CVE-2023-46736: Server-Side Request Forgery (SSRF)

EspoCRM is an Open Source CRM Customer Relationship Management software. In affected versions there is Server-Side Request Forgery SSRF vulnerability via the upload image from url api. Users who have access to the /Attachment/fromImageUrl endpoint can specify URL to point to an internal host. Eve...

PT-2023-29234 · Electron · Electron

Name of the Vulnerable Software and Affected Versions: Electron versions prior to 22.3.24 Electron versions prior to 24.8.3 Electron versions prior to 25.8.1 Electron versions prior to 26.2.1 Electron versions prior to 27.0.0-alpha.7 Description: This issue impacts Electron apps that have the...

CVE-2023-6360

The 'My Calendar' WordPress Plugin, version 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route...

CVE-2023-48289

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft Excel allows Stored XSS.This issue affects Import Spreadsheets from Microsoft Excel: from n/a through 10.1.3...

PT-2023-7555 · WordPress · Wordpress Calendar Plugin

Name of the Vulnerable Software and Affected Versions: My Calendar WordPress Plugin version 3.4.22 Description: The issue is related to an unauthenticated SQL injection vulnerability. This vulnerability is present in the from and to parameters in the "/my-calendar/v1/events" rest route. It allows...

CVE-2023-48289: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft Excel allows Stored XSS.This issue affects Import Spreadsheets from Microsoft Excel: from n/a through 10.1.3...

CVE-2023-6360: Improper Neutralization of Special Elements used in an SQL Command

The 'My Calendar' WordPress Plugin, version 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route...

CVE-2023-49043

Buffer Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the wpapskcrypto parameter in the function fromSetWirelessRepeat...

SideFX: Port 587 SMPT Open: Can send any mail remotely from the internal mail users to company mail id's.

Port 587 SMTP open. Attacker can send emails remotely to company email addresses. This allows phishing, spamming, or other malicious emails to be sent from what appears to be a legitimate internal company email account...

ROS-20231115-01

A vulnerability in the Squid proxy server related to the execution of a "buffer overflow" attack, writing up to 2MB of of arbitrary data to the memory heap when Squid is configured to accept HTTP Digest Authentication. Exploitation of the vulnerability could allow an attacker acting remotely to...

PT-2023-35598

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash occurs in the Gfx::ICC::TextDescriptionTagData::from bytes function, which is called by...

PT-2023-27160

Name of the Vulnerable Software and Affected Versions Acurax Under Construction / Maintenance Mode from Acurax plugin versions = 2.6 Description The issue is related to an Unauth. Stored Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the...

kernel: drm/amdkfd: Fix an illegal memory access

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix an illegal memory access In the kfdwaitonevents function, the kfdeventwaiter structure is allocated by alloceventwaiters, but the event field of the waiter structure is not initialized; When copyfromuser fails in...

kernel: scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent lpfcdebugfslockstatwrite buffer overflow A static code analysis tool flagged the possibility of buffer overflow when using copyfromuser for a debugfs entry. Currently, it is possible that copyfromuser copies...

PT-2024-14741

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.0-rc5-gcd8bdf563d46 Description The issue arises from the TCP sockets and MPTCP subflows building egress packets larger than 64K, exceeding the maximum DSS data size. This results in the length being...

The vulnerability of the bfd_section_from_shdr function in the bfd/elf.c component of the GNU Binutils development environment allows a attacker to trigger a service failure.

The vulnerability of the bfdsectionfromshdr function in the bfd/elf.c component of the GNU Binutils development environment is related to insufficient input validation. Exploiting this vulnerability allows an attacker to cause service failures remotely...

mariadb: server crashes in query_arena::set_query_arena upon SELECT from view

A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/sqlclass.cc, impacting availability...

kernel: drm/amdkfd: Fix an illegal memory access

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix an illegal memory access In the kfdwaitonevents function, the kfdeventwaiter structure is allocated by alloceventwaiters, but the event field of the waiter structure is not initialized; When copyfromuser fails in...

kernel: scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent lpfcdebugfslockstatwrite buffer overflow A static code analysis tool flagged the possibility of buffer overflow when using copyfromuser for a debugfs entry. Currently, it is possible that copyfromuser copies...

FreeBSD : OpenDMARC - Remote denial of service (ede832bf-6576-11ec-a636-000c29061ce6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ede832bf-6576-11ec-a636-000c29061ce6 advisory. - OpenDMARC 1.4.1 and 1.4.1.1 allows remote attackers to cause a denial of service NULL pointer...