Vulnerabilities fixed in Trend Micro Deep Security

Trend Micro has fixed vulnerabilities in Deep Security. A local malicious person can exploit the vulnerabilities to grant themselves elevated privileges and thus potentially execute arbitrary code execute arbitrary code with elevated privileges. Depending on the implementation this may include th...

JVN#83655695: Multiple Dahua Technology products vulnerable to authentication bypass

Multiple products provided by Dahua Technology contain an authentication bypass vulnerability CWE-287. Impact The product's identity verification may be bypassed if a remote attacker sends specially crafted data packets. Solution Update the software Update the software to the latest version...

PT-2024-15405 · WordPress · Connect Contact Form 7

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Connector WordPress plugin version 1.2.2 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back...

PT-2024-11521 · WordPress · Contact Form & Lead Form Elementor Builder

Name of the Vulnerable Software and Affected Versions: Contact Form & Lead Form Elementor Builder WordPress plugin versions prior to 1.7.0 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the plugin not escaping some of its form fields before...

PT-2024-15213 · Peepso · The Community By Peepso

Name of the Vulnerable Software and Affected Versions: The Community by PeepSo WordPress plugin versions prior to 6.3.1.2 Description: The issue is related to the lack of a CSRF check when creating a user post, which could allow attackers to make logged-in users perform such actions via a CSRF...

PT-2024-1538

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.35 and prior MySQL Server versions 8.2.0 and prior Description The vulnerability exists in the MySQL Server product due to insufficient input validation in the User-Defined Function UDF component. This allows a...

PT-2024-11511 · WordPress · Wp-Invoice

Name of the Vulnerable Software and Affected Versions: WP-Invoice WordPress plugin versions 4.3.1 and earlier Description: The issue is related to the lack of CSRF check when updating settings and insufficient sanitization and escaping in some settings, allowing an attacker to make a logged-in...

PT-2024-1266 · Unknown +12 · X.Org Server +12

Name of the Vulnerable Software and Affected Versions: X.Org Server versions prior to 21.1.11 Xwayland versions prior to 23.2.4 xorg-server versions prior to 1.20.8-alt12 xorg-server versions prior to 1.20.14-alt11 xorg-xwayland versions prior to 23.1.1-alt4 Description: A heap buffer overflow fl...

GHSA-JC7H-C423-MPJC Apache Shiro vulnerable to path traversal

Apache Shiro before 1.130 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure blockSemicolon is enabled this is the default...

Pleasanter vulnerable to cross-site scripting

Overview Pleasanter provided by Implem Inc. contains a cross-site scripting vulnerability CWE-79. Masamitsu Kushi of Operation Group, Communication Technology Department, Digital Innovation HQ at Mitsubishi Heavy Industries, Ltd. reported this vulnerability to Implem Inc. and coordinated. After t...

PT-2024-5115 · Trend Micro +1 · Trend Micro Security +2

Name of the Vulnerable Software and Affected Versions: Trend Micro Security versions 17.x Trend Micro Maximum Security affected versions not specified Description: The issue is related to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged...

Security Bulletin: A vulnerability in axios affects IBM Robotic Process Automation and may result in cross-site request forgery (CVE-2023-45857).

Summary axios is used by IBM Robotic Process Automation as part of control center CVE-2023-45857. Vulnerability Details CVEID:CVE-2023-45857 DESCRIPTION: Axios is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By inserting the X-XSRF-TOKEN header...

FCC wants cars to make life harder for stalkers

Most new model cars are not just cars anymore. With multiple digital systems, vehicles are increasingly plugged into web applications and digital processes. Some of them are basically smartphones on wheels. Even if we assume these new features were all created with your convenience in mind, some ...

DSA-5599-1 phpseclib - security update

Bulletin has no description...

PT-2024-1237 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.8.13 GitHub Enterprise Server versions prior to 3.9.8 GitHub Enterprise Server versions prior to 3.10.5 GitHub Enterprise Server versions prior to 3.11.3 Description: The issue is related to...

CVE-2023-50159

In ScaleFusion Windows Desktop App agent 10.5.2, Kiosk mode application restrictions can be bypassed allowing arbitrary code to be executed. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode...

CVE-2022-32919

The issue was addressed with improved UI handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Visiting a website that frames malicious content may lead to UI spoofing...

Cisco TelePresence Management Suite Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco TelePresence Management Suite TMS Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. These vulnerabilities are due to insufficient input...

Cisco ThousandEyes Enterprise Agent Virtual Appliance Privilege Escalation Vulnerability

A vulnerability in the web-based management interface of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. This vulnerability is due to insufficient validation of...

GHSA-PPXX-5M9H-6VXF quic-go's path validation mechanism can be exploited to cause denial of service

An attacker can cause its peer to run out of memory sending a large number of PATHCHALLENGE frames. The receiver is supposed to respond to each PATHCHALLENGE frame with a PATHRESPONSE frame. The attacker can prevent the receiver from sending out the vast majority of these PATHRESPONSE frames by...