3863 matches found
Anevia Flamingo XL 3.6.20 Authenticated Root Remote Code Execution
Summary Flamingo XL, a new modular and high-density IPTV head-end product for hospitality and corporate markets. Flamingo XL captures live TV and radio content from satellite, cable, digital terrestrial and analog sources before streaming it over IP networks to STBs, PCs or other IP-connected...
Anevia Flamingo XS 3.6.5 Authenticated Root Remote Code Execution
Summary Flamingo XL, a new modular and high-density IPTV head-end product for hospitality and corporate markets. Flamingo XL captures live TV and radio content from satellite, cable, digital terrestrial and analog sources before streaming it over IP networks to STBs, PCs or other IP-connected...
Password Hash Disclosure
pimcore/customer-management-framework-bundle is vulnerable to Password Hash Disclosure. The vulnerability exists due to the getDetailviewData function of DefaultCustomerView.php because it does not properly mask user password hashes, which allows an attacker to crack the password hash and gain...
CVE-2023-20178
A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed aft...
Security Bulletin: There is a vulnerability in JSZip used by IBM Maximo Asset Management (CVE-2022-48285)
Summary There is a vulnerability in JSZip used by IBM Maximo Asset Management. Vulnerability Details CVEID:CVE-2022-48285 DESCRIPTION: JSZip could allow a remote attacker to traverse directories on the system, caused by the failure to sanitize filenames when files are loaded with loadAsync, which...
CVE-2023-28353
An issue was discovered in Faronics Insight 10.0.19045 on Windows. An unauthenticated attacker is able to upload any type of file to any location on the Teacher Console's computer, enabling a variety of different exploitation paths including code execution. It is also possible for the attacker to...
The vulnerability of the OPC Factory Server data server, related to incorrect restrictions on XML links to external objects, allows attackers to gain unauthorized access to the file system.
The vulnerability of the OPC Factory Server data server is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to the file system...
PT-2023-23651 · Vipre · Vipre Antivirus Plus
Name of the Vulnerable Software and Affected Versions: VIPRE Antivirus Plus affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target syste...
PT-2023-23647 · Vipre · Vipre Antivirus Plus
Name of the Vulnerable Software and Affected Versions: VIPRE Antivirus Plus affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations of VIPRE Antivirus Plus. An attacker must first obtain the ability to execute low-privileged...
PT-2023-23650 · Vipre · Vipre Antivirus Plus
Name of the Vulnerable Software and Affected Versions: VIPRE Antivirus Plus affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target syste...
CVE-2023-28080
PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains DLL Hijacking Vulnerabilities. A regular user non-admin can exploit these issues to potentially escalate privileges and execute arbitrary code in the context of NT AUTHORITY\SYSTEM...
Apache InLong Security Bypass Vulnerability
Apache InLong is the United States Apache Apache Foundation's one-stop massive data integration framework. A security bypass vulnerability exists in Apache InLong versions 1.4.0 through 1.6.0, which stems from insufficient session expiration, and can be exploited by an attacker to reuse old...
Command injection
All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the installModule function. Note: To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have...
CVE-2023-26128
All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the installModule function. Note: To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have...
Authentication Bypass
concrete5 is vulnerable to Authentication Bypass. The vulnerability exists due to the lack of authentication validation in Job.php which allows an attacker to bypass permission checks and access the system...
PT-2023-23644 · Wacom · Wacom Drivers For Windows
Name of the Vulnerable Software and Affected Versions: Wacom Drivers for Windows affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations of Wacom Drivers for Windows. An attacker must first obtain the ability to execute...
CVE-2023-31761
Weak security in the transmitter of Blitzwolf BW-IS22 Smart Home Security Alarm v1.0 allows attackers to gain full access to the system via a code replay attack...
CVE-2023-31762
Weak security in the transmitter of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to gain full access to the system via a code replay attack...