PT-2023-31901 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: Mattermost fails to properly check permissions when retrieving a post, allowing a System Role with the permission to manage channels to read the posts of a DM conversation...

UBUNTU-CVE-2023-42822

xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdppainter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within...

GLPI Information Disclosure Vulnerability

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

PT-2023-6841 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.10 Description: The issue is related to insecure privilege management in GLPI, a free asset and IT management software package. An API user with read access to user resources can steal accounts of other users. The...

PT-2023-28657 · Apple · Ios +3

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 17 iPadOS versions prior to 17 macOS versions prior to Sonoma 14 watchOS versions prior to 10 Description: A permissions issue was addressed with additional restrictions. This issue allows an app to potentially read...

PT-2023-6822 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.10 Description: The issue is related to information disclosure in the GLPI system. Exploitation of this issue may allow a remote attacker to disclose protected information. An API user can enumerate sensitive field...

Jenkins Security Vulnerabilities

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. Jenkins has a security vulnerability that stems from not excluding sensitive build variables such as password parameter...

The vulnerability of the Apache Superset data visualization software lies in authentication errors, which allow an attacker to gain read access to the database.

The vulnerability of the Apache Superset data visualization software is related to authentication errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain read access to the database...

PT-2023-20192 · Fortinet · Fortiap-W2 +3

Name of the Vulnerable Software and Affected Versions: FortiAP-W2 versions 6.0 through 7.2.1 FortiAP-C versions 5.2 through 5.4.4 FortiAP versions 6.0 through 7.2.1 FortiAP-U versions 5.4 through 7.0.0 Description: An incomplete filtering of one or more instances of special elements in the comman...

CVE-2023-41947

A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to Frugal Testing using attacker-specified credentials...

PT-2023-5197

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.1.0 Description The issue is related to improper data authorization checks on Jinja templated queries, allowing an authenticated user to issue queries on database tables they may not have access t...

MediaTek Chip Security Breach

MediaTek chips are a variety of MediaTek chips from MediaTek, a Chinese company. A security vulnerability exists in the MediaTek chips, which is caused due to an improper access control of the register interface in the bluetooth driver, which may allow read and write access to registers...

PT-2023-24040 · Unknown · Bluetooth Driver

Name of the Vulnerable Software and Affected Versions: Bluetooth driver affected versions not specified Description: The issue is related to improper access control of the register interface in the Bluetooth driver, allowing possible read and write access to registers. This could lead to a local...

CVE-2023-23763

An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain read access to an upstream repository after its visibility was changed to private. This vulnerability affected all versions of GitHub Enterprise Server prior to...

GitHub Enterprise Server Security Vulnerability

GitHub Enterprise Server is a U.S. GitHub open source application. Provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server versions prior to 3.10.0, 3.9.4,...

CVE-2023-2914

The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, an integer overflow condition exists in the affected products. When the ThinManager processes incoming messages, a read access violation occurs and terminates the process. A malicious user...

PT-2023-26929 · Installd · Installd

Name of the Vulnerable Software and Affected Versions: installd affected versions not specified Description: The issue is related to a parameter verification vulnerability in the installd module. This vulnerability can be exploited to read and write sandbox files without proper authorization...

PYSEC-2023-136

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider. Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read fil...

How to pre-populate domain name in Citrix Web Studio logon page

This article describes how to automatically pre-populate the domain name in Citrix Web Studio logon page. Requirements Citrix Web Studio Read/writeaccess to C:\Program Files\Citrix\Web Studio\Site...

CVE-2023-37855

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem within the embedded Qt browser...