PYSEC-2023-124

Heap buffer overflow in paddle.trace in PaddlePaddle before 2.5.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible...

The vulnerability of the Jenkins SAML Single Sign On (SSO) plugin, which stems from the lack of SSL/TLS certificate verification, allows attackers to disclose sensitive information.

The vulnerability of the Jenkins SAML Single Sign On SSO plugin is related to the lack of SSL/TLS certificate verification. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

The vulnerability of the SonicWall Analytics analytical service and the SonicWall Global Management System (GMS) global network firewall management system lies in the lack of protection for the SQL query structure, which allows attackers to exploit the protected information.

The vulnerability of the SonicWall Analytics analytical service and the SonicWall Global Management System GMS global network firewall management system is related to the lack of protection for the SQL query structure. Exploiting this vulnerability can allow a malicious actor to disclose protecte...

Foxit PDF Reader Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

The vulnerability of the Jupyter Core environment for interactive code development and execution allows attackers to expose protected information, upload and execute code with elevated privileges.

The vulnerability in the Jupyter Core environment for interactive code development and execution is related to errors in privilege management. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information, upload and execute code with elevated privileges...

The vulnerability of Citrix ADC application delivery controllers (formerly known as Citrix NetScaler Application Delivery Controller) and Citrix Gateway virtual environment access control systems (formerly known as Citrix NetScaler Gateway) stems from improper validation of the return value of a function. This allows attackers to disclose sensitive information that should be protected.

The vulnerability of Citrix ADC application delivery controllers formerly known as Citrix NetScaler Application Delivery Controller, as well as the Citrix Gateway access control system formerly known as Citrix NetScaler Gateway, is related to improper validation of the return value of a function...

PT-2023-5054

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.1.0 Description The issue is related to the use of alternative driver names when importing a database, which could allow a remote attacker to create arbitrary files and gain unauthorized access to...

The vulnerability of the `ksmbd_conn_handler_loop()` function in the `fs/ksmbd/connection.c` file of the KSMBD file system of the Linux operating system allows a attacker to access protected information or cause service failures.

The vulnerability of the ksmbdconnhandlerloop function in the fs/ksmbd/connection.c file of the KSMBD file system of the Linux operating system is related to access to data beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to gain access to protected information o...

PT-2023-4192 · Apple +8 · Ipados +13

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 15.7.8 iPadOS versions prior to 15.7.8 iOS versions prior to 16.6 iPadOS versions prior to 16.6 tvOS versions prior to 16.6 macOS Ventura versions prior to 13.5 Safari versions prior to 16.6 watchOS versions prior to 9.6...

Cross-Process Information Leak

Bulletin ID: AMD-SB-7008 Potential Impact: Information disclosure Severity: Medium Summary Under specific microarchitectural circumstances, a register in “Zen 2” CPUs may not be written to 0 correctly. This may cause data from another process and/or thread to be stored in the YMM register, which...

Dell EMC PowerStore 日志信息泄露漏洞

Dell EMC PowerStore is a storage device from Dell USA. A log information disclosure vulnerability exists in Dell EMC PowerStore versions prior to 3.5.0.1, which originates from the insertion of sensitive information into a log file, and can be exploited by a malicious, high-privileged user to cau...

The vulnerability of the CGI programming language Ruby allows attackers to gain access to confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the CGI programming language Ruby is related to the occurrence of interpretation conflicts when unreliable input data is inserted into the HTTP response header. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and...

CVE-2023-27877 IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosure

IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure password policy to the CouchDB server and collect sensitive information from the database. IBM X-Force ID: 247905...

The vulnerability of the seg6genl_sethmac function in the Linux operating system allows a hacker to disclose sensitive information that is protected by this function.

The vulnerability of the seg6genlsethmac function in the Linux operating system is related to reading beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to disclose protected information...

PT-2023-7335 · Apple +6 · Macos Sonoma +11

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 17.1.2 iPadOS versions prior to 17.1.2 macOS Sonoma versions prior to 14.1.2 Safari versions prior to 17.1.2 Description: The issue is related to an out-of-bounds read in the WebKit web browser engine, which may allow an...

Command injection

Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporary backup path to access sensitive information, resulting in the disclosure of all indexed node data, because OpenSearch credentials are exposed. The data...

The vulnerability of the application software interface of the Cisco Catalyst SD-WAN Manager allows a attacker to disclose sensitive information or alter the configuration of the Cisco Catalyst SD-WAN Manager instances.

The vulnerability of the application software interface of the Cisco Catalyst SD-WAN Manager is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information or alter the configuration of the Cisco Catalyst...

Progress Software Chef Infra Server 安全漏洞

Progress Software Chef Infra Server is an application from Progress Software, Inc. It is used to act as a hub for configuration data. A security vulnerability exists in Progress Software Chef Infra Server versions prior to 15.7, which stems from a vulnerability that allows a local attacker to...

CVE-2023-31824

An issue found in DERICIA Co. Ltd, DELICIA v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp DELICIA function...

PT-2023-25292 · Unknown · Sante Dicom Viewer Pro

Name of the Vulnerable Software and Affected Versions: Sante DICOM Viewer Pro affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations. It requires user interaction, such as visiting a malicious page or opening a...