CVE-2022-1415 Drools: unsafe data deserialization in streamutils

A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects usually called gadgets and achieve code execution on the server...

Race Condition

wiremock is vulnerable toa Race Condition. The vulnerability is due to the render function when DNS server's address expire between initial validation and an outbound network request, potentially leading to unintended access to prohibited domains...

CVE-2023-39699

IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion LFI vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server...

PT-2023-4595

Name of the Vulnerable Software and Affected Versions: Python versions prior to 3.8.18 Python versions 3.9.x prior to 3.9.18 Python versions 3.10.x prior to 3.10.13 Python versions 3.11.x prior to 3.11.5 Description: An issue was discovered in Python that primarily affects servers using TLS clien...

CVE-2023-23565

An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to retrieve PHP files from the server via Local File Inclusion...

UBUNTU-CVE-2020-23793

An issue was discovered in spice-server spice-server-0.14.0-6.el76.1.x8664 of Redhat's VDI product. There is a security vulnerablility that can restart KVMvirtual machine without any authorization. It is not yet known if there will be other other effects...

CVE-2023-26469

In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server...

CVE-2023-26469

In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server...

PT-2023-28796 · Broadcom · Broadcom Raid Controller Web Server

Name of the Vulnerable Software and Affected Versions: Broadcom RAID Controller Web server nginx affected versions not specified Description: The issue concerns the Broadcom RAID Controller Web server, which is based on nginx and is serving private server-side files without any authentication on...

Cross site scripting

ScanCode.io is a server to script and automate software composition analysis pipelines. In the /license/ endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting XSS vulnerability when attempting to access a detailed license vie...

CVE-2023-39964

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. In the api/v1/file.go file, there is a function called LoadFromFile, which directly reads the...

Nextcloud Security Breach

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Server. An attacker could use this vulnerability to brute-force break the client secrets of a configured OAuth...

Denial of Service (DoS)

Overview Microsoft.AspNetCore.App.Runtime.win-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Denial of Service DoS in Kestrel where, on detecting a...

CVE-2023-38181 Microsoft Exchange Server Spoofing Vulnerability

...

CVE-2023-36894 Microsoft SharePoint Server Information Disclosure Vulnerability

...

CVE-2023-37491 Improper Authorization check vulnerability in SAP Message Server

The ACL Access Control List of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authenticated malicious user to enter the...

Siemens RUGGEDCOM CROSSBOW SQL注入漏洞

RUGGEDCOM CROSSBOW is a secure access management solution designed to provide NERC CIP compliant access to smart electronic devices. Siemens RUGGEDCOM CROSSBOW suffers from a SQL injection vulnerability that can be exploited by an attacker to execute arbitrary SQL queries on the server database...

SAP Message Server 授权问题漏洞

SAP Message Server is a message server application from SAP Germany. SAP Message Server is vulnerable to authorization issues, no details of the vulnerability are provided at this time...

Suprema BioStar 2 Operating System Command Injection Vulnerability

Suprema BioStar 2 is a web-based biometric security smart lock platform from Suprema Korea. A security vulnerability exists in Suprema BioStar 2 versions prior to V2.9.1, which stems from a vulnerability that allows an authenticated user to execute arbitrary operating system commands on the BioSt...

Minecraft fans beware: Players and servers at risk from BleedingPipe vulnerability

Minecraft players interested in modding are potentially at risk of compromise. A Remote Code Execution RCE vulnerability in certain Minecraft mods allows for malicious commands on both servers and clients. The vulnerability, named BleedingPipe, allows attackers to take over a targeted server...