PT-2023-3948 · Adobe · Indesign

Name of the Vulnerable Software and Affected Versions: Adobe InDesign versions ID18.3 and earlier Adobe InDesign versions ID17.4.1 and earlier Description: The issue is related to an out-of-bounds read in memory, which could allow an attacker to gain unauthorized access to protected information...

PT-2023-3946 · Adobe · Indesign

Name of the Vulnerable Software and Affected Versions: Adobe InDesign versions ID18.3 and earlier Adobe InDesign versions ID17.4.1 and earlier Description: The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage thi...

PT-2023-4014 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.6.3 Description: The issue is related to improper authorization in Apache Airflow, allowing unauthorized read access to a DAG through a specially crafted URL. This could enable a remote attacker to disclose...

WordPress plugin Greeklish-permalink 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

TOTOLINK LR350 命令注入漏洞

TOTOLINK LR350 is a wireless router from China Gion Electronics TOTOLINK. A security vulnerability exists in TOTOLINK LR350 version V9.3.5u.6369B20220309. An attacker can exploit this vulnerability to conduct a command injection attack via the hostname parameter of the setOpModeCfg method...

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.

...

INEX IXP-Manager 跨站脚本漏洞

INEX IXP-Manager is an INEX open source web application. A security vulnerability exists in INEX IXP-Manager versions prior to 6.3.1. An attacker exploited the vulnerability to perform cross-site scripting attacks...

Flask-AppBuilder 安全漏洞

Flask-AppBuilder is a simple and fast application development framework. A security vulnerability exists in Flask-AppBuilder versions prior to 4.3.2, which can be exploited by an attacker to trigger a database error by adding special characters to the Add, Edit user form...

Aeotec WallMote Switch 安全漏洞

Aeotec WallMote Switch is a switch from Aeotec. Aeotec WallMote Switch version v2.3 has a security vulnerability that stems from allowing an attacker to cause a denial of service DoS on the system via a specially crafted Z-Wave message...

PT-2023-25331

Name of the Vulnerable Software and Affected Versions Sitecore Experience Manager versions through 10.3 Sitecore Experience Platform versions through 10.3 Sitecore Experience Commerce versions through 10.3 Description Multiple Sitecore products are affected by a remote code execution issue. This...

PT-2023-25325 · Sugarcrm · Sugarcrm Enterprise

Name of the Vulnerable Software and Affected Versions: SugarCRM Enterprise versions prior to 11.0.6 SugarCRM Enterprise versions 12.x prior to 12.0.3 Description: An Unrestricted File Upload issue has been identified in the Notes module due to missing input validation. This allows custom PHP code...

Vulnerabilities fixed in Microfocus ArcSight Logger

Micro Focus has fixed vulnerabilities in ArcSight Logger. A malicious party could exploit the vulnerabilities to launch a Cross-site Scripting attack, or an XML External Entity Injection. Such an attack can lead to execution of arbitrary code in the context of the victim's browser, or access data...

CVE-2023-24470

Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0...

CVE-2023-32961

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Katie Seaborn Zotpress plugin = 7.3.3 versions...

CVE-2023-33653

Sitecore Experience Platform XP v9.3 was discovered to contain an authenticated remote code execution RCE vulnerability via the component /Applications/Content%20Manager/Execute.aspx?cmd=convert&mode=HTML...

libspdm 安全漏洞

libspdm is a DMTF open source example implementation that follows the DMTF SPDM specification. A security vulnerability exists in libspdm versions prior to 2.3.3 and 3.0, which stems from a vulnerability that allows an unauthenticated requestor to store and use a respondent's CTExponent value...

CVE-2023-23561

Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information...

Alarm Clock 安全漏洞

Alarm Clock is an app from the Smart Alarm Clock Team team. It is used to set the hours and minutes of an online alarm clock. A security vulnerability exists in Alarm Clock for Heavy Sleepers version v.5.3.2, which originates from allowing unauthorized applications to cause a denial of service vi...

CVE-2022-47159 WordPress Logaster Logo Generator Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Logaster Logaster Logo Generator plugin = 1.3 versions...

WordPress plugin LiteSpeed Cache 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...