1378 matches found
ZTE MF258 Cross-Site Scripting Vulnerability
The ZTE MF258 is a desktop router from ZTE Corporation ZTE, China. A cross-site scripting vulnerability exists in the ZTE MF258 version prior to ZTESTDV1.0.0B11, which stems from insufficient validation of SMS interface parameter inputs, resulting in a cross-site scripting attack...
Amazon Linux 2 : tar (ALAS-2024-2390)
The version of tar installed on the remote host is prior to 1.26-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2390 advisory. It was discovered that tar incorrectly handled extended attributes in PAX archives. An attacker could supply a specially crafted file a...
PYSEC-2024-129
FPE in paddle.nanmedian in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service...
ClickHouse Security Breach
ClickHouse is ClickHouse's fastest and most resource-efficient open source database for real-time applications and analytics. A security vulnerability exists in ClickHouse that originates from an attacker being able to send a specially crafted payload to the publicly available native interface on...
PT-2023-31418 · Docker +1 · Docker +1
Name of the Vulnerable Software and Affected Versions: Forgejo versions prior to 1.20.5-1 Description: The issue allows for 2FA bypass when docker login uses Basic Authentication. Recommendations: For versions prior to 1.20.5-1, update to version 1.20.5-1 or later to resolve the issue...
DEBIAN-CVE-2023-6346
Use after free in WebAudio in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
OpenHarmony 安全漏洞
OpenHarmony is a kind of hongmeng operating system open source project. A security vulnerability exists in OpenHarmony prior to version v3.2.2, which can be exploited by an attacker to read and write arbitrary files via improper privilege saving...
PT-2023-32527 · Trellix · Trellix Getsusp
Name of the Vulnerable Software and Affected Versions: Trellix GetSusp versions prior to 5.0.0.27 Description: The issue is caused by improper privilege management, allowing a local, low-privilege attacker to gain access to files that usually require a higher privilege level. This occurs because...
CVE-2023-42555
Use of implicit intent for sensitive communication vulnerability in EasySetup prior to version 11.1.13 allows attackers to get the bluetooth address of user device...
CVE-2023-5889 Insufficient Session Expiration in pkp/pkp-lib
Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16...
PT-2023-32408 · Pkp · Pkp-Lib
Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue concerns an Unrestricted Upload of File with Dangerous Type and Cross-site Scripting. Recommendations: For versions prior to 3.3.0-16, update to version 3.3.0-16 or later to resolv...
AnythingLLM Access Control Error Vulnerability
AnythingLLM is a document chatbot that meets business requirements. An Access Control Error vulnerability exists in versions prior to AnythingLLM 0.1.0 that stems from incorrect access control...
CVE-2023-4933
The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled...
CVE-2023-5535 Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to v9.0.2010...
AZL-39603 CVE-2023-44487 affecting package cri-o for versions less than 1.21.7-2
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-35297 CVE-2023-44487 affecting package telegraf for versions less than 1.27.3-3
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
PT-2023-24384 · Ocomon · Ocomon
Name of the Vulnerable Software and Affected Versions: OcoMon versions prior to 4.0.1 Description: A local file inclusion issue via the lang parameter allows attackers to execute arbitrary code by supplying a crafted PHP file. This can be achieved by exploiting the vulnerability in the lang...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : vim (SUSE-SU-2023:3955-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3955-1 advisory. Security fixes: - CVE-2023-4733: Fixed use-after-free in function buflistaltfpos bsc1215004. -...
