PT-2023-30278 · Totolink · Totolink Lr1200Gb

Name of the Vulnerable Software and Affected Versions: TOTOLINK LR1200GB version 9.1.0u.6619 B20230130 Description: A stack overflow issue was discovered via the password parameter in the loginAuth function. This issue can be exploited, potentially allowing unauthorized access. Recommendations: F...

CVE-2023-46129 xkeys Seal encryption used fixed key for all encryption

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server...

Code injection

baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in the mail form of baserCMS. As of time of publication, no known patched versions are available...

PT-2023-29917

Name of the Vulnerable Software and Affected Versions crypto-js versions prior to 4.2.0 Description The crypto-js library has a weakened PBKDF2 configuration, which is 1,000 times weaker than originally specified in 1993 and at least 1,300,000 times weaker than the current industry standard. This...

PT-2023-8375 · Ibm · Ibm Security Verify Governance

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Governance version 10.0 Description: The issue is related to the use of hard-coded credentials, such as a password or cryptographic key, in IBM Security Verify Governance. This could allow a remote attacker to disclose...

PT-2023-28802 · Unknown · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMSmadesimple version 2.2.18 Description: A Cross Site Scripting issue allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the Manage Shortcuts component. This enables the attacker to perform...

PT-2023-29673 · Apache · Apache Brpc

Name of the Vulnerable Software and Affected Versions: Apache bRPC versions 1.6.0. 2. Apply the patch available at https://github.com/apache/brpc/pull/2411 if upgrading is not feasible. 3. Disable the rpcz feature as a temporary workaround...

PT-2023-25755 · Totolink · Totolink Cp300+

Name of the Vulnerable Software and Affected Versions: TOTOLINK CP300+ versions = V5.2cu.7594 B20200910 Description: A stack overflow issue was discovered in the UploadCustomModule function via the File parameter. Recommendations: For TOTOLINK CP300+ versions = V5.2cu.7594 B20200910, consider...

CVE-2023-25675 affecting package tensorflow for versions less than 2.11.1-1

CVE-2023-25675 affecting package tensorflow for versions less than 2.11.1-1. A patched version of the package is available...

CVE-2023-25801 affecting package tensorflow for versions less than 2.11.1-1

CVE-2023-25801 affecting package tensorflow for versions less than 2.11.1-1. A patched version of the package is available...

CVE-2023-44487 affecting package vitess for versions less than 16.0.2-5

CVE-2023-44487 affecting package vitess for versions less than 16.0.2-5. A patched version of the package is available...

CVE-2023-4921 affecting package kernel for versions less than 5.15.133.1-1

CVE-2023-4921 affecting package kernel for versions less than 5.15.133.1-1. A patched version of the package is available...

CVE-2023-38703

CVE-2023-38703 affects the PJSIP library when SRTP is enabled and the underlying transport is not UDP. The issue is a use-after-free in the higher-level SRTP path that is not synchronized with the lower transport, potentially causing memory corruption or application termination. The description n...

PT-2023-29063 · Unknown · Mojoportal

Name of the Vulnerable Software and Affected Versions: mojoPortal version 2.7.0.0 Description: The issue allows a remote attacker to execute arbitrary code via the File Manager function. This is a result of a File Upload vulnerability. Recommendations: For mojoPortal version 2.7.0.0, consider...

PT-2023-32038 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 2.0 Description: The issue concerns the use of hard-coded credentials in the GitHub repository microweber/microweber. A patch is available and is anticipated to be part of version 2.0. Recommendations:...

Notepad++ < 8.5.7 Multiple Buffer Overflow Vulnerabilities

The version of Notepad++ installed on the remote host is prior to 8.5.7. It is, therefore, affected by multiple buffer overflow vulnerabilties. An authenticated, local attacker could exploit these to cause a denial of service condition or the execution of arbitrary code. Note that Nessus has not...

Important: redis

Issue Overview: Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis BIT command are vulnerable to integ...

PYSEC-2023-178

plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less...

PT-2023-28639 · Frauscher Sensortechnik Gmbh · Fds101

Name of the Vulnerable Software and Affected Versions: Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi versions 1.4.24 and all previous versions Description: The issue is related to a SQL injection vulnerability that can be exploited via manipulated parameters of the web interface without...

CVE-2023-42447

blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on...