PT-2023-22357 · Tenda · Tenda N301

Name of the Vulnerable Software and Affected Versions: Tenda N301 version 6.0, Firmware version 12.02.01.61 multi Description: The issue allows an authenticated attacker on the LAN or WLAN to intercept communications with the router and obtain the password due to cleartext transmission in...

CVE-2023-29680

CVE-2023-29680 affects Tenda N301 devices with v6.0 firmware (example: v12.02.01.61_multi). The issue is cleartext transmission via the set-cookie:ecos_pw cookie, allowing an authenticated attacker on the LAN/WLAN to intercept router communications and obtain the password. Red Hat and NVD entries...

OESA-2023-1263 screen security update

Screen is a full-screen window manager that multiplexes a physical terminal between several processes,typically interactive shells. Security Fixes: socket.c in GNU Screen through 4.9.0, when installed setuid or setgid the default on platforms such as Arch Linux and FreeBSD, allows local users to...

ROS-20230428-01

A vulnerability in the Python Charmers Future program is related to improper input validation when processing the the Set-Cookie header. Exploitation of the vulnerability could allow an attacker acting remotely to to send a specially crafted HTTP request to the application and perform a denial of...

CVE-2023-29779

Sengled Dimmer Switch V0.0.9 contains a denial of service DOS vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes. After receiving the malicious command, the device will keep reporting its status and finally drain its battery...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator...

CVE-2023-26060

An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that has a client-side template injection payload. Input validation is missing during creation of the working set. For an external attacker, it is very difficult t...

CVE-2023-26060

An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that has a client-side template injection payload. Input validation is missing during creation of the working set. For an external attacker, it is very difficult t...

Input validation

An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that has a client-side template injection payload. Input validation is missing during creation of the working set. For an external attacker, it is very difficult t...

DEBIAN-CVE-2023-31083

An issue was discovered in drivers/bluetooth/hcildisc.c in the Linux kernel 6.2. In hciuartttyioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCIUARTPROTOSET is set before hu-proto is set. A NULL pointer dereference may occur...

UBUNTU-CVE-2023-31083

An issue was discovered in drivers/bluetooth/hcildisc.c in the Linux kernel 6.2. In hciuartttyioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCIUARTPROTOSET is set before hu-proto is set. A NULL pointer dereference may occur...

PT-2023-21583 · Avalanche · Avalanche

Name of the Vulnerable Software and Affected Versions: Avalanche versions 6.3.x and below Description: An authentication bypass issue exists that could allow an attacker to gain access by exploiting the SetUser method or by exploiting a Race Condition in the authentication message. Recommendation...

Nokia NetAct 代码注入漏洞

Nokia NetAct is a network management system from Nokia of Finland. A security vulnerability exists in Nokia NetAct versions prior to 22 FP2211, which stems from a lack of input validation during the creation of a working set...

CVE-2023-29913

H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/aspForm...

PT-2023-18961 · Sick · Sick Fx0-Gpnt00000 Flexisoft Pnet Gatew. +9

Name of the Vulnerable Software and Affected Versions: SICK UE410-EN3 FLEXI ETHERNET GATEW. versions all SICK UE410-EN1 FLEXI ETHERNET GATEW. versions all SICK UE410-EN3S04 FLEXI ETHERNET GATEW. versions all SICK UE410-EN4 FLEXI ETHERNET GATEW. versions all SICK FX0-GENT00000 FLEXISOFT EIP GATEW...

The vulnerability of the closed software environment of the Cisco Identity Services Engine allows a perpetrator to increase their privileges.

The vulnerability of the closed software environment of the Cisco Identity Services Engine exists due to the lack of measures taken to neutralize special elements used in the operating system command set. Exploiting this vulnerability can allow attackers to enhance their privileges...

Mozilla: Fullscreen notification obscured

The Mozilla Foundation Security Advisory describes this flaw as: A website could have obscured the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. This could have led to user confusion and possible spoofing attack...

Mozilla: Fullscreen notification obscured

The Mozilla Foundation Security Advisory describes this flaw as: A website could have obscured the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. This could have led to user confusion and possible spoofing attack...

Mozilla: Fullscreen notification obscured

The Mozilla Foundation Security Advisory describes this flaw as: A website could have obscured the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. This could have led to user confusion and possible spoofing attack...

Mozilla: Fullscreen notification obscured

The Mozilla Foundation Security Advisory describes this flaw as: A website could have obscured the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. This could have led to user confusion and possible spoofing attack...