Novel-Plus Code Issue Vulnerability

Novel-Plus is an online social reading and writing platform from Novel-Plus, Inc. A code issue vulnerability exists in Novel-Plus v4.3.0-RC1 and earlier versions, which stems from an arbitrary file download vulnerability in the component com.java2nb.common.controller.FileController: fileDownload...

PT-2024-10358 · Drupal · Migrate Tools

Name of the Vulnerable Software and Affected Versions: Migrate Tools versions 0.0.0 through 6.0.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability in the Migrate Tools module of the Drupal CMS system. This vulnerability can be exploited by a remote attacker to...

PT-2024-20236 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus versions 4.3.0-RC1 and prior Description: A SQL injection issue exists, allowing an attacker to perform SQL injection via the /system/dataPerm/list API endpoint by passing crafted offset, limit, and sort parameters. Recommendations...

CVE-2023-40545

Authentication bypass when an OAuth2 Client is using clientsecretjwt as its authentication method on affected 11.3 versions via specially crafted requests...

PT-2024-20226 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP version 3.3 Description: The issue concerns an Arbitrary File Upload vulnerability. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulti...

Ping Identity PingFederate Access Control Error Vulnerability

Ping Identity PingFederate is a flagship software-based federation server in the United States. used for identity management. Ping Identity A security vulnerability exists in PingFederate version 11.3, which stems from the fact that authentication can be bypassed...

CVE-2023-6846

The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mkcheckfilemanagerphpsyntax AJAX function. This makes it possible for authenticated attackers, with subscriber access and above, to execute code on the server...

CVE-2023-47564

An incorrect permission assignment for critical resource vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow authenticated users to read or modify the resource via a network. We have already fixed the vulnerability in the following versions: Qsync...

PT-2024-19245 · Peepso · Peepso Community

Name of the Vulnerable Software and Affected Versions: PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles versions prior to 6.3.1.0 Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site...

PT-2024-13839 · Logpoint · Logpoint Siem

Name of the Vulnerable Software and Affected Versions: Logpoint SIEM versions 6.10.0 through 7.x before 7.3.0 Description: The Jinja templating in Logpoint SIEM does not correctly sanitize log data being displayed when using a custom Jinja template in the Alert view. A remote attacker can craft a...

Apple iOS and iPadOS Security Vulnerabilities

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS version 17.3 and iPadOS version 17.3, which stems from a shortcut that may be...

Apple tvOS Security Breach

Apple tvOS is a smart TV operating system from Apple. A security vulnerability exists in Apple tvOS version 17.3, which stems from an application that may be able to access sensitive user data...

Apple tvOS Security Breach

Apple tvOS is an operating system for smart TVs from Apple. A security vulnerability exists in Apple tvOS version 17.3, which originates from an application that may be able to execute arbitrary code using kernel privileges...

Apple tvOS Security Breach

Apple tvOS is a smart TV operating system from Apple. A security vulnerability exists in Apple tvOS version 17.3, which stems from an application that may be able to access sensitive user data...

PT-2024-1264 · Apple · Ipados +4

Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.3 watchOS versions prior to 10.3 tvOS versions prior to 17.3 iOS versions prior to 17.3 iPadOS versions prior to 17.3 Description: The issue is related to the handling of temporary files, which may allow an a...

SUSE-SU-2024:0128-1 Security update for cloud-init

This update for cloud-init contains the following fixes: - Move fdupes call back to %install.bsc1214169 - Update to version 23.3. bsc1216011 bsc1215794 bsc1215740 bsc1216007 + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support 4390 + Fix cckeyboard in mantic LP: 2030788 + ec2: initiali...

GTKWave buffer overflow vulnerability (CNVD-2024-04846)

GTKWave is a full-featured, GTK+-based waveform viewer from GTKWave. A buffer overflow vulnerability exists in GTKWave version 3.3.115, which can be exploited by an attacker to cause arbitrary code execution via specially crafted .fst files...

Schneider Electric Easergy Studio Code Issue Vulnerability

Schneider Electric Easergy Studio is an IED support software for setup and configuration from Schneider Electric France. A code issue vulnerability exists in versions prior to Schneider Electric Easergy Studio v9.3.5 that stems from the presence of untrusted data deserialization, which could allo...

IBM CICS Transaction Gateway 安全漏洞

IBM CICS Transaction Gateway is a connector for modernizing enterprise CICS assets from International Business Machines IBM. An access control error vulnerability exists in IBM CICS Transaction Gateway version 9.3, which can be exploited by an attacker to transfer or view files...

PT-2024-13411 · Ibm · Ibm Cics Transaction Gateway

Name of the Vulnerable Software and Affected Versions: IBM CICS Transaction Gateway version 9.3 Description: The issue is related to improper access controls in IBM CICS Transaction Gateway, which could allow a user to transfer or view files. Recommendations: For IBM CICS Transaction Gateway...