DEBIAN-CVE-2023-33466

Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrite the configuration, which can be exploited to trigger Remote Code Execution RCE...

CVE-2023-31411

A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. The lack of authentication in the API allows the attacker to potentially compromise the functionality of the EventCam App...

IBM BMC Patrol 安全漏洞

IBM BMC Patrol is an agent technology-based management system from International Business Machines IBM. A security vulnerability exists in IBM BMC Patrol versions prior to 23.1.00, which stems from the fact that agent configurations can be remotely modified and can be exploited by an attacker to...

Apple macOS Ventura 安全漏洞

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Ventura version 13.4, which stems from an application that may be able to retain access to system configuration files even after its privileges have been revoked...

CVE-2023-28656 NGINX Management Suite vulnerability

NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

F5 BIG-IP 安全漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, and load balancing. A security vulnerability exists in F5 BIG-IP that stems from a vulnerability that could allow an authenticated attacker to access configuratio...

PT-2023-12959 · Fortinet · Fortiproxy +1

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 6.0.x through 7.2.0 Description: A missing cryptographic steps vulnerability in the functions that encrypt the DHCP and DNS keys may allow an attacker in possession of the encrypted key to decipher it. This issue...

SUSE CVE-2021-32687

Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. The vulnerability involves changing the...

SUSE CVE-2022-23302

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName...

PT-2023-1648 · B&R · B&R Aprol

Name of the Vulnerable Software and Affected Versions: B&R APROL versions prior to R 4.2-07 Description: The issue is related to insufficient validation of input parameters when changing configuration on the Tbase server, which could result in a buffer overflow. This may lead to Denial-of-Service...

PT-2022-22814 · Wapples · Wapples

Name of the Vulnerable Software and Affected Versions: WAPPLES versions through 6.0 Description: A threat actor could use a hardcoded systemi account to access the system configuration and confidential information, such as SSL keys, via an HTTPS request to the "/webapi/" URI on port 443 or 5001...

Penta Security Systems WAPPLES 信任管理问题漏洞

Penta Security Systems WAPPLES is a logical web application firewall from Penta Security Systems, India. A vulnerability exists in Penta Security Systems WAPPLES version 6.0 and prior versions due to a trust management issue. An attacker could exploit the vulnerability to access system...

PT-2022-16420 · Tcl · Tcl Linkhub Mesh Wi-Fi

Name of the Vulnerable Software and Affected Versions: TCL LinkHub Mesh Wi-Fi MS1G 00 01.00 14 Description: A buffer overflow issue exists in the GetValue functionality. This can be triggered by a specially-crafted configuration value, allowing an attacker to modify the configuration and cause a...

Yokogawa STARDOM 信任管理问题漏洞

Yokogawa STARDOM is a series of intelligent control systems from Yokogawa Electric Yokogawa, Japan. A security vulnerability exists in the Yokogawa STARDOM. An attacker could use this vulnerability to read or change configuration settings or update the controller to tamper with the firmware...

Input validation

A CWE-20: Improper Input Validation vulnerability exists that could cause potential remote code execution when an attacker is able to intercept and modify a request on the same network or has configuration access to an ION device on the network. Affected Products: Wiser Smart, EER21000 & EER21001...

GHSA-8QH4-FGHR-6FXG Improper Limitation of a Pathname to a Restricted Directory in Jenkins Google OAuth Credentials Plugin

An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master...

CVE-2021-3956

A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller XCC firmware affecting XCC devices configured in LDAP Authentication Only Mode and using an LDAP server that supports “unauthenticated bind”, such as Microsoft Active...

GHSA-X55P-6526-XMMP Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

Jenkins before versions 2.44 and 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens SECURITY-362...

CVE-2022-30232

A CWE-20: Improper Input Validation vulnerability exists that could cause potential remote code execution when an attacker is able to intercept and modify a request on the same network or has configuration access to an ION device on the network. Affected Products: Wiser Smart, EER21000 & EER21001...

Inductive Automation Ignition 路径遍历漏洞

Inductive Automation Ignition is a suite of integrated software platforms for SCADA systems from Inductive Automation, Inc. The platform supports SCADA data acquisition and monitoring systems, HMI human machine interface, and more. A path traversal vulnerability exists in Inductive Automation...