CVE-2023-4827

The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the fsconnector AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell...

Nutanix power actions failure after the windows patches on Cloud Connector

Following a Windows patch to Cloud Connectors, power actions, and autoscale actions are failing to Nutanix-hosted VDAs. You can see failures relating to the Citrix Remote Broker Provider service, and the Nutanix PlugIn on the Cloud Connectors event logs, XaXdProxy crash linked to the broker...

Elastic Sharepoint Online Python Connector v8.10.3.0 Security Update

Elastic Sharepoint Online Python Connector Improper Access Control ESA-2023-18 An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user is assigned limited access permissions to an item on a...

Apache Kafka Connect API Vulnerability in Bitbucket Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 7.21.0, 8.7.1, 8.8.0, 8.9.0, 8.10.0, 8.11.0, and 8.12.0 of Bitbucket Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 8.8 and a CVSS Vector of...

org.apache.tomcat:tomcat-catalina Vulnerability in Bamboo Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 9.2.2, 9.2.3 and 9.3.0 of Bamboo Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticat...

Fixed in Apache Tomcat JK Connector 1.2.49

Important: Information disclosure CVE-2023-41081 In some circumstances, such as when a configuration included JkOptions +ForwardDirectories but the configuration did not provide explicit mounts for all possible proxied requests, modjk would use an implicit mapping and map the request to the first...

GHSA-P3R5-X3HR-GPG5 OpenRefine Remote Code execution in project import with mysql jdbc url attack

Summary An remote Code exec vulnerability allows any unauthenticated user to exec code on the server. Details Hi,Team, i find openrefine support to import data from database,When use mysql jdbc to connect to database,It is vulnerable to jdbc url attacks,for example,unauthenticated attacker can ge...

OpenRefine Remote Code execution in project import with mysql jdbc url attack

Summary An remote Code exec vulnerability allows any unauthenticated user to exec code on the server. Details Hi,Team, i find openrefine support to import data from database,When use mysql jdbc to connect to database,It is vulnerable to jdbc url attacks,for example,unauthenticated attacker can ge...

PT-2023-28143 · Unknown +2 · Mysql Connector/J +3

Name of the Vulnerable Software and Affected Versions: OpenRefine versions prior to 3.7.5 Description: An arbitrary file read issue allows any unauthenticated user to read a file on a server. This is related to the use of the MySQL JDBC connector, where an attacker can exploit the...

PT-2023-28144 · Unknown +2 · Mysql Connector/J +4

Name of the Vulnerable Software and Affected Versions: OpenRefine versions prior to 3.7.5 Description: A remote code execution issue allows any unauthenticated user to execute code on the server. This is possible due to a vulnerability in the way OpenRefine handles certain database connections,...

CVE-2023-4777

An incorrect permission check in Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier allows attackers with global Item/Configure permission while lacking Item/Configure permission on any particular job to enumerate credentials IDs of credentials stored in Jenkins and to connect to an...

CVE-2023-4777

An incorrect permission check in Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier allows attackers with global Item/Configure permission while lacking Item/Configure permission on any particular job to enumerate credentials IDs of credentials stored in Jenkins and to connect to an...

CVE-2023-4777

CVE-2023-4777 affects Qualys Container Scanning Connector Plugin for Jenkins (versions ≤ 1.6.2.6). The root cause is an incorrect permission check that lets an attacker with global Item/Configure permission, but not per-job Item/Configure, enumerate credential IDs stored in Jenkins and connect to...

The vulnerability of the proxy server of the Zscaler Client Connector allows attackers to circumvent security restrictions and gain increased privileges.

The vulnerability of the Zscaler Client Connector software proxy relates to the unlimited download of dangerous files. Exploiting this vulnerability can allow a hacker to bypass security restrictions and enhance their privileges by sending specially crafted requests...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.4 release and security update

Red Hat JBoss Web Server 5.7.4 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Windows Server. Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System CV...

The vulnerability of the AutoIt module in the ClamAV antivirus software package allows a malicious actor to trigger a service failure. This vulnerability exists in the Cisco Secure Endpoint Connector for Windows protection software.

The vulnerability of the AutoIt module in the ClamAV antivirus software package affects systems for protecting against malicious programs. This issue is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Atlassian Confluence 7.13.15 < 7.13.19 / 7.19.7 < 7.19.11 / 8.1.1 < 8.4.1 DoS (CONFSERVER-90185)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-90185 advisory. - The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If...

WordPress Putler Connector for WooCommerce Plugin <= 2.12.0 is vulnerable to Broken Access Control

Software Putler Connector for WooCommerce Type Plugin Vulnerable versions = 2.12.0 Fixed in 2.13.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40326 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0ccea21ecf23 Credits David...

WordPress Putler Connector for WooCommerce Plugin <= 2.12.0 is vulnerable to Broken Access Control

Software Putler Connector for WooCommerce Type Plugin Vulnerable versions = 2.12.0 Fixed in 2.13.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40327 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID e0681a41f8e1 Credits Davi...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, Inc. in the United States. A security vulnerability exists in versions prior to Google Chrome 116.0.5845.96, which originates from a post-release reuse in the Device Trust Connector, allowing remote attackers to cause the browser to shut down via a...