PT-2023-30329

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 12.4.8 Description The login screen of the standalone install tool discloses the full path of the transient data directory. This issue applies to composer-based scenarios only, and "classic" non-composer installations a...

CVE-2023-33878: DEPRECATED: Often Misused: Path Manipulation

Path transversal in some IntelR NUC P14E Laptop Element Audio Install Package software before version 156 for Windows may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-47126: Exposure of Sensitive Information to an Unauthorized Actor

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory e.g. /var/www/html/var/transient/. This applies to composer-based scenarios only...

KLA61978 Multiple vulnerabilities in Microsoft Server Software

Multiple vulnerabilities were found in Microsoft Server Software. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Microsoft Exchange Server can be exploited...

Vulnerabilities fixed in Microsoft Azure

Microsoft has fixed vulnerabilities in components of Azure. A malicious party could exploit the vulnerabilities to circumvent a security measure, execute arbitrary code with the victim's privileges or gain access to sensitive data. Azure:...

PT-2023-24529

Name of the Vulnerable Software and Affected Versions IntelR NUC P14E Laptop Element Audio Install Package software versions prior to 156 for Windows Description The issue concerns path transversal in the IntelR NUC P14E Laptop Element Audio Install Package software, which may allow an...

Fedora: Security Advisory for radare2 (FEDORA-2023-ffaebb1e10)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

typo3 -- Multiple vulnerabilities

[email protected] reports: Weak Authentication in Session Handling in typo3/cms-core: In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for the first site can be reused o...

CVE-2023-5747 Command injection via wave install file

Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device. The Wave server application in camera device was vulnerable to command injection allowing an attacker to run arbitrary code. HanwhaVision has releas...

Fedora: Security Advisory for xorg-x11-server-Xwayland (FEDORA-2023-18cb340b28)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apple Security Update: macOS Sonoma 14.1.1

Apple recommends to install security update macOS Sonoma 14.1.1 on devices macOS Sonoma...

PT-2023-35501

Name of the Vulnerable Software and Affected Versions cabal-install versions prior to 3.10.2.0 Description A problem was discovered in cabal-install's implementation of the Hackage Security protocol, which could allow an attacker with a revoked private key and the ability to perform a...

Malware in workspaces-install-already-exists

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

kk Star Ratings < 5.4.6 - Rating Tampering via Race Condition

Description The plugin does not implement atomic operations, allowing one user vote multiple times on a poll due to a Race Condition. 1- Install and activate kk Star Ratings. 2- Go to the page that displays the star rating. 3- Using Burp and the Turbo Intruder extension, intercept the rating...

48 Malicious npm Packages Found Deploying Reverse Shells on Developer Systems

A new set of 48 malicious npm packages have been discovered in the npm repository with capabilities to deploy a reverse shell on compromised systems. "These packages, deceptively named to appear legitimate, contained obfuscated JavaScript designed to initiate a reverse shell on package install,"...

PT-2023-32414 · Popojicms · Popojicms

Name of the Vulnerable Software and Affected Versions: PopojiCMS version 2.0.1 Description: A vulnerability was found in the file install.php of the component Web Config, affecting some unknown processing. The manipulation of the argument Site Title with the input alert1 leads to cross site...

Electron Technologies FZC PopojiCMS Cross-Site Scripting Vulnerability

Electron Technologies FZC PopojiCMS is an open source content management system CMS based on the Popoji framework from Electron Technologies FZC, USA. A cross-site scripting vulnerability exists in Electron Technologies FZC PopojiCMS version 2.0.1, which stems from some unknown processing in the...

SUSE CVE-2015-3159

The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool ABRT does not properly handle the process environment before invoking abrt-action-install-debuginfo, which allows local users to gain privileges...

CVE-2023-47101

The installer aka openvpn-client-installer in Securepoint SSL VPN Client before 2.0.40 allows local privilege escalation during installation or repair...

CVE-2023-21345

In Game Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...