CVE-2023-5008 Student Information System v1.0 - Unauthenticated SQL Injection

Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control...

PT-2023-29913 · Curl +6 · Curl +6

Name of the Vulnerable Software and Affected Versions: curl affected versions not specified Description: When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use...

CVE-2023-6512: Inappropriate Encoding for Output Context

Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially spoof the contents of an iframe dialog context menu via a crafted HTML page. Chromium security severity: Low...

Fedora 37 : motif (2023-25329c196b)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-25329c196b advisory. Security fix for CVE-2023-43788 and CVE-2023-43789 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Amazon Linux AMI : libXpm (ALAS-2023-1894)

The version of libXpm installed on the remote host is prior to 3.5.10-2.13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1894 advisory. libXpm: out of bounds read in XpmCreateXpmImageFromBuffer NOTE: https://www.openwall.com/lists/oss-security/2023/10/03/1NOTE: Fix...

GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. GitLab suffers from a security vulnerability that stems from the fact that und...

The vulnerability of the `show_zysync_server_contents` function in the network storage software Zyxel NAS326 and NAS542 allows a hacker to execute arbitrary code.

The vulnerability of the showzysyncservercontents function in Zyxel NAS326 and NAS542 software exists because measures to neutralize special elements used in operating system commands have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending...

Default configuration

OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but c...

CVE-2023-49298

OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but c...

CVE-2023-49298

OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but c...

Table of Contents Plus < 2309 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The Table of Contents Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2302 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-lev...

CVE-2023-49298: Authorization Bypass Through User-Controlled Key

OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but c...

PT-2023-9698 · Nextcloud +1 · Nextcloud Enterprise Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 27.1.10 Nextcloud Server versions prior to 28.0.6 Nextcloud Server versions prior to 29.0.1 Nextcloud Enterprise Server versions prior to 24.0.12.15 Nextcloud Enterprise Server versions prior to 25.0.13.10...

Adobe RoboHelp Server UpdateCommandStream XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe RoboHelp Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UpdateCommandStream method. Due to the improper restriction of XML...

CVE-2023-20526

Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access to expose the contents of ASP memory potentially leading to a loss of confidentiality...

Rocky Linux 8 : samba (RLSA-2022:7111)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:7111 advisory. - A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing...

Fedora 39 : libXpm (2023-c4cf6646b9)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-c4cf6646b9 advisory. libXpm 3.5.17, fixes CVE-2023-43788, CVE-2023-43789, CVE-2023-43786 Tenable has extracted the preceding description block directly from the Fedora...

Fedora 39 : libX11 (2023-06bff5611a)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-06bff5611a advisory. libX11 1.8.7, fixes CVE-2023-43785 to 43789 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessu...

Security Bulletin: IBM Rational Build Forge 8.0.0.24 addresses multiple vulnerabilities by updating OpenSSL

Summary IBM Rational Build Forge 8.0.0.24 addresses multiple vulnerabilities by updating OpenSSL Vulnerability Details CVEID:CVE-2022-4304 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation...

CVE-2022-3702

A denial of service vulnerability was reported in Lenovo Vantage HardwareScan Plugin version 1.3.0.5 and earlier that could allow a local attacker to delete contents of an arbitrary directory under certain conditions...