CVE-2023-3892

CVE-2023-3892 affects MIM Assistant and MIM Client’s DICOM RTst Loading modules, via an improper restriction of XML External Entity (XXE) references. The root cause is handling of XML that can enable entity expansion when processing 3rd‑party private RTst metadata tags, potentially allowing an at...

PT-2023-26687 · Unknown · Client Dicom Rtst Loading Modules +1

Name of the Vulnerable Software and Affected Versions: MIM Assistant and Client DICOM RTst Loading modules affected versions not specified Description: The issue concerns an Improper Restriction of XML External Entity Reference, which allows XML Entity Linking or XML External Entity attacks...

Mozilla Thunderbird < 102.15.1

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 102.15.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2023-40 advisory. - Opening a malicious WebP image could lead to a heap buffer overflow in the content process. We are aware of th...

PT-2023-5418 · Intel · Intel Driver & Support Assistant

Name of the Vulnerable Software and Affected Versions: Intel Driver & Support Assistant affected versions not specified Description: The issue is related to incorrect link resolution before accessing a file in the DSA service of Intel Driver & Support Assistant. This allows a local attacker to...

The vulnerability of the Imagick() function (~/includes/mla-stream-image.php) of the Media Library Assistant plugin of the WordPress content management system allows a hacker to execute arbitrary code.

The vulnerability of the Imagick function /includes/mla-stream-image.php in the Media Library Assistant plugin of the WordPress content management system is related to improper external manipulation of file names or file paths. Exploiting this vulnerability could allow a malicious actor to execut...

CVE-2023-4634

The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mlastreamfile' parameter from the /includes/mla-stream-image.php file,...

CVE-2023-4634

The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mlastreamfile' parameter from the /includes/mla-stream-image.php file,...

CVE-2023-4634

Summary of CVE-2023-4634 : The WordPress plugin Media Library Assistant (versions up to 3.09, fixed in 3.10) is vulnerable to Local File Inclusion and Remote Code Execution due to insufficient validation of file paths passed to the mla_stream_file parameter in includes/mla-stream-image.php, where...

CVE-2023-4634 Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution

The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mlastreamfile' parameter from the /includes/mla-stream-image.php file,...

WordPress plugin Media Library Assistant security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...

WordPress Media Library Assistant Plugin <= 3.09 is vulnerable to Remote Code Execution (RCE)

Software Media Library Assistant Type Plugin Vulnerable versions = 3.09 Fixed in 3.10 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-4634 Patch priority High CVSS severity High 10 Developer Claim ownership PSID a9f84b644a17 Credits Pepitoh Required privilege...

Exploit for CVE-2023-4634

CVE-2023-4634 RCE Exploit for Wordpress Plugin Media-Library P...

CVE-2023-4615

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/download/updateFile endpoint. The issue results from the lack of prope...

CVE-2023-4616

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/thumbnail endpoint. The issue results from the lack of proper validati...

CVE-2023-4615

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/download/updateFile endpoint. The issue results from the lack of prope...

CVE-2023-4614

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/installation/setThumbnailRc endpoint. The issue results from the lack of prope...

Design/Logic Flaw

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/download/updateFile endpoint. The issue results from the lack of prope...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/installation/setThumbnailRc endpoint. The issue results from the lack of prope...

CVE-2023-4616 thumbnail Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/thumbnail endpoint. The issue results from the lack of proper validati...

CVE-2023-4616

CVE-2023-4616 concerns a path traversal in LG LED Assistant’s /api/thumbnail endpoint. The vulnerability stems from insufficient validation of a user-supplied path before performing file operations, enabling an unauthenticated attacker to read sensitive information in the context of the current u...