3842 matches found
CLSA-2023-1695834624 python3: Fix of 2 CVEs
CVE-2021-3177: Replace snprintf to prevent buffer overflow - CVE-2022-48565: Reject XML entity declarations in plist files...
NodeBB Security Vulnerabilities
NodeBB is a forum system built using Node.js a web application platform built on top of Google's V8 JavaScript engine by the Design Create Play team. A security vulnerability exists in versions prior to NodeBB v1.18.6, which stems from the presence of a Remote Code Execution RCE vulnerability tha...
PT-2023-5510 · Cisco · Cisco Catalyst Sd-Wan Manager
Name of the Vulnerable Software and Affected Versions: Cisco Catalyst SD-WAN Manager Software affected versions not specified Description: A vulnerability in the Security Assertion Markup Language SAML APIs could allow an unauthenticated, remote attacker to gain unauthorized access to the...
The vulnerability in the software web interface for processing and transmitting confidential data of Progress MOVEit Transfer lies in the lack of validation for XML objects’ sequences, allowing an intruder to gain unauthorized access to the MOVEit Transfer database.
The vulnerability of the software web interface for processing and transmitting confidential data in Progress MOVEit Transfer is related to the lack of verification of the validity of XML objects. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access...
The vulnerability of the “links” function in the Cacti network monitoring software allows a hacker to execute arbitrary SQL queries.
The vulnerability of the “links” function in the Cacti network monitoring software is related to the lack of validation for the sequences of XML objects. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...
UBUNTU-CVE-2023-3550
Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious link to the instance administrator...
The vulnerability of Google Chrome’s user tabs allows a hacker to bypass existing security restrictions.
The vulnerability of user tabs in Google Chrome is related to the improper use of standard permissions. Exploiting this vulnerability allows a malicious actor to bypass security restrictions through a specially created HTML page...
DEBIAN-CVE-2023-4909
Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. Chromium security severity: Low...
PT-2023-5489 · Google +1 · Google Chrome +1
Name of the Vulnerable Software and Affected Versions: Google Chrome on Android versions prior to 117.0.5938.62 Description: The issue is related to an inappropriate implementation in Intents, allowing a remote attacker to obfuscate security UI via a crafted HTML page. This could potentially enab...
CVE-2023-31069
An issue was discovered in TSplus Remote Access through 16.0.2.14. Credentials are stored as cleartext within the HTML source code of the login page...
The vulnerability of the binary data management service of the software solution allows a perpetrator to execute arbitrary code.
The vulnerability of the binary data management service of the software solution relates to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with administrative privileges by sending a specially crafted Java object in...
GHSA-8CJG-F53M-8M9Q Magento XML Injection vulnerability in the Widgets Update Layout
Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...
CVE-2023-4298
The 123.chat WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Lexmark Code Issue Vulnerability
Lexmark is a series of printers in the United States. A security vulnerability exists in versions of Lexmark devices prior to 2023-08-25, which stems from an allowed XML External Entity Attack XXE attack that can lead to information disclosure...
CVE-2023-40593
In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language SAML request to the /saml/acs REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon...
Design/Logic Flaw
In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language SAML request to the /saml/acs REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon...
CVE-2023-41167
@webiny/react-rich-text-renderer before 5.37.2 allows XSS attacks by content managers. This is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. Webiny is an open-source serverless enterprise CMS. The @webiny/react-rich-text-renderer package depends on the...
PT-2023-27485 · Lg · Lg Simple Editor
Name of the Vulnerable Software and Affected Versions: LG Simple Editor affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this issue. The specif...
USN-6305-1 php8.1 vulnerabilities
It was discovered that PHP incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information. CVE-2023-3823 It was discovered that PHP incorrectly handled certain PHAR files. An attacker could possibly use this issue to cause a crash, expose sensitiv...
