Important: Red Hat Security Advisory: cups-filters security update

An update for cups-filters is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...

OESA-2023-1315 cups-filters security update

This project provides backends, filters, and other software that was once part of the core CUPS distribution but is no longer maintained by Apple Inc. In addition it contains additional filters and software developed independently of Apple, especially filters for the PDF-centric printing workflow...

CVE-2023-28700

OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator privileges can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt servic...

CVE-2023-28700

Summary: CVE-2023-28700 affects the OMICARD EDM backend system. The file-upload function does not restrict dangerous file types. A LAN attacker with administrator privileges can upload and run arbitrary executables, enabling arbitrary system commands or service disruption. Root cause (as describe...

CVE-2023-3028

Insufficient authentication in the MQTT backend broker allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerabilities were identified: - The MQTT...

Authentication flaw

Insufficient authentication in the MQTT backend broker allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerabilities were identified: - The MQTT...

CVE-2023-3028 Improper backend communication allows access and manipulation of the telemetry data

Insufficient authentication in the MQTT backend broker allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerabilities were identified: - The MQTT...

CVE-2023-3028 Improper backend communication allows access and manipulation of the telemetry data

Insufficient authentication in the MQTT backend broker allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerabilities were identified: - The MQTT...

CVE-2023-3028

CVE-2023-3028 affects the HopeChart HQT-401 telematics unit. The issue is an insufficient authentication flaw in the MQTT backend (broker) that allows unauthorized connections and access to telemetry data across the fleet. Consequences described in connected documents include exposure of sensitiv...

MQTT 授权问题漏洞

MQTT Message Queuing Telemetry Transport is an ISO standard ISO/IEC PRF 20922 based on the Publish/Subscribe paradigm of messaging protocols, which works on the TCP/IP family of protocols, and is designed for remote devices with low hardware performance and poor network conditions. It works on th...

The web app does not verify weak password at backend

Description Access and login to the demo website: https://cloudexplorer-lite-demo.fit2cloud.com/ At changing password function, the backend does not verify weak passwords so that user can do: 1/ Set new password as same as old password. 2/ Set new password by one character, such as 1. This case c...

The vulnerability of the user_list_backend.php script in the Piwigo content management system allows attackers to carry out SQL injection attacks.

The vulnerability of the userlistbackend.php script in the Piwigo content management system is related to the lack of validation for the consistency of XML objects. Exploiting this vulnerability allows a malicious actor to carry out attacks based on SQL injections...

CVE-2023-32689

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a phishing attack vulnerability that involves a user uploading malicious files. A malicious user could upload an HTML file to Parse Server vi...

PT-2023-3469 · Unknown · Omicard Edm +1

Name of the Vulnerable Software and Affected Versions: OMICARD EDM ITPison affected versions not specified OMICARD EDM affected versions not specified Description: The issue is related to the file uploading function in the OMICARD EDM backend system, which does not restrict the upload of files wi...

CVE-2023-24600

OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls for reading contacts via a move to their own address book...

CVE-2023-24599

OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers, aka "ID confusion."...

Design/Logic Flaw

OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of header data...

CVE-2023-24603

CVE-2023-24603 affects Open-Xchange OX App Suite prior to backend 7.10.6-rev37. The vulnerability stems from missing size-limits when downloading data, e.g., a crafted iCal feed could deliver unlimited data, potentially leading to information exposure and resource abuse. Public sources in the con...

CVE-2023-24598

OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of another user...

Debian DSA-5413-1 : sniproxy - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5413 advisory. An issue has been found in sniproxy, a transparent TLS and HTTP layer 4 proxy with SNI support. Due to bad handling of wildcard backend hosts, a crafted HTTP or TLS packet...