CVE-2023-27868

IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked class instantiation when providing plugin classes. By sending a specially crafted request using the named...

Best Fee Management System 权限许可和访问控制问题漏洞

Best Fee Management System is a fee management system by Mayuri K. Individual developer. Best Fee Management System version 1.0 has a permissions licensing and access control issue vulnerability that stems from the saveuser function in the adminclass.php file that results in incorrect access...

PT-2023-25406 · Sourcecodester · Sourcecodester Best Pos Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Fee Management System version 1.0 Description: A critical issue has been found, affecting the function save user of the file admin class.php in the component Add User Handler. This leads to improper access controls, allowi...

CVE-2023-27868: Improper Control of Generation of Code

IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked class instantiation when providing plugin classes. By sending a specially crafted request using the named...

CVE-2023-25097

Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these...

Security Bulletin: IBM Match 360 is vulnerable to SnakeYaml's Constructor() class that not restrict types which can be instantiated during deserialization (CVE-2022-1471)

Summary SnakeYaml's Constructor class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict...

PT-2023-5070

Name of the Vulnerable Software and Affected Versions Milesight UR32L version 32.3.0.5 Description Multiple buffer overflow vulnerabilities exist in the vtysh ubus binary due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacke...

PT-2023-5069 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: The issue is caused by multiple buffer overflow vulnerabilities in the vtysh ubus binary due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code...

ASB-A-275340417

In Policy of Policy.java, there is a possible boot loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

Denial Of Service (DoS)

io.netty:netty-handler is vulnerable to Denial of Service DoS attacks. During TLS handshakes, the SniHandler class can allocate up to 16MB of heap for each channel. The SniHandler is used to establish a TCP server when the handler or channel has no idle timeout. In order to configure an SSL handl...

Medium: glib2

Issue Overview: PCRE before 8.38 mishandles the : and \ substrings in character classes, which allows remote attackers to cause a denial of service uninitialized memory read or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object...

CVE-2023-1722

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators...

Authentication flaw

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators...

CVE-2023-1722 Yoga Class Registration System 1.0 - ATO

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators...

CVE-2023-1722

CVE-2023-1722 concerns the Yoga Class Registration System 1.0, where an administrator can execute commands on the server. The root cause, as described across multiple sources, is improper validation of uploaded class thumbnails by administrators, enabling arbitrary command execution. The vulnerab...

CVE-2023-1721

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators...

Authentication flaw

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators...

CVE-2023-1722: Cross-Site Request Forgery (CSRF)

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators...

PT-2023-17191

Name of the Vulnerable Software and Affected Versions Yoga Class Registration System version 1.0 Description The issue allows an administrator to execute commands on the server due to incorrect validation of thumbnails of classes uploaded by administrators. Recommendations For Yoga Class...

CVE-2023-1721 Yoga Class Registration System 1.0 - RCE

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators...