CVE-2023-4417

Improper access controls in the entry duplication component in Devolutions Remote Desktop Manager 2023.2.19 and earlier versions on Windows allows an authenticated user, under specific circumstances, to inadvertently share their personal vault entry with shared vaults via an incorrect vault in th...

CVE-2023-4417

The CVE-2023-4417 issue affects Devolutions Remote Desktop Manager for Windows up to 2023.2.19, caused by improper access controls in the entry duplication component. An authenticated user can, under certain conditions, share a personal vault entry with shared vaults via an incorrect vault during...

PT-2023-29140 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2023.2.19 and earlier Description: The issue is related to improper access controls in the entry duplication component, allowing an authenticated user, under specific circumstances, to inadvertently...

Part III: Implementing Effective Cyber Security Metrics that Reduce Risk Realistically

We outlined some critical cybersecurity metrics in Part I of this three-part blog series. In the final blog post, we will delve into three crucial aspects outlined in Josh’s article: tactical metrics for operational teams, strategic metrics for leadership, and the metrics addressing the...

Broadcom RAID Controller 安全漏洞

The Broadcom RAID Controller is a series of RAID controllers from Broadcom Corporation USA. A security vulnerability exists in the Broadcom RAID Controller, which arises from a vulnerability in the web interface that allows a client to bypass controls and cause unauthorized access to data by a...

Design/Logic Flaw

An issue was discovered in Tigergraph Enterprise 3.7.0. The TigerGraph platform allows users to define new User Defined Functions UDFs from C/C++ code. To support this functionality TigerGraph allows users to upload custom C/C++ code which is then compiled and installed into the platform. An...

Fortinet FortiClient VPN Improper Access Control Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fortinet FortiClient VPN. Authentication is required to exploit this vulnerability. The specific flaw exists within the FortiClient Logging daemon. The product applies insufficient access controls to...

PT-2023-23337

Name of the Vulnerable Software and Affected Versions PRTG versions 23.2.84.1566 and earlier Description A cross-site request forgery CSRF token bypass was identified that allows remote attackers to perform actions with the permissions of a victim user, provided the victim user has an active...

PT-2023-4549

Name of the Vulnerable Software and Affected Versions Node.js versions 16.x through 20.x Description A privilege escalation issue exists in the experimental policy mechanism due to inadequate access controls. This can be exploited by a remote attacker to bypass existing security restrictions. The...

Voice Memos Component Unauthorized Access

The vulnerability of the Voice Memos component of the macOS operating system is related to access control deficiencies. Exploiting this vulnerability could allow a perpetrator to gain unauthorized access to protected information...

Lower Data Breach Insurance Costs with These Tips

The changing attack landscape has resulted in the hardening of the data breach insurance market. Gain insight into how implementing security controls can reduce the mean time to detect and control the costliness of an attack...

PT-2023-4293

Name of the Vulnerable Software and Affected Versions ASP.NET affected versions not specified Description The issue is related to an elevation-of-privilege vulnerability in ASP.NET, which allows attackers to affect the system. This vulnerability is associated with insufficient access controls in...

PT-2023-4297 · Microsoft · Exchange Server

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The issue is related to an elevation of privilege vulnerability in Microsoft Exchange Server, which can be exploited by a remote attacker to elevate their privileges. This...

PT-2023-4249 · Sap · Sap Business One

Name of the Vulnerable Software and Affected Versions: SAP Business One Service Layer version 10.0 Description: The issue is related to insufficient protection of service data in the SAP Business One system, which can be exploited by a remote attacker to disclose protected information. An...

Incorrect Authorization

gitlab is vulnerable to Incorrect Authorization. The vulnerability allows demoted project members to gain access to details on authored merge requests due to improper access controls...

CVE-2023-4183

A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file editupdate.php of the component Password Handler. The manipulation of the argument userid leads to improper access controls. The atta...

CVE-2023-4183

A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file editupdate.php of the component Password Handler. The manipulation of the argument userid leads to improper access controls. The atta...

CVE-2023-4183

The CVE-2023-4183 entry concerns SourceCodester Inventory Management System 1.0, where the file edit_update.php in the Password Handler allows an attacker to manipulate the user_id parameter to bypass access controls. This remote, network-based flaw can impact confidentiality, integrity, and avai...

CVE-2023-4169

A vulnerability was found in Ruijie RG-EW1200G 1.01B1P5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/sys/setpasswd of the component Administrator Password Handler. The manipulation leads to improper access controls. The attack can ...

CVE-2023-4169

A vulnerability was found in Ruijie RG-EW1200G 1.01B1P5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/sys/setpasswd of the component Administrator Password Handler. The manipulation leads to improper access controls. The attack can ...