PT-2023-13216 · Apple · Xcode +1

Name of the Vulnerable Software and Affected Versions: Xcode versions prior to 14.0 Description: The issue may lead to disclosure of user information when parsing a file. It was addressed with improved checks. Recommendations: For versions prior to 14.0, update to Xcode 14.0 to resolve the issue...

PT-2023-20907

Name of the Vulnerable Software and Affected Versions Finex Media Competition Management System versions prior to 23.07 Description The issue allows exposure of private personal information to an unauthorized actor, enabling the retrieval of embedded sensitive data and collection of data as...

CloudExplorer Lite 访问控制错误漏洞

CloudExplorer Lite is CloudExplorer's platform that provides out-of-the-box basic features such as cloud hosting management, cloud billing, operational analytics, and security compliance, as well as powerful extensibility to meet the customization needs of enterprises. An access control error...

CVE-2023-25183

In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that could allow users to execute arbitrary commands on the hub device...

CVE-2023-2839

Divide By Zero in GitHub repository gpac/gpac prior to 2.2.2...

CVE-2023-2832

SQL Injection in GitHub repository unilogies/bumsys prior to 2.2.0...

PT-2023-23741 · Teltonika · Teltonika'S Remote Management System

Name of the Vulnerable Software and Affected Versions: Teltonika’s Remote Management System versions prior to 4.10.0 Description: The issue concerns the virtual private network VPN hub feature in Teltonika’s Remote Management System, which utilizes OpenVPN for cross-device communication. This...

PT-2023-23261 · Snap One · Ovrc Pro

Name of the Vulnerable Software and Affected Versions: Snap One OvrC Pro versions prior to 7.2 Description: The issue concerns a locally running web server in Snap One OvrC Pro that is accessible from both the local network and remotely. Additionally, there is a hidden superuser account in OvrC...

PT-2023-21647 · Unilogies · Bumsys

Name of the Vulnerable Software and Affected Versions: unilogies/bumsys versions prior to 2.2.0 Description: The issue is related to SQL Injection in the GitHub repository unilogies/bumsys. Recommendations: For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue...

PT-2023-20929 · Sitecore · Sitecore Experience Platform

Name of the Vulnerable Software and Affected Versions: Sitecore Experience Platform versions prior to 10.2 Description: The issue allows remote attackers to download arbitrary files via a crafted command to the "download.aspx" endpoint. This is achieved by exploiting a Directory Traversal...

PT-2023-20965

Name of the Vulnerable Software and Affected Versions Rental Module versions prior to 23.05.15 Description The issue allows Command Injection and enables attackers to upload malicious files, including web shells, to a web server. This is due to an Unrestricted Upload of File with Dangerous Type...

Pixel＆tonic Craft CMS 注入漏洞

Pixel & tonic Craft CMS is a content management system CMS from Pixel & tonic USA. An injection vulnerability exists in Craft CMS versions prior to 4.4.6, which stems from an unrestricted file extension that could lead to remote code execution...

OpenText Documentum Content Server 安全漏洞

OpenText Documentum Content Server is a data storage platform from OpenText, Inc. that is used to provide secure, enterprise-wide control over any type of content. A security vulnerability exists in OpenText Documentum Content Server versions prior to 23.2, which stems from a privilege escalation...

多款Western Digital产品资源管理错误漏洞

Western Digital My Cloud is a personal cloud storage device.Western Digital My Cloud Home is an easy-to-use personal cloud storage device.SanDisk ibi is a smart photo manager and media storage drive from SanDisk Corporation. SanDisk ibi and others are products of SanDisk Corporation.SanDisk ibi i...

Johnson Controls OpenBlue Enterprise Manager Data Collector 授权问题漏洞

The Johnson Controls OpenBlue Enterprise Manager Data Collector is an industrial PC from Johnson Controls that provides connectivity to instrumentation and building automation systems to extract data from EM applications. A security vulnerability exists in Johnson Controls OpenBlue Enterprise...

PT-2023-23761 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.4 Description: A buffer overflow issue was addressed with improved memory handling, allowing an app to potentially execute arbitrary code with kernel privileges. Recommendations: For versions prior to 13.4, update t...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current curl Multiple Vulnerabilities (SSA:2023-137-01)

The version of curl installed on the remote host is prior to 8.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-137-01 advisory. - A use after free vulnerability exists in curl v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key...

CVE-2023-2752 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta...

Amazon Linux 2 : golang (ALAS-2023-2037)

The version of golang installed on the remote host is prior to 1.18.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2037 advisory. HTTP and MIME header parsing could allocate large amounts of memory, even when parsing small inputs. Certain unusual patterns of...

PT-2023-21350 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: mlflow versions prior to 2.3.1 Description: The issue is related to path traversal, where the sequence '..filename' can be used to bypass security restrictions. This allows unauthorized access to files and directories outside the intended...