CVE-2023-45391

CVE-2023-45391 describes a stored XSS in the Granding UTime Master product. According to Red Hat and other sources, the vulnerability arises in the Create A New Employee function for Granding UTime Master v9.0.7-Build: Apr 4, 2023, where an attacker with authenticated access can inject arbitrary ...

GRANDING UTime Master Security Vulnerability

GRANDING UTime Master is a powerful web-based time and attendance management software from GRANDING. A security vulnerability exists in GRANDING UTime Master v9.0.7-Build: Apr 4,2023 that stems from a vulnerability that allows an authenticated attacker to access sensitive information via a crafte...

CVE-2023-45393

An indirect object reference IDOR in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to access sensitive information via a crafted cookie...

CVE-2023-45391

A stored cross-site scripting XSS vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter...

CVE-2023-45393

An indirect object reference IDOR in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to access sensitive information via a crafted cookie...

CVE-2023-45391

A stored cross-site scripting XSS vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter...

CVE-2023-45393

GRANDING UTime Master 9.0.7-Build: Apr 4, 2023 is affected by an indirect object reference (IDOR) vulnerability that allows authenticated attackers to access sensitive information via a crafted cookie. Root cause is IDOR in cookie handling; impact is information disclosure with CVSS 3.1 base scor...

NULL Pointer Dereference in function gf_filter_pck_new_alloc_internal

Description NULL Pointer Dereference in function gffilterpcknewallocinternal at filtercore/filterpck.c:108. Version git log commit 5692dc729491805e0e5f55c21d50ba1e6b19e88e HEAD - master, origin/master, origin/HEAD Author: Aurelien David Date: Wed Oct 11 13:24:46 2023 +0200 ac3dmx: add remain size...

CVE-2023-42796

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05.11, CP-8050 MASTER MODULE All versions CPCI85 V05.11. The web server of affected devices fails to properly sanitize user input for the /sicweb-ajax/tmproot/ endpoint. This could allow an authenticated remote...

CVE-2023-36380

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05.11 only with activated debug support, CP-8050 MASTER MODULE All versions CPCI85 V05.11 only with activated debug support. The affected devices contain a hard-coded ID in the SSH authorizedkeys configuration file...

Design/Logic Flaw

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05.11, CP-8050 MASTER MODULE All versions CPCI85 V05.11. The web server of affected devices fails to properly sanitize user input for the /sicweb-ajax/tmproot/ endpoint. This could allow an authenticated remote...

CVE-2023-42796

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05.11, CP-8050 MASTER MODULE All versions CPCI85 V05.11. The web server of affected devices fails to properly sanitize user input for the /sicweb-ajax/tmproot/ endpoint. This could allow an authenticated remote...

CVE-2023-42796

CVE-2023-42796 affects Siemens SICAM A8000 CPCI85 firmware web server (CP-8031/CP-8050 MASTER MODULE, all versions before CPCI85 V05.11). The vulnerability is a path traversal flaw in the /sicweb-ajax/tmproot/ endpoint that allows an authenticated remote attacker to traverse directories and downl...

CVE-2023-36380

The CVE-2023-36380 issue affects Siemens SICAM A8000 CP-8031 and CP-8050 MASTER MODULEs prior to CPCI85 V05.11 when debug support is activated. A hard-coded credential in the SSH authorized_keys configuration enables login if the attacker knows the corresponding private key. The vulnerability is ...

CVE-2023-38703

PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not...

UBUNTU-CVE-2023-38703

PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Master Data Management (CVE-2022-40609)

Summary IBM Master Data Management is impacted by vulnerabilities in IBM WebSphere Application Server where IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Master Data Management (CVE-2023-35890)

Summary IBM Master Data Management version 11.6 and 12.0 is impacted by vulnerability in WebSphere Application Server which could provide weaker than expected security, caused by the improper encoding in a local configuration file. Vulnerability Details CVEID:CVE-2023-35890 DESCRIPTION: IBM...

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition, related to access control deficiencies, allows a violator to bypass code owners’ approval by modifying the master branch.

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass code owners’ approvals by modifying the master branch...

SaltStack 3000 < 3002.8 / 3003 < 3003.4 / 3004 < 3004.1 Multiple Vulnerabilities

According to its self-reported version number, the instance of SaltStack hosted on the remote server is affected by multiple vulnerabilities: - After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests...