PT-2023-32687 · Huawei · Huawei Smart Screen

Name of the Vulnerable Software and Affected Versions: Huawei Smart Screen products affected versions not specified Description: The Bluetooth module of some Huawei Smart Screen products has an identity authentication bypass issue. This may allow attackers to access restricted functions...

CVE-2023-40462

The ACEManager component of ALEOS 4.16 and earlier does not perform input sanitization during authentication, which could potentially result in a Denial of Service DoS condition for ACEManager without impairing other router functions. ACEManager recovers from the DoS condition by restarting withi...

Design/Logic Flaw

The ACEManager component of ALEOS 4.16 and earlier does not perform input sanitization during authentication, which could potentially result in a Denial of Service DoS condition for ACEManager without impairing other router functions. ACEManager recovers from the DoS condition by restarting withi...

CVE-2023-45773

In multiple functions of btmblegap.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation...

Missing Authorization

DolphinScheduler is is vulnerable to Missing Authorization. The vulnerability is due to insufficient permission checks for UDF function operations in the resource center. This allowed logged-in users to delete UDF functions without proper authorization...

postgresql: Memory disclosure in aggregate function calls

A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes,...

CVE-2023-49620

Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized which almost used in sql task, with unauthorized access vulnerability IDOR, but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires...

PT-2023-31274 · Unknown · Dolphinscheduler

Name of the Vulnerable Software and Affected Versions: DolphinScheduler versions prior to 3.1.0 Description: The issue allows authenticated users to delete UDF functions in the resource center without authorization, which is related to an unauthorized access vulnerability, also known as Insecure...

CVE-2023-40458

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Sierra Wireless, Inc ALEOS could potentially allow a remote attacker to trigger a Denial of Service DoS condition for ACEManager without impairing other router functions. This condition is cleared by restarting the device...

CVE-2023-40458

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Sierra Wireless, Inc ALEOS could potentially allow a remote attacker to trigger a Denial of Service DoS condition for ACEManager without impairing other router functions. This condition is cleared by restarting the device...

CVE-2023-40458

Removed by vendor...

postgresql: Memory disclosure in aggregate function calls

A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes,...

The vulnerability of the Adobe Framemaker desktop publishing system, related to the ability to bypass security functions, allows attackers to circumvent existing security restrictions.

The vulnerability of the desktop publishing system Adobe Framemaker relates to the bypassing of security functions. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...

postgresql: Memory disclosure in aggregate function calls

A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes,...

PT-2023-35618 · Git +1 · Libxaac

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type identified as Global-buffer-overflow READ 4. The crash state involves several functions, including iaace estimate sc...

PT-2023-35608 · Git +1 · Libavc

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow crash. Technical details about the crash include the functions isvcd populate res prms, isvcd parse...

GLSA-202311-03 : SQLite: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202311-03 SQLite: Multiple Vulnerabilities - An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function. CVE-2021-31239 - SQLite through 3.40.0, when relying o...

PT-2023-19561 · WordPress · Userpro

Name of the Vulnerable Software and Affected Versions: UserPro plugin for WordPress versions up to, and including, 5.1.1 Description: The issue is due to missing nonce validation in the admin page, userpro verify user, and verifyUnverifyAllUsers functions, making it possible for unauthenticated...

The vulnerability of the PUB Manager web-based system for managing technological processes in SIMATIC PCS neo allows a hacker to load arbitrary documents.

The vulnerability of the administration console of the SIMATIC PCS neo web-based process control system is related to the absence of authentication for critical functions. Exploiting this vulnerability could allow an attacker to download arbitrary documents remotely...

LDAP Injection

Apache Derby is vulnerable to LDAP Injection. The vulnerability is due to improper input validation in the username field which can be used to bypass authentication checks. This can be exploited by an attacker by injecting malicious usernames, and as a result fill up the disk by creating junk Der...