CVE-2023-3071 Cross-site Scripting (XSS) - Stored in tsolucio/corebos

Cross-site Scripting XSS - Stored in GitHub repository tsolucio/corebos prior to 8...

CVE-2023-28399

Incorrect permission assignment for critical resource exists in CONPROSYS HMI System CHS versions prior to 3.5.3. ACL Access Control List is not appropriately set to the local folder where the affected product is installed, therefore a wide range of privileges is permitted to a user of the PC whe...

PT-2023-24368 · Kramerav · Kramerav Via Go²

Name of the Vulnerable Software and Affected Versions: KramerAV VIA GO² versions prior to 4.0.1.1326 Description: The issue allows for unauthenticated arbitrary file read. Recommendations: For versions prior to 4.0.1.1326, update to version 4.0.1.1326 or later to resolve the issue...

PT-2023-3761 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 114.0.5735.90 Description: The issue is related to an inappropriate implementation in the Downloads component, allowing an attacker to bypass file access restrictions. This can be achieved by convincing a user ...

Supcon SimField 代码问题漏洞

Supcon SimField is an intelligent mobile device monitoring platform from Supcon China. A code issue vulnerability exists in versions of Supcon SimField prior to 1.80.00.00, which stems from a problem with the file /admin/reportupload.aspx, where manipulation of the parameter files can result in...

Pixel＆tonic Craft CMS 注入漏洞

Pixel & tonic Craft CMS is a content management system CMS from Pixel & tonic USA. An injection vulnerability exists in Craft CMS versions prior to 4.4.6, which stems from an unrestricted file extension that could lead to remote code execution...

Amazon Linux 2 : wireshark (ALAS-2023-2040)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2040 advisory. TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection ...

Intel VROC software 代码问题漏洞

Intel VROC software is an application from Intel Corporation USA. A security vulnerability exists in Intel VROC software prior to version 7.7.6.1003, which stems from the presence of a null pointer dereference that could allow an authenticated user to potentially enable privilege escalation via...

CVE-2023-2516 Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass

Cross-site Scripting XSS - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7...

Amazon Linux 2 : openldap (ALAS-2023-2033)

The version of openldap installed on the remote host is prior to 2.4.44-25. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2033 advisory. An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relyi...

Zyxel NBG-418N v2 安全漏洞

The Zyxel NBG-418N v2 is a wireless router from China Hopkins Zyxel. A security vulnerability exists in the Zyxel NBG-418N v2 firmware version prior to V1.00. An attacker could exploit this vulnerability to cause a buffer overflow...

phpMyFAQ 访问控制错误漏洞

phpMyFAQ is a multilingual, fully database-driven FAQ system by the individual developer Thorsten Rinne. An access control error vulnerability exists in versions prior to phpMyFAQ 3.1.13, which stems from improper access control...

CVE-2023-25437

An issue was discovered in vTech VCS754 version 1.1.1.A before 1.1.1.H, allows attackers to gain escalated privileges and gain sensitive information due to cleartext passwords passed in the raw HTML...

M-Files 资源管理错误漏洞

M-Files is an innovative metadata-driven document management platform from M-Files, Inc. A resource management error vulnerability exists in versions prior to M-Files 23.4.12528.1 that stems from uncontrolled memory consumption of scheduled jobs, which can be exploited by an attacker to cause a...

Oracle SQL Developer 安全漏洞

Oracle SQL Developer is a free integrated development environment from Oracle Corporation that simplifies the development and management of Oracle databases. A security vulnerability exists in Oracle SQL Developer versions prior to 23.1.0. An attacker exploiting this vulnerability could take over...

PT-2023-18415 · Tribe29 · Tribe29 Checkmk Appliance

Name of the Vulnerable Software and Affected Versions: Tribe29 Checkmk Appliance versions prior to 1.6.4 Description: The issue allows a local attacker to retrieve passwords by reading log files, specifically due to sensitive data exposure in Webconf. This can lead to unauthorized access to...

WordPress plugin JetEngine 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

Lexmark 输入验证错误漏洞

Lexmark is a line of printers in the United States. A security vulnerability exists in Certain Lexmark devices version 2023-02-19 and prior versions, which stems from an integer overflow in Lexmark devices...

CVE-2023-0382

User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption...

SUSE CVE-2023-1823

Inappropriate implementation in FedCM in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...