Tornado 输入验证错误漏洞

Tornado is a Python web framework and asynchronous networking library from the Chinese Tornado Technology Tornado community. The library scales to thousands of open connections through the use of non-blocking network I/O, making it well suited for long-time polling, WebSockets, and other...

CVE-2023-22689

Cross-Site Request Forgery CSRF vulnerability in Lucian Apostol Auto Affiliate Links plugin = 6.3 versions...

WordPress Plugin Auto Affiliate Links 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2023-23996 · Mitel · Mitel Mivoice Connect

Name of the Vulnerable Software and Affected Versions: Mitel MiVoice Connect versions through 19.3 SP2 22.24.1500.0 Description: The Linux DVS server component could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control...

PT-2023-24013 · Symcon · Ip-Symcon

Name of the Vulnerable Software and Affected Versions: Symcon IP-Symcon versions prior to 6.3 Description: The web interface of Symcon IP-Symcon allows a remote attacker to read sensitive files via .. directory-traversal sequences in the URL. This issue enables unauthorized access to sensitive...

CVE-2023-29276

Adobe Substance 3D Painter versions 8.3.0 and earlier is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

Adobe Substance 3D Painter 缓冲区错误漏洞

Adobe Substance 3D Painter is a 3D texturing application from the American company Audobee Adobe. An out-of-bounds write vulnerability exists in Adobe Substance 3D Painter 8.3.0 and earlier versions, which can be exploited by an attacker to execute code in the current user's context...

Adobe Substance 3D Painter 缓冲区错误漏洞

Adobe Substance 3D Painter is a 3D texturing application from the American company Audobee Adobe. An out-of-bounds write vulnerability exists in Adobe Substance 3D Painter 8.3.0 and earlier versions, which can be exploited by an attacker to execute code in the current user's context...

CVE-2022-46817

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Flyzoo Flyzoo Chat plugin = 2.3.3 versions...

Intel Quartus Prime Pro 代码问题漏洞

Intel Quartus Prime Pro is a set of multi-platform design environments from the U.S. company Intel Intel. The product is primarily used for programming programmable logic devices. A security vulnerability exists in Intel Quartus Prime Pro edition software prior to version 22.3, which stems from t...

PT-2023-2738 · Adobe · Substance3D - Painter

Name of the Vulnerable Software and Affected Versions: Adobe Substance 3D Painter versions 8.3.0 and earlier Description: The issue is related to an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacke...

PT-2023-2734 · Adobe · Substance3D - Painter

Name of the Vulnerable Software and Affected Versions: Adobe Substance 3D Painter versions 8.3.0 and earlier Description: The issue is related to a Stack-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires use...

Ivanti Avalanche 竞争条件问题漏洞

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche version 6.3.x and prior versions. An attacker could exploit the...

Ivanti Avalanche 代码问题漏洞

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A code issue vulnerability exists in Ivanti Avalanche version 6.3.x and prior versions, which stems from a failure ...

PT-2023-21458 · Apple · Studio Display Firmware +1

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.3 Studio Display Firmware versions prior to 16.4 Description: A memory corruption issue was addressed with improved state management, allowing an app to potentially execute arbitrary code with kernel privileges...

Netcon NS-ASG SQL注入漏洞

Netcon NS-ASG is an application security gateway from China Netcon Technology Netcon. A security vulnerability exists in Netcon NS-ASG v6.3, which originates from an SQL injection vulnerability in the component /admin/addikev2.php...

GeoVision GV-Edge Recording Manager 权限许可和访问控制问题漏洞

GeoVision GV-Edge Recording Manager is a video surveillance system from GeoVision Japan that realizes one-camera image management, remote monitoring, and more. A security vulnerability exists in GeoVision GV-Edge Recording Manager version 2.2.3.0, which originates from including incorrect...

GHSA-83FM-W79M-64R5 Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.3.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...

GHSA-X422-6QHV-P29G Relative path traversal in mlflow

Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1...

PT-2023-23002 · H2O · H2O

Name of the Vulnerable Software and Affected Versions: H2O versions 2.3.0-beta2 and prior Description: H2O is an HTTP server. When the reverse proxy handler tries to process a certain type of invalid HTTP request, it tries to build an upstream URL by reading from an uninitialized pointer. This...