PT-2023-20942 · Isoftforce · Isoftforce Dreamer Cms

Name of the Vulnerable Software and Affected Versions: isoftforce Dreamer CMS version 4.0.1 Description: A permissions issue allows local attackers to obtain sensitive information via the AttachmentController parameter. This issue can be exploited to gain access to restricted data. Recommendation...

CVE-2023-26912

Cross site scripting XSS vulnerability in xenv S-mall-ssm thru commit 3d9e77f7d80289a30f67aaba1ae73e375d33ef71 on Feb 17, 2020, allows local attackers to execute arbitrary code via the evaluate button...

CVE-2023-26912

Cross site scripting XSS vulnerability in xenv S-mall-ssm thru commit 3d9e77f7d80289a30f67aaba1ae73e375d33ef71 on Feb 17, 2020, allows local attackers to execute arbitrary code via the evaluate button...

ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF

A use-after-free flaw was found in sndctlelemread in sound/core/control.c in Advanced Linux Sound Architecture ALSA subsystem in the Linux kernel. In this flaw a normal privileged, local attacker may impact the system due to a locking issue in the compat path, leading to a kernel information leak...

CVE-2023-24465

Communication Wi-Fi subsystem within OpenHarmony-v3.1.4 and prior versions, OpenHarmony-v3.0.7 and prior versions has a null pointer reference vulnerability which local attackers can exploit this vulnerability to cause the current application to crash...

CVE-2023-0083

The ArKUI framework subsystem within OpenHarmony-v3.1.5 and prior versions, OpenHarmony-v3.0.7 and prior versions has an Improper Input Validation vulnerability which local attackers can exploit this vulnerability to send malicious data, causing the current application to crash...

Input validation

The ArKUI framework subsystem within OpenHarmony-v3.1.5 and prior versions, OpenHarmony-v3.0.7 and prior versions has an Improper Input Validation vulnerability which local attackers can exploit this vulnerability to send malicious data, causing the current application to crash...

Null pointer dereference

The bundle management subsystem within OpenHarmony-v3.1.4 and prior versions has a null pointer reference vulnerability which local attackers can exploit this vulnerability to cause a DoS attack to the system when installing a malicious HAP package...

Privilege escalation

The kernel subsystem function checkpermissionforsettokenid within OpenHarmony-v3.1.5 and prior versions has an UAF vulnerability which local attackers can exploit this vulnerability to escalate the privilege to root...

CVE-2023-24465 Communication Wi-Fi  subsystem has a null pointer reference vulnerability when receving external data.

Communication Wi-Fi subsystem within OpenHarmony-v3.1.4 and prior versions, OpenHarmony-v3.0.7 and prior versions has a null pointer reference vulnerability which local attackers can exploit this vulnerability to cause the current application to crash...

CVE-2023-22436 The kernel subsystem function check_permission_for_set_tokenid has an UAF vulnerability.

The kernel subsystem function checkpermissionforsettokenid within OpenHarmony-v3.1.5 and prior versions has an UAF vulnerability which local attackers can exploit this vulnerability to escalate the privilege to root...

CVE-2023-0083 The ArkUI framework subsystem doesn't check the input parameter,causing type confusion and invalid memory access.

The ArKUI framework subsystem within OpenHarmony-v3.1.5 and prior versions, OpenHarmony-v3.0.7 and prior versions has an Improper Input Validation vulnerability which local attackers can exploit this vulnerability to send malicious data, causing the current application to crash...

SUSE SLES11 Security Update : cifs-utils (SUSE-SU-2022:14950-1)

The remote SUSE Linux SLES11 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2022:14950-1 advisory. - CVE-2022-27239: Fixed a buffer overflow in the command line ip option bsc1197216. Tenable has extracted the preceding description block directly fro...

Atlassian Confluence 7.1.x < 7.12.3 DLL Hijacking

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.10 or 7.5.0 prior to 7.12.3. It therefore may be affected by a weakness when deployed onto the Windows operating system environment allows allow authenticated local...

Important: cifs-utils

Issue Overview: A stack-based buffer overflow issue was found in pifs-utils. Parsing the mount.cifs ip command-line argument can lead to local attackers gaining root privileges. CVE-2022-27239 Affected Packages: cifs-utils Issue Correction: Run yum update cifs-utils or yum update --advisory...

CVE-2023-1189

A vulnerability was found in WiseCleaner Wise Folder Hider 4.4.3.202. It has been declared as problematic. Affected by this vulnerability is the function 0x222400/0x222404/0x222410 in the library WiseFs64.sys of the component IoControlCode Handler. The manipulation leads to denial of service. An...

Command Injection

@zowe/imperative is vulnerable to Command Injection. The vulnerability exists due to the insecure usage of execSync, which allows an already-privileged local attackers to inject and execute malicious shell commands through the plugin install/update commands or through maliciously formed environme...

CVE-2022-45988

starsoftcomm CooCare 5.304 allows local attackers to escalate privileges and execute arbitrary commands via a crafted file upload...

SUSE-SU-2023:0613-1 Security update for tpm2-0-tss

This update for tpm2-0-tss fixes the following issues: - CVE-2023-22745: Fixed a memory safety issue that could be exploited by local attackers with TPM access bsc1207325...

SUSE-SU-2023:0526-1 Security update for tpm2-0-tss

This update for tpm2-0-tss fixes the following issues: - CVE-2023-22745: Fixed a memory safety issue that could be exploited by local attackers with TPM access bsc1207325...