ELECOM WAB-MAT registers its windows service executable with an unquoted file path

Overview WAB-MAT provided by ELECOM CO.,LTD. is Access Point Management Tool for corporate users. WAB-MAT registers its windows service executable with an unquoted file path CWE-428. Tomohisa Hasegawa of Canon IT Solutions Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the...

PT-2023-21718 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: Dataease versions prior to 1.18.5 Description: The issue concerns the file upload interface in Dataease, where permissions are not properly checked, allowing users who are not logged in to upload files directly to the background. Additionally...

DLA-3366-1 tzdata - new timezone database

Bulletin has no description...

Intel® DCM Advisory

Summary: A potential security vulnerability in the Intel® Data Center Manager DCM software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-33942 Description: Protection mechanism failure in the...

PT-2023-20214 · Basercms · Basercms

Name of the Vulnerable Software and Affected Versions: baserCMS versions prior to 4.7.5 Description: There is a Remote Code Execution RCE Vulnerability in the management system of baserCMS. This issue allows for remote code execution, which is a serious security concern. The estimated number of...

PT-2023-20215 · Basercms · Basercms

Name of the Vulnerable Software and Affected Versions: baserCMS versions prior to 4.7.5 Description: The issue allows any file to be uploaded on the management system of baserCMS. This poses a risk, especially when the management system is used by multiple users. The vulnerability enables malicio...

Cisco IOS XE Software Fragmented Tunnel Protocol Packet Denial of Service Vulnerability

A vulnerability in the fragmentation handling code of tunnel protocol packets in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected system to reload, resulting in a denial of service DoS condition. This vulnerability is due to the improper handling of large...

Cisco IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the Cloud Management for Catalyst migration feature of Cisco IOS XE Software could allow an authenticated, local attacker to gain root-level privileges on an affected device. This vulnerability is due to insufficient memory protection in the Cisco IOS XE Meraki migration featur...

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability

A vulnerability in the deterministic random bit generator DRBG, also known as pseudorandom number generator PRNG, in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software for Cisco ASA 5506-X, ASA 5508-X, and ASA 5516-X Firewalls could allow an...

Important: zlib

Issue Overview: An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large number of distant matches crafted payloads, the buffer into which the compressed or deflated...

PT-2023-2196 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 Description: The issue is related to a deserialization vulnerability in the Device-gateway service, which could allow deserialization of requests prior to authentication,...

PT-2023-2346 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 Description: The issue is related to insufficient input validation in the Delta Electronics InfraSuite Device Master software, which could allow an unauthenticated attacker to...

PT-2023-20243 · Ibm · Ibm Security Guardium Key Lifecycle Manager

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium Key Lifecycle Manager versions 3.0 through 4.1.1 Description: The issue allows a remote attacker to send specially crafted SQL statements, which could enable the attacker to view, add, modify, or delete information in th...

PT-2023-16411 · WordPress · Paid Memberships Pro

Name of the Vulnerable Software and Affected Versions: Paid Memberships Pro WordPress plugin versions prior to 2.9.12 Description: The issue concerns the Paid Memberships Pro WordPress plugin, where subscribers can render shortcodes that concatenate attributes directly into an SQL query. This is...

MGASA-2023-0095 Updated mysql-connector-c++ packages fix security vulnerability

The program plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. CVE-2022-24407...

MGASA-2023-0097 Updated ruby-git packages fix security vulnerability

ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. CVE-2022-46648, CVE-2022-47318...

SUSE-SU-2023:0799-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2023-27522: Fixed HTTP response splitting in modproxyuwsgi bsc1209049. - CVE-2023-25690: Fixed HTTP request splitting with modrewrite and modproxy bsc1209047. The following non-security bugs were fixed: - Fixed passing health check does no...

PT-2023-17001 · Teampass · Teampass

Name of the Vulnerable Software and Affected Versions: teampass versions prior to 3.0.0.23 Description: The issue is related to improper authorization in the teampass GitHub repository. It allows for authorization bypass through a user-controlled key. There is no information provided about the...

PT-2023-18229 · Unknown · Secsettings

Name of the Vulnerable Software and Affected Versions: SecSettings versions prior to SMR Mar-2023 Release 1 Description: The issue is related to improper authentication in SecSettings, allowing an attacker to reset the setting. Recommendations: For versions prior to SMR Mar-2023 Release 1, update...

PT-2023-18223 · Samsung · Exynos

Name of the Vulnerable Software and Affected Versions: Exynos baseband versions prior to SMR Mar-2023 Release 1 Description: The issue is related to improper authorization implementation, which leads to incorrect handling of unencrypted messages. Recommendations: For versions prior to SMR Mar-202...