CVE-2023-43982

CVE-2023-43982 affects Bon Presta boninstagramcarousel versions 5.2.1–7.0.0. A server-side request forgery (SSRF) vulnerability exists in the url parameter of insta_parser.php, allowing an attacker to use the vulnerable site as a proxy to reach other targets or exfiltrate data via HTTP requests. ...

CVE-2023-43982: Server-Side Request Forgery (SSRF)

Bon Presta boninstagramcarousel between v5.2.1 to v7.0.0 was discovered to contain a Server-Side Request Forgery SSRF via the url parameter at instaparser.php. This vulnerability allows attackers to use the vulnerable website as proxy to attack other websites or exfiltrate data via a HTTP call...

Huawei HarmonyOS Security Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from incorrect privilege control of the call module, resulting in compromised confidentialit...

USN-6467-1 krb5 vulnerability

Robert Morris discovered that Kerberos did not properly handle memory access when processing RPC data through kadmind, which could lead to the freeing of uninitialized memory. An authenticated remote attacker could possibly use this issue to cause kadmind to crash, resulting in a denial of servic...

CVE-2023-2622

Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call RPC of the InspectSetup service endpoint. The low privilege client is then allowed to read arbitrary files that they do not have authorization to read...

CVE-2023-2622

Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call RPC of the InspectSetup service endpoint. The low privilege client is then allowed to read arbitrary files that they do not have authorization to read...

Authorization

Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call RPC of the InspectSetup service endpoint. The low privilege client is then allowed to read arbitrary files that they do not have authorization to read...

CVE-2023-2622

Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call RPC of the InspectSetup service endpoint. The low privilege client is then allowed to read arbitrary files that they do not have authorization to read...

CVE-2023-2622

Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call RPC of the InspectSetup service endpoint. The low privilege client is then allowed to read arbitrary files that they do not have authorization to read...

CVE-2023-45899

An issue in the component SuperUserSetuserModuleFrontController:init of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call...

Authentication flaw

An issue in the component SuperUserSetuserModuleFrontController:init of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call...

CVE-2023-45899

An issue in the component SuperUserSetuserModuleFrontController:init of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call...

CVE-2023-45899

An issue in the component SuperUserSetuserModuleFrontController:init of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call...

CVE-2023-36263: Improper Neutralization of Special Elements used in an SQL Command

Prestashop opartlimitquantity 1.4.5 and before is vulnerable to SQL Injection. OpartlimitquantityAlertlimitModuleFrontController::displayAjaxPushAlertMessage has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection...

PT-2023-20547 · Unknown · Inspectsetup

Name of the Vulnerable Software and Affected Versions: InspectSetup service affected versions not specified Description: The issue allows authenticated clients to read arbitrary files on the MAIN Computer system using the remote procedure call RPC of the InspectSetup service endpoint. This enable...

CVE-2023-45899: Incorrect Authorization

An issue in the component SuperUserSetuserModuleFrontController:init of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call...

CVE-2023-42803 BigBlueButton Unrestricted File Upload vulnerability

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension before saving the file, and does not remove it in case of validation failures...

CVE-2023-21340

In Telecomm, there is a possible way to get the call state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21340

In Telecomm, there is a possible way to get the call state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21313

In Core, there is a possible way to forward calls without user knowledge due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...