Home Assistant 授权问题漏洞

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. An authorization issue vulnerability exists in Home Assistant Supervisor versions prior to 2023.01.1 that stems from an authentication bypass vulnerability...

PT-2023-2035

Name of the Vulnerable Software and Affected Versions Rack versions prior to 3.0.4.2 Rack versions prior to 2.2.6.3 Rack versions prior to 2.1.4.3 Rack versions prior to 2.0.9.3 Description A DoS issue exists in the Multipart MIME parsing code, allowing an attacker to craft requests that can be...

PT-2023-21162 · Xcat · Xcat

Name of the Vulnerable Software and Affected Versions: xCAT versions prior to 2.16.5 Description: xCAT is a toolkit for deployment and administration of computer clusters. If zones are configured as a mechanism to secure clusters in XCAT, it is possible for a local root user from one node to obta...

DEBIAN-CVE-2023-1218

Use after free in WebRTC in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

PT-2023-35410 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.12 Description: The issue concerns the use of the WQ MEM RECLAIM flag for workqueue. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...

PT-2023-21153 · Xml.Etree +2 · Xml.Etree +2

Name of the Vulnerable Software and Affected Versions: OWSLib versions prior to 0.28.1 Description: The XML parser in OWSLib does not disable entity resolution, which could lead to arbitrary file reads from an attacker-controlled XML payload. This issue affects all XML parsing in the codebase. Th...

PT-2023-16835 · Unknown · Answerdev/Answer

Name of the Vulnerable Software and Affected Versions: answerdev/answer versions prior to 1.0.6 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation, allowing attackers to inject...

PT-2023-16832 · Answerdev · Answer

Name of the Vulnerable Software and Affected Versions: answerdev/answer versions prior to 1.0.6 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation, allowing an attacker to injec...

JTEKT Kostac PLC Programming Software 资源管理错误漏洞

JTEKT Kostac PLC Programming Software is PLC programmer software for personal computers from JTEKT Japan. A security vulnerability exists in JTEKT Kostac PLC Programming Software version 1.6.9.0 and prior versions, which originates from memory reuse after release. An attacker could exploit the...

Vim 安全漏洞

Vim is a cross-platform text editor. A security vulnerability exists in versions prior to Vim 9.0.1378, which stems from an incorrect calculation of the buffer size...

Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from Pixel & tonic, USA. A cross-site scripting vulnerability exists in Craft CMS versions prior to 4.3.7, which stems from a cross-site scripting XSS vulnerability...

CVE-2022-38734

StorageGRID formerly StorageGRID Webscale versions prior to 11.6.0.8 are susceptible to a Denial of Service DoS vulnerability. A successful exploit could lead to to a crash of the Local Distribution Router LDR service...

XWiki Platform 缓冲区错误漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki Platform versions prior to 14.0-rc-1, which stems from an out-of-memory vulnerability that can be exploited by an attacker to cause a...

Sophos Connect 跨站请求伪造漏洞

Sophos Connect is a VPN client from Sophos UK. A security vulnerability exists in Sophos Connect version 2.2.90 and prior versions. An attacker could exploit this vulnerability to perform cross-site request forgery attacks...

WordPress Plugin My Sticky Elements SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

part-db 跨站脚本漏洞

part-db is a web-based database for managing electronic components. A security vulnerability exists in part-db versions prior to 1.0.2, which stems from not properly escaping user input and can be exploited by an attacker to inject arbitrary HTML into a page...

Froxlor 跨站请求伪造漏洞

Froxlor is a lightweight server management software from the Froxlor team. A cross-site request forgery vulnerability exists in Froxlor versions prior to 2.0.11. An attacker could exploit this vulnerability to perform cross-site request forgery attacks...

PT-2023-9203 · Frrouting +8 · Frrouting +8

Name of the Vulnerable Software and Affected Versions: FRRouting versions prior to 8.4.3 Description: The issue is related to the handling of incorrect requests without attributes in the bgpd/bgp flowspec.c file of FRRouting, a Unix-like system network routing implementation tool. This can be...

AudioCodes Device Manager Express SQL注入漏洞

AudioCodes Device Manager Express is a powerful lifecycle management tool for AudioCodes IP Phones, EPOS and Jabra headsets and speakers from AudioCodes Israel. A SQL injection vulnerability exists in AudioCodes Device Manager Express 7.8.20002.47752 and prior versions, which stems from an...

AudioCodes Device Manager Express 路径遍历漏洞

AudioCodes Device Manager Express is a powerful lifecycle management tool for AudioCodes IP phones, EPOS and Jabra headsets and speakers from AudioCodes Israel. A path traversal vulnerability exists in AudioCodes Device Manager Express 7.8.20002.47752 and prior versions, which stems from a path...