Fortinet Fortigate Authenticated user null pointer dereference in SSL-VPN (FG-IR-23-015)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-23-015 advisory. - A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before...

Denial Of Service (DoS)

Struts 2 Core is vulnerable to Denial Of Service DoS. The vulnerability exists due to improper list bound checks during a multipart request with non-file form fields. An attacker can submit a crafted request, resulting in an out of memory error if the struts.multipart.maxSize is a value greater o...

IBM Security Directory Suite 操作系统命令注入漏洞

IBM Security Directory Suite is a scalable, standards-based identity platform from International Business Machines IBM that simplifies identity and directory management. An operating system command injection vulnerability exists in IBM Security Directory Suite VA, which can be exploited by an...

CVE-2023-32731

A flaw was found in gRPC. This flaw allows a remote attacker to obtain sensitive information, caused by a flaw when the gRPC HTTP2 stack raised a header size exceeded error. By sending a specially crafted request, an attacker can obtain sensitive information, and use this information to launch...

CVE-2023-33604

Imperial CMS v7.5 was discovered to contain an arbitrary file deletion vulnerability via the DelspReFile function in /sp/ListSp.php. This vulnerability is exploited by attackers via a crafted POST request...

The vulnerability of D-Link DSL-3782 router’s microprogramming software allows a hacker to bypass the authentication process and gain access to confidential information.

The vulnerability of the D-Link DSL-3782 router’s microprogramming software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process and gain access to confidential information through a specially crafted...

The vulnerability of the LoginPassword function in the application software interface of D-Link DIR-2150 router software allows a hacker to bypass existing security restrictions.

The vulnerability of the LoginPassword function in the application software interface of D-Link DIR-2150 router software relates to the bypassing of authentication processes. Exploiting this vulnerability allows an attacker to circumvent existing security restrictions by using a specially created...

Denial Of Service (DoS)

proxy is vulnerable to Denial of Service DoS attacks. A malicious user is able to cause a TypeError exception via sending a crafted HTTP request through the socket.remoteAddress variable, resulting in denial of service conditions...

Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery (CSRF)

The plugin does not protect the ajax actions azhaddpost, azhduplicatepost, azhupdatepost and azhremovepost against CSRF attacks, allowing an unauthenticated attacker to add, modify and delete posts by tricking a logged in user to submit a crafted request...

Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery (CSRF) to Stored XSS

The plugin does not protect the ajax actions azhsave against CSRF attacks, allowing an unauthenticated attacker to modify posts by tricking a logged in user with rights to edit the post to submit a crafted request. Furthermore if the targeted user has a role of editor or above, arbitrary web...

CVE-2023-30285

An issue in Deviniti Issue Sync Synchronization v3.5.2 for Jira allows attackers to obtain the login credentials of a user via a crafted request sent to /rest/synchronizer/1.0/technicalUser...

Information disclosure

An issue in Deviniti Issue Sync Synchronization v3.5.2 for Jira allows attackers to obtain the login credentials of a user via a crafted request sent to /rest/synchronizer/1.0/technicalUser...

CVE-2023-30285

Summary: CVE-2023-30285 affects Deviniti Issue Sync Synchronization for Jira (version 3.5.2). The issue allows an attacker to obtain a user’s login credentials by sending a crafted request to the vulnerable API endpoint "/rest/synchronizer/1.0/technicalUser". The available documents consistently ...

Deviniti Issue Sync Synchronization 安全漏洞

Deviniti Issue Sync Synchronization is a synchronization application from Deviniti. A security vulnerability exists in Deviniti Issue Sync Synchronization version v3.5.2, which stems from a vulnerability that allows an attacker to obtain a user's login credentials via a specially crafted request...

The vulnerability of the built-in software of the ARIS controller, related to reading data outside the buffer in memory, allows a intruder to perform a service failure.

The vulnerability of the built-in software of the ARIS controller is related to reading data outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to perform a service failure through a specially crafted request...

The vulnerability of the RequestInfoByXml function in the software interface of the API platform for collaborative work and automation of documentation processing in Weaver e-cology allows a malicious actor to gain access to read, modify, or delete data.

The vulnerability of the RequestInfoByXml function in the software interface of the API for collaborative work and automation of documentation processing in the Weaver e-cology platform is related to an incorrect limitation on XML links to external objects. Exploiting this vulnerability could all...

golang: net/http, net/textproto: denial of service from excessive memory allocation

A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by memory exhaustion in the common function in HTTP and MIME header parsing. By sending a specially crafted request, a remote attacker can cause a denial of service...

Liferay Portal has Inefficient Regular Expression

Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs...

GHSA-CHRC-Q6V3-JFV8 Liferay Portal has Inefficient Regular Expression

Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs...

CVE-2023-33950

Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs...