata function, allowing unauthenticated users to retrieve arbitrary posts/pages such as draft, private etc IDs and tiles...