PT-2023-18968 · Sourcecodester · Sourcecodester Service Provider Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Service Provider Management System version 1.0 Description: A critical issue has been found in the system, affecting the file /admin/inquiries/view inquiry.php. The manipulation of the id argument leads to SQL injection. This...

PT-2023-2616 · Myscada · Myscada Mypro

Name of the Vulnerable Software and Affected Versions: mySCADA myPRO versions 8.26.0 and prior Description: The issue is related to insufficient checking of arguments passed to a command, allowing a remote attacker to execute arbitrary code in the operating system. An authenticated user could...

The vulnerability of the microprogramming software for Schneider Electric’s spaceLYnk and homeLYnk logic controllers arises from incorrect restrictions on the path name in the restricted access catalog. This allows attackers to trigger a service failure.

The vulnerability of the microprogramming software for Schneider Electric’s spaceLYnk and homeLYnk logic controllers is related to an incorrect limitation on the path name in the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to trigger a service failure...

CVE-2023-29526 Async and display macro allow displaying and interacting with any document in restricted mode

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to display or interact with any page a user cannot access through the combination of the async and display macros. A comment with either macro will be execut...

PT-2023-2788 · Oracle +2 · Virtualbox +2

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.44 Oracle VM VirtualBox versions prior to 7.0.8 Description: The issue is related to a use-after-free vulnerability in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker...

The vulnerability of the command-line interface of ArubaOS systems allows a hacker to delete any files they desire.

The vulnerability of the command-line interface of ArubaOS systems is related to incorrect restrictions on the path name to the restricted-access directory. Exploiting this vulnerability could allow a remote attacker to delete any files they desire...

The vulnerability of the command-line interface of ArubaOS systems allows a hacker to delete any files they desire.

The vulnerability of the command-line interface of ArubaOS systems is related to incorrect restrictions on the path name to the restricted-access directory. Exploiting this vulnerability could allow a remote attacker to delete any files they desire...

The vulnerability of the ML lifecycle management platform, related to an incorrect restriction on the path name for the restricted access catalog, allows a perpetrator to gain unauthorized access to protected information, execute arbitrary code, or obtain full control over the system.

The vulnerability of the ML lifecycle management platform is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information, execute arbitrary code, or gain full contr...

PT-2023-21052 · Ibm · Ibm Aspera Connect +1

Name of the Vulnerable Software and Affected Versions: IBM Aspera Cargo version 4.2.5 IBM Aspera Connect version 4.2.5 Description: The issue is caused by improper bounds checking, leading to a buffer overflow. An attacker could exploit this to execute arbitrary code on the system. Recommendation...

The vulnerability of the UPSMON Pro monitoring system, related to errors in processing the relative path to the restricted-access catalog, allows a perpetrator to bypass security restrictions and gain unauthorized access to protected information.

The vulnerability of the UPSMON Pro monitoring system is related to errors in processing the relative path to the restricted-access catalog. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions and gain unauthorized access to protected information...

The vulnerability of the ColdFusion software platform arises from an incorrect limitation on the path to the restricted access catalog, allowing attackers to execute arbitrary code.

The vulnerability of the ColdFusion software platform exists due to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

8x8: Unprotected Atlantis Server at https://132.226.█.█

Vulnerability description not provided...

The vulnerability of the microprogramming software of TP-Link Archer C5, C7, C8, C9, TL-WR740N, TL-WR741ND, TL-WR841N, TL-WR841ND, TL-WR841ND (9.0), and TL-WR841ND allows a hacker to bypass authentication procedures and read or write arbitrary files into the system.

The vulnerability of the microprogrammed software of TP-Link Archer C5, C7, C8, C9, TL-WR740N, TL-WR741ND, TL-WR841N, TL-WR841ND, TL-WR841ND 9.0, and TL-WR841ND is related to incorrect restrictions on path names in the restricted access directory. Exploiting this vulnerability allows a malicious...

The vulnerability of FortiWeb web applications’ network firewalls arises from incorrect restrictions on the path to the restricted access catalog, allowing attackers to gain unauthorized access to protected information.

The vulnerability of FortiWeb web applications’ network firewalls is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a special...

PT-2023-20567 · Covesa +1 · Dlt-Daemon +1

Name of the Vulnerable Software and Affected Versions: dlt-daemon versions through 2.18.8 Description: An issue was discovered in the Connected Vehicle Systems Alliance COVESA; formerly GENIVI dlt-daemon. Dynamic memory is not released after it is allocated in dlt-control-common.c. Recommendation...

PT-2023-1389

Name of the Vulnerable Software and Affected Versions HAProxy versions prior to 2.7.3 HAProxy versions prior to 2.6.9 HAProxy versions prior to 2.5.12 HAProxy versions prior to 2.4.22 HAProxy versions prior to 2.2.29 HAProxy versions prior to 2.0.31 Description The issue is related to the handlin...

PT-2023-19670 · Sap · Sap Netweaver As Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP Business Server Pages versions 700, 701, 702, 731, 740 Description: The issue is caused by insufficient input sanitization, allowing an unauthenticated user to alter the current session of the user by injecting malicious...

PT-2023-15690 · Hewlett Packard · Hp Deskjet 2540 Series

Name of the Vulnerable Software and Affected Versions: HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR Description: The issue allows an authenticated attacker to inject their own script into the page via the HTTP configuration page, which is a Cross Site Scripting XSS problem. This...

CVE-2023-23933 Issue in Anomaly Detection with document and field level rules in numerical feature aggregations

OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications. There is an issue with the application of document and field level restrictions in the Anomaly Detection plugin, where users with the Anomaly Detector role can read aggregated numerical data e.g. averages,...

CVE-2022-3482

An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only...