CVE-2023-41034 DDFFileParser in eclipse leshan is vulnerable to XXE Attacks

Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser and DefaultDDFFileValidator and so ObjectLoader are vulnerable to XXE Attacks. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if the...

CVE-2023-36914

Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability...

Microsoft Windows Windows Smart Card Resource Management Server Security Vulnerability

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Smart Card Resource Management Server. An attacker could exploit this vulnerability to bypass certain functionality. The following...

CVE-2023-37364

In WS-Inc J WBEM Server 4.7.4 before 4.7.5, the CIM-XML protocol adapter does not disable entity resolution. This allows context-dependent attackers to read arbitrary files or cause a denial of service, a similar issue to CVE-2013-4152...

Trend Micro Apex One Path Traversal Vulnerability

Trend Micro Apex One is an endpoint protection software from Trend Micro. Trend Micro Apex One suffers from a path traversal vulnerability, which arises when the program fails to properly filter for specific elements in the path of a resource or file, and can be exploited by an attacker to upload...

CVE-2023-36002

A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected...

CVE-2023-36002

A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected...

CVE-2023-35998

A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write unauthorized objects. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before...

Authorization

A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write unauthorized objects. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before...

CVE-2023-36002

CVE-2023-36002 affects Proofpoint Insider Threat Management Server prior to 7.14.3. A missing authorization check in multiple URL validation endpoints allows an anonymous attacker on an adjacent network to smuggle content via DNS lookups. Impact is limited to affected versions; mitigation is to u...

CVE-2023-36002 ITM Server Missing Authorization for URL validation

A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected...

CVE-2023-36002 ITM Server Missing Authorization for URL validation

A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected...

CVE-2023-36000

The CVE-2023-36000 entry concerns the Insider Threat Management Server (Proofpoint) where a missing authorization check in the MacOS agent configuration endpoint allows an adjacent-network attacker to obtain sensitive information after obtaining a valid agent authentication token. Affected versio...

CVE-2023-35998

CVE-2023-35998 concerns Proofpoint’s Insider Threat Management Server. The vulnerability is a missing authorization check in multiple SOAP endpoints, enabling an attacker on an adjacent network to read and write unauthorized objects after obtaining a valid agent authentication token. Affected all...

PT-2023-25410 · Unknown · Insider Threat Management Server

Name of the Vulnerable Software and Affected Versions: Insider Threat Management Server versions prior to 7.14.3 Description: A missing authorization check in the MacOS agent configuration endpoint enables an anonymous attacker on an adjacent network to obtain sensitive information. The attacker...

CVE-2023-32557

A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an arbitrary file to the Management Server which could lead to remote code execution with system privileges...

Path traversal

A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an arbitrary file to the Management Server which could lead to remote code execution with system privileges...

CVE-2023-32557

A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an arbitrary file to the Management Server which could lead to remote code execution with system privileges...

CVE-2023-32557

CVE-2023-32557 corresponds to a path traversal vulnerability in Trend Micro Apex One and Apex One as a Service that allows an unauthenticated attacker to upload an arbitrary file to the Management Server, enabling remote code execution with system privileges. The issue is documented across multip...

Design/Logic Flaw

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute...