12579 matches found
Multiple vulnerabilities in Panasonic Control FPWIN Pro7
Overview Control FPWIN Pro7 provided by Panasonic contains multiple vulnerabilities listed below. Stack-based Buffer Overflow CWE-121 - CVE-2023-6314 Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119 - CVE-2023-6315 Michael Heinzl reported these vulnerabilities to th...
PT-2024-1326 · Intel · Intel Integrated Sensor Hub (Ish) Driver +1
Name of the Vulnerable Software and Affected Versions: Intel NUC P14E Laptop Element versions prior to 5.4.1.4479 Description: The issue is related to incorrect default permissions in the Intel Integrated Sensor Hub ISH driver, which may allow an authenticated user to potentially enable escalatio...
PT-2024-1085 · Unknown · Cp-8050 Master Module +1
Name of the Vulnerable Software and Affected Versions: CP-8031 MASTER MODULE versions prior to CPCI85 V05.20 CP-8050 MASTER MODULE versions prior to CPCI85 V05.20 Description: A flaw has been identified in the network configuration service of affected devices, related to the conversion of ipv4...
MGASA-2024-0004 Updated dropbear package fixes a security vulnerability
Parts of the SSH specification are vulnerable to a novel prefix truncation attack a.k.a. Terrapin attack, which allows a man-in-the-middle attacker to strip an arbitrary number of messages right after the initial key exchange, breaking SSH extension negotiation RFC8308 in the process and thus...
PT-2024-15109 · WordPress · Commenttweets
Name of the Vulnerable Software and Affected Versions: CommentTweets WordPress plugin versions 0.6 and earlier Description: The issue concerns the lack of CSRF checks in certain areas of the plugin, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks...
Important: bluez
Issue Overview: bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution CVE-2023-45866 Affected Packages: bluez Issue Correction: Run dnf update bluez --releasever 2023.3.20240108 to update your system. New Packages: aarch64: ...
RUSTSEC-2024-0434 Missing facility to signal rotation of a verified cryptographic identity
Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes. matrix-sdk-crypto 0.8.0 adds a n...
SUSE-SU-2024:0035-1 Security update for python-paramiko
This update for python-paramiko fixes the following issues: - CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity aka Terrapin Attack bscbsc1218168. - Update to 3.4.0...
SMTP Smuggling Enabling Spoofed Emails to Evade Authentication Protocols
Summary: A new email spoofing technique called "SMTP Smuggling" lets attackers send emails from fake addresses, bypassing security checks. This trick works by abusing how different servers handle line endings in email messages. The attack could affect millions of email users, so updating your...
Withdrawn Advisory: User-provided environment values allow execution on macOS agents
Withdrawn Advisory This advisory has been withdrawn because the vulnerability affects a binary, not a library in a supported ecosystem. Therefore, users of the library should not receive alerts. This link is maintained to preserve external references. Original Description Impact Agents running on...
PT-2024-13857 · Broadcom · Apiida Api Gateway Manager
Name of the Vulnerable Software and Affected Versions: APIIDA API Gateway Manager for Broadcom Layer7 version 2023.2 Description: The APIIDA API Gateway Manager for Broadcom Layer7 is affected by a Cross Site Scripting XSS issue. This allows for malicious scripts to be injected into the website,...
PT-2024-13611 · Google · Google Pixel Watch
Name of the Vulnerable Software and Affected Versions: Google Pixel Watch affected versions not specified Description: The issue is related to a possible way to access adb before SUW completion due to an insecure default value in the checkDebuggingDisallowed function of DeviceVersionFragment.java...
PT-2024-5150 · Artifex +3 · Artifex Ghostscript +3
Name of the Vulnerable Software and Affected Versions: Artifex Ghostscript versions prior to 10.03.0 Description: The issue is related to a stack-based buffer overflow in the Ghostscript software, which can be exploited via the CIDFSubstPath and CIDFSubstFont parameters. This can potentially allo...
PT-2024-18: Stored Cross-Site Scripting (Stored XSS) in Moodle
The vulnerability was identified in Moodle versions 4.0 - 4.3.3, 4.2 - 4.2.6, 4.1 - 4.1.9 and older unsupported versions. Insufficient escaping of participants' names in the page table leads to Stored XSS attack when interacting with some features. Discovered vulnerability allows an attacker to...
PT-2024-14836 · WordPress · Affiliate-Toolkit
Name of the Vulnerable Software and Affected Versions: affiliate-toolkit WordPress plugin version 3.4.2 and earlier Description: The issue is related to a lack of authorization and authentication for requests to the "affiliate-toolkit-starter/tools/atkp imagereceiver.php" endpoint, allowing...
MGASA-2023-0356 Updated proftpd packages fix a security vulnerability
ProFTPd upstream has released version 1.3.8b to fix CVE-2023-48795. From the changelog: - Implemented mitigations for "Terrapin" SSH attack CVE-2023-48795...
PT-2023-31928 · WordPress · Ws Form Lite
Name of the Vulnerable Software and Affected Versions: WS Form LITE – Drag & Drop Contact Form Builder for WordPress versions 1.9.170 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This...
PT-2023-31797 · Zerobounce · Zerobounce Email Verification & Validation
Name of the Vulnerable Software and Affected Versions: ZeroBounce Email Verification & Validation versions 1.0.11 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This can b...
CVE-2023-50255 Zip Path Traversal in Deepin-Compressor
Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version...