CVE-2023-24600

CVE-2023-24600 affects OX App Suite. The vulnerability is in versions prior to 7.10.6-rev37, allowing authenticated users to bypass access controls for reading contacts by moving them to their own address book. Impact is information disclosure of contacts; per sources, the issue is mitigated by u...

Microsoft Windows Sysmon Privilege Escalation

The vulnerability of the Microsoft Windows Sysmon system service in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow a hacker to bypass security restrictions and increase their privileges...

CVE-2023-24600

OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls for reading contacts via a move to their own address book...

CVE-2023-32686 kiwitcms vulnerable to stored XSS via unrestricted files upload

Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded...

Apache Superset Access Control Bypass

The vulnerability of the Apache Superset data visualization software is related to the insecure initialization of resources. Exploiting this vulnerability can allow an attacker, operating remotely, to bypass established access controls, provided that the SECRETKEY is set by default...

CVE-2023-2903

A vulnerability classified as problematic has been found in NFine Rapid Development Platform 20230511. This affects an unknown part of the file /SystemManage/Role/GetGridJson?keyword=&page=1&rows=20. The manipulation leads to improper access controls. It is possible to initiate the attack remotel...

CVE-2023-2903 NFine Rapid Development Platform access control

A vulnerability classified as problematic has been found in NFine Rapid Development Platform 20230511. This affects an unknown part of the file /SystemManage/Role/GetGridJson?keyword=&page=1&rows=20. The manipulation leads to improper access controls. It is possible to initiate the attack remotel...

CVE-2023-2901

A vulnerability was found in NFine Rapid Development Platform 20230511. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /SystemManage/User/GetGridJson?search=false&nd=1680855479750&rows=50&page=1&sidx=FCreatorTime+desc&sord=asc. The...

CVE-2023-2902 NFine Rapid Development Platform access control

A vulnerability was found in NFine Rapid Development Platform 20230511. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /SystemManage/Organize/GetTreeGridJson?search=false&nd=1681813520783&rows=10000&page=1&sidx=&sord=asc. The manipulation leads ...

CVE-2023-2902

CVE-2023-2902 affects NFine Rapid Development Platform (version 20230511). The issue lies in the GetTreeGridJson endpoint under SystemManage/Organize, enabling improper access controls that could be exploited remotely. Public exploit information exists per the sources, with confidentiality impact...

CVE-2023-2901

CVE-2023-2901 affects NFine Rapid Development Platform 20230511. The vulnerability exists in an unknown function of the endpoint /SystemManage/User/GetGridJson?... which leads to improper access controls. It is exploitable remotely and, per multiple sources, the exploit has been disclosed publicl...

PT-2023-22084 · Unknown · Nfine Rapid Development Platform

Name of the Vulnerable Software and Affected Versions: NFine Rapid Development Platform version 20230511 Description: A vulnerability has been found in the NFine Rapid Development Platform, affecting an unknown functionality of the file "/SystemManage/User/GetGridJson?...

PT-2023-22092 · Unknown · Nfine Rapid Development Platform

Name of the Vulnerable Software and Affected Versions: NFine Rapid Development Platform version 20230511 Description: A vulnerability was found in the NFine Rapid Development Platform, affecting some unknown functionality of the file "/SystemManage/Organize/GetTreeGridJson?...

Johnson Controls OpenBlue Enterprise Manager Data Collector

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Inc. Equipment: OpenBlue Enterprise Manager Data Collector Vulnerabilities: Improper Authentication, Exposure of Sensitive Information to an Unauthorized Actor 2. RISK EVALUATION...

Code injection

Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can add users to streams, and separately to limit who can invite users to the organization. In Zulip Server 6.1 and below, the UI which allows a user to invite ...

CVE-2023-32677 Users who can send invitations can erroneously add users to streams during invitation in Zulip

Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can add users to streams, and separately to limit who can invite users to the organization. In Zulip Server 6.1 and below, the UI which allows a user to invite ...

CVE-2023-32677 Users who can send invitations can erroneously add users to streams during invitation in Zulip

Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can add users to streams, and separately to limit who can invite users to the organization. In Zulip Server 6.1 and below, the UI which allows a user to invite ...

PT-2023-18746 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue allows a local user to read user credentials stored in plain clear text. Recommendations: For IBM InfoSphere Information Server version 11.7, update the software to a versi...

Hitachi Energy’s MicroSCADA Pro/X SYS600 Products

1. EXECUTIVE SUMMARY CVSS v3 6.7 ATTENTION: Public exploits are available Vendor: Hitachi Energy Equipment: MicroSCADA Pro/X SYS600 Products Vulnerabilities: Permissions, Privileges, and Access Controls 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

CVE-2023-31871

OpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Documentum user to root. The software comes prepackaged with a root owned SUID binary dmsecurewriter. The binary has security controls in place preventing creation of a file in a...