13695 matches found
PT-2023-7251 · Zyxel · Zyxel Usg Flex Series +3
Name of the Vulnerable Software and Affected Versions: Zyxel ATP series version 5.37 Zyxel USG FLEX series version 5.37 Zyxel USG FLEX 50W series version 5.37 Zyxel USG20W-VPN series version 5.37 Description: A buffer overflow issue in the firmware could allow an authenticated local attacker with...
Cisco ThousandEyes Enterprise Agent Virtual Appliance Privilege Escalation Vulnerability
A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient input validation by the operating system CLI. An attacker cou...
Cisco ThousandEyes Enterprise Agent 参数注入漏洞
Cisco ThousandEyes Enterprise Agent is an application from Cisco, Inc. It provides extended visibility, automated insights, and seamless workflow. A security vulnerability exists in Cisco ThousandEyes Enterprise Agent that stems from insufficient validation of user-supplied inputs to CLI...
PT-2023-17416 · Cisco · Cisco Thousandeyes Enterprise Agent
Name of the Vulnerable Software and Affected Versions: Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type affected versions not specified Description: A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker to elevate...
PT-2023-4613 · Cisco · Cisco Thousandeyes Enterprise Agent
Name of the Vulnerable Software and Affected Versions: Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type affected versions not specified Description: A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker to elevate...
Codedoc Security Vulnerabilities
Codedoc is a documentation generator for C/C ++ code. Michaelrsweet A security vulnerability exists in codedoc version v.3.7, which stems from the presence of a buffer overflow vulnerability that allows attackers to cause a denial of service via the codedoc.c:1742 component...
WordPress LINE Notify Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)
Software LINE Notify Type Plugin Vulnerable versions = 1.4.4 Fixed in 1.4.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30497 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 329899cef564 Credits Ivy TOOR, LISA Requir...
Unsanitized user controlled input in module generation
Impact The import-in-the-middle loader used by @opentelemetry/instrumentation works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. It allows for remote code execution in cases where an application passes...
Paessler PRTG Network Monitor Command Injection Vulnerability
Paessler PRTG Network Monitor is a full-featured network monitoring and management software from Paessler, Germany. A command injection vulnerability exists in Paessler PRTG Network Monitor version 23.2.83.1760, which stems from command line parameter injection and undocumented debug feature flag...
import-in-the-middle has unsanitized user controlled input in module generation
Impact The import-in-the-middle loader works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. It allows for remote code execution in cases where an application passes user-supplied input directly to an import...
Hackers Abusing Cloudflare Tunnels for Covert Communications
New research has revealed that threat actors are abusing Cloudflare Tunnels to establish covert communication channels from compromised hosts and retain persistent access. "Cloudflared is functionally very similar to ngrok," Nic Finn, a senior threat intelligence analyst at GuidePoint Security,...
nodejs: HTTP Request Smuggling via Empty headers separated by CR
A vulnerability has been identified in the Node.js, where llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS...
[SECURITY] Fedora 38 Update: xen-4.17.1-9.fc38
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...
Matrix matrix-appservice-irc Command Injection Vulnerability
matrix-appservice-irc is a bridge for Matrix. This bridge passes all IRC messages to Matrix and all Matrix messages to IRC. A command injection vulnerability exists in Matrix matrix-appservice-irc versions prior to 1.0.1, which stems from a vulnerability that allows an attacker to craft commands...
CVE-2023-3348
The Wrangler command line tool [email protected] or [email protected] was affected by a directory traversal vulnerability when running a local development server for Pages wrangler pages dev command. This vulnerability enabled an attacker in the same network as the victim to connect to the local...
CVE-2023-3348
The CVE-2023-3348 entry concerns the Cloudflare Wrangler CLI and its pages dev local development server. Affected components: Wrangler (<=3.1.0) and Wrangler (
CVE-2023-3348 Directory traversal vulnerability in Cloudflare Wrangler
The Wrangler command line tool [email protected] or [email protected] was affected by a directory traversal vulnerability when running a local development server for Pages wrangler pages dev command. This vulnerability enabled an attacker in the same network as the victim to connect to the local...
SUSE CVE-2023-20583
A potential power side-channel vulnerability in AMD processors may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache line changes over time potentially resulting in a leak of sensitive information...