The vulnerability of the Virtio driver in the Linux operating system allows a hacker to gain access to protected data.

The vulnerability of the Vitrio driver in the Linux operating system is related to the use of uninitialized data in the vdusevdpagetconfig function. Exploiting this vulnerability could allow an attacker to gain access to protected data...

CVE-2023-22942

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway SSG app in the ‘kvstoreclient’ REST endpoint lets a potential attacker update SSG KV store collections using an HTTP GET request...

Cross site request forgery (csrf)

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway SSG app in the ‘kvstoreclient’ REST endpoint lets a potential attacker update SSG KV store collections using an HTTP GET request...

CVE-2023-22942 Cross-Site Request Forgery in the ‘ssg/kvstore_client’ REST Endpoint in Splunk Enterprise

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway SSG app in the ‘kvstoreclient’ REST endpoint lets a potential attacker update SSG KV store collections using an HTTP GET request...

Apache Sling 注入漏洞

Apache Sling is the United States Apache Apache Foundation of a Java platform for open source Web framework. Designed to meet the JSR-170 content repository such as Apache Jackrabbit to create content-centric applications. Apache Sling JCR Base versions prior to 3.1.12 JNDI injection vulnerabilit...

CVE-2023-25717

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?loginusername=admin&password=password$curl substring...

Remote code execution

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?loginusername=admin&password=password$curl substring...

CVE-2023-25717

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?loginusername=admin&password=password$curl substring. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

CVE-2023-25717

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?loginusername=admin&password=password$curl substring...

PT-2023-35172 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.90 Description: The issue is related to a null-deref in gsmi get variable. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to v5.15.90,...

PT-2023-35292 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.231 Description: The issue concerns the validation of the addr parameter in the mdiobus get phy function. This is an automated identification of a potential security issue, but the actual impact and attack...

CVE-2023-25717

CVE-2023-25717 affects Ruckus Wireless Admin panels (10.4 and earlier) across Ruckus ZoneDirector, SmartZone, and Solo APs where the web services component is enabled. The vulnerability enables unauthenticated remote code execution via an unauthenticated HTTP GET request (example parameterized lo...

PT-2023-35003 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.9 Description: The issue is related to a double increment of client count in the dma chan get function. This problem was introduced in version v4.0 and is fixed in Linux Kernel version v6.1.9. The actual...

PT-2023-35105 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.93 Description: A potential issue has been identified in the Linux Kernel, related to the get swap pages function in mm/swapfile. The actual impact and attack plausibility have not yet been proven...

PT-2023-35358 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.305 Description: The issue is related to a double increment of client count in the dma chan get function. This problem was introduced in version v4.0 and is fixed in Linux Kernel version v4.14.305. The...

AZL-13300 CVE-2023-25165 affecting package cert-manager for versions less than 1.7.3-8

Helm is a tool that streamlines installing and managing Kubernetes applications.getHostByName is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS...

GHSA-33M6-Q9V5-62R7 go.uuid has Predictable UUID Identifiers

CVE Description for go.uuid A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due to insecure randomness in the g.rand.Read function the generated UUIDs are predictable for an attacker. Updat...

Improper Validation of Array Index in GJSON

GJSON 1.6.6 allows attackers to cause a denial of service panic: runtime error: slice bounds out of range via a crafted GET call...

GHSA-P64J-R5F4-PWWX Improper Validation of Array Index in GJSON

GJSON 1.6.6 allows attackers to cause a denial of service panic: runtime error: slice bounds out of range via a crafted GET call...

EXNESS: SSRF in graphQL query (pwapi.ex2b.com)

An SSRF vulnerability was discovered in the GraphQL query for allTicks on the pwapi.ex2b.com website. This vulnerability allowed an attacker to set the source parameter to perform arbitrary GET requests, potentially compromising internal services exposed to internal network requests...