2208 matches found
CVE-2023-50459
CVE-2023-50459 corresponds to a Broken Access Control issue in the TYPO3 extension femanager (in2code). The connected advisories identify the vulnerable components as the check_edit_user component (improper access checks) and a missing backend access check, enabling an authenticated frontend user...
CVE-2021-44910
CVE-2021-44910 is described in the NUCLEI template as an information-leak issue in the SpringBlade framework. The root cause is a default SIGN_KEY used for JWT signing, which can be exploited to forge tokens and access sensitive data (e.g., user credentials, password hashes, and logs) within Spri...
CVE-2023-50462
The connected sources confirm CVE-2023-50462 corresponds to an Insecure Direct Object Reference (IDOR) in the TYPO3 extension Content Consent (content_consent). Root cause: the extension fails to verify whether a requested content element identifier is permitted, allowing unauthenticated users to...
CVE-2023-50461
CVE-2023-50461 corresponds to a TYPO3 Direct Mail extension vulnerability. The Direct Mail backend’s Configuration module allows an authenticated backend user to write arbitrary TSConfig for folders configured as Direct Mail, which can lead to Configuration Injection and Arbitrary Code Execution....
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.20 (SUSE-SU-2023:4708-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4708-1 advisory. Update to go1.20.12: - CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// sche...
CVE-2023-43020
CVE-2023-43020 is evidenced in IBM bulletins as a denial-of-service vulnerability in IBM Db2 (including Db2 Connect Server) when processing a specially crafted query. Affected products span Db2 on Linux/UNIX/Windows (versions 10.5, 11.1, 11.5; Db2 Big SQL is also listed in related bulletins). The...
CVE-2021-26292
The CVE-2021-26292 entry maps to AfterLogic Aurora and WebMail Pro
MGASA-2023-0323 Fix u-boot reading file would overwrite reserved memory error
U-boot would not boot after upgrading to 2023.01 version on RPI 4/CM4 boards. Log would report: - Found EFI removable media binary efi/boot/bootaa64.efi - Reading file would overwrite reserved memory The updated package allows u-boot to load properly bootaa64.efi...
Fix u-boot reading file would overwrite reserved memory error
U-boot would not boot after upgrading to 2023.01 version on RPI 4/CM4 boards. Log would report: - Found EFI removable media binary efi/boot/bootaa64.efi - Reading file would overwrite reserved memory The updated package allows u-boot to load properly bootaa64.efi...
CVE-2023-39120
Nodogsplash is affected by a directory traversal vulnerability (CVE-2023-39120) that also impacts OpenWrt. The issue allows remote attackers to read arbitrary files from the target system and is mitigated by upgrading Nodogsplash to version 5.0.1. The Nuclei template notes the vulnerability and s...
CVE-2023-1434
Odoo prior to 16.0 is vulnerable to CVE-2023-1434 due to an incorrect Content-Type on an API endpoint, enabling Cross-Site Scripting. The NUCLEI template notes the issue affects versions before 16.0 and describes the root cause as a mis-set content type in an API handler. Impactally, successful e...
CVE-2021-27748
CVE-2021-27748 is associated with IBM WebSphere HCL Digital Experience and represents a Server-Side Request Forgery (SSRF) vulnerability that affects on‑premise deployments and containerized environments. The Nuclei template flags an SSRF issue in WebSphere DX, enabling an attacker to bypass secu...
CVE-2021-28854
VICIdial Web Client is reported vulnerable to information disclosure (CVE-2021-28854). The Nuclei template describes that sensitive files are accessible from the client side, including mysqli logs, auth logs, debug information, login attempts (successful and unsuccessful) with IPs, User-Agents, a...
CVE-2021-28073
CVE-2021-28073 corresponds to an authentication bypass in ntopng <= 4.2. The Nuclei template describes a vulnerability in ntopng that could allow unauthorized access to sensitive information due to bypassing authentication. Affected product: ntopng (network traffic monitor) with version
CVE-2018-10818
Connected document details confirm CVE-2018-10818 affects LG NAS devices, via a pre-auth remote command injection in the password parameter exposed through the /system/sharedir.php endpoint. The attack vector is unauthenticated and could enable arbitrary code execution on affected devices. Concre...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.20 (SUSE-SU-2023:4470-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4470-1 advisory. go1.20.11 released 2023-11-07 includes security fixes to the path/filepath package, as well as b...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.21 (SUSE-SU-2023:4471-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4471-1 advisory. go1.21.4 released 2023-11-07 includes security fixes to the path/filepath package, as well as bu...
cups security and bug fix update
1:2.2.6-54 - RHEL-2612 - cups pulls an unneeded dependency on python3 1:2.2.6-53 - CVE-2023-32360 cups: Information leak through Cups-Get-Document operation 1:2.2.6-52 - 2217178 - Delays printing to lpd when reserved ports are exhausted - 2217283 - The command 'cancel -x ' does not remove job fil...
CVE-2023-40118
CVE-2023-40118 is addressed in ChromeOS updates as part of the Android Runtime Container security fixes. The connected ChromeOS release notes indicate CVE-2023-40118 was fixed as a Medium severity issue on impacted platforms within the Android Runtime Container, in the context of the ChromeOS Sta...