CVE-2023-45672 Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py`

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate. This can lead to unauthenticated remote code execution. This can be performed through the UI at /confi...

CVE-2023-42494

EisBaer Scada - CWE-749: Exposed Dangerous Method or Function...

Design/Logic Flaw

EisBaer Scada - CWE-749: Exposed Dangerous Method or Function...

CVE-2023-42494 EisBaer Scada - CWE-749: Exposed Dangerous Method or Function

EisBaer Scada - CWE-749: Exposed Dangerous Method or Function...

CVE-2023-42494

Concrete details found: EisBaer Scada is affected by CVE-2023-42494 (CWE-749: Exposed Dangerous Method or Function). The linked PT-2023-6570 entry states the issue involves dangerous methods/functions in the SCADA system and that exploitation may allow a remote attacker to execute arbitrary code;...

CVE-2023-42494 EisBaer Scada - CWE-749: Exposed Dangerous Method or Function

EisBaer Scada - CWE-749: Exposed Dangerous Method or Function...

CVE-2023-41255

The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication of the ‘su’ binary file installed on the device that can be accessed through the ADB Android Debug Bridge protocol exposed on...

Alexander Maier EisBaer Scada Security Breach

Alexander Maier EisBaer Scada is a visualization of the actual display and control program created on Windows operating systems by Alexander Maier of Germany. Alexander Maier EisBaer Scada has a security vulnerability that originates from an exposed and dangerous method or function...

CVE-2023-42494: Exposed Dangerous Method or Function

EisBaer Scada - CWE-749: Exposed Dangerous Method or Function...

8x8: Unprotected Atlantis Server at https://152.70.█.█

The Atlantis test server at https://152.70.█.█ was found to be exposed without protection. Atlantis is an application used to automate Terraform via pull requests. The issue was identified and resolved by restricting access to the Atlantis service...

CVE-2023-4645

The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the aiajax function. This can allow unauthenticated attackers to extract sensitive data such as post titles and slugs including those of protected posts along with their...

QNAP QTS / QuTS hero Path Traversal (QSA-23-42)

The version of QNAP QTS / QuTS hero installed on the remote host is affected by a vulnerability as referenced in the QSA-23-42 advisory. A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the...

CVE-2023-20198: Active Exploitation of Cisco IOS XE Zero-Day Vulnerability

On Monday, October 16, Cisco’s Talos group published a blog on an active threat campaign exploiting CVE-2023-20198, a “previously unknown” zero-day vulnerability in the web UI component of Cisco IOS XE software. IOS XE is an operating system that runs on a wide range of Cisco networking devices,...

SUSE CVE-2018-25091

urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this...

CVE-2023-40180 Denial of service vulnerability in silverstripe-graphql via recursive queries

silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack DDOS attack against a website. This mostly affects websites with publicly exposed graphql schemas. If your...

CVE-2023-40180 Denial of service vulnerability in silverstripe-graphql via recursive queries

silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack DDOS attack against a website. This mostly affects websites with publicly exposed graphql schemas. If your...

Cisco IOX XE Unauthenticated RCE Chain

This module leverages both CVE-2023-20198 and CVE-2023-20273 against vulnerable instances of Cisco IOS XE devices which have the Web UI exposed. An attacker can execute a payload with root privileges. The vulnerable IOS XE versions are: 16.1.1, 16.1.2, 16.1.3, 16.2.1, 16.2.2, 16.3.1, 16.3.2,...

CVE-2022-42451

Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user...

Code injection

Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user...

CVE-2023-37194

A vulnerability has been identified in SIMATIC CP 1604 All versions, SIMATIC CP 1616 All versions, SIMATIC CP 1623 All versions, SIMATIC CP 1626 All versions, SIMATIC CP 1628 All versions. The kernel memory of affected devices is exposed to user-mode via direct memory access DMA which could allow...