SUSE CVE-2019-14817

A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. A specially crafted PostScript file could disable security protection and then have access to...

CVE-2023-0159

The CVE-2023-0159 entry affects the WordPress plugin Extensive VC Addons for WPBakery page builder (versions prior to 1.9.1). The vulnerability arises from not validating a parameter passed to PHP’s extract function when loading templates, permitting an unauthenticated attacker to override the te...

SOUND4 LinkAndShare Transmitter 1.1.2 Format String Stack Buffer Overflow

Summary The SOUND4 Link&Share L&S is a simple and open protocol that allow users to remotely control SOUND4 processors through a network connection. SOUND4 offers a tool that manage sending L&S commands to your processors: the Link&Share Transmitter. Description The application suffers from a...

CVE-2023-24439

Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2023-0101

A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1. An authenticated attacker could potentially execute a specially crafted file to obtain root or NT AUTHORITY / SYSTEM privileges on the Nessus host...

PT-2023-14606 · Dell · Solution Enabler Vapp +2

Name of the Vulnerable Software and Affected Versions: Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x Description: The issue allows a low privileged remote attacker to potentially exploit an information disclosure vulnerability, leading to the...

Authentication Bypass

github.com/nanobox-io/golang-nanoauth is vulnerable to Authentication Bypass. The vulnerability exists due to an improper authentication mechanism in nanoauth.go which allows an attacker to bypass permission checks and gain access to the system when the ListenAndServe function is called with an...

CVE-2022-4258 Hima: Unquoted path vulnerabilities in HIMA PC based Software

In multiple versions of HIMA PC based Software an unquoted Windows search path vulnerability might allow local users to gain privileges via a malicious .exe file and gain full access to the system...

Shibboleth 代码问题漏洞

Shibboleth is an open source SAML protocol Web Single Sign-On system for Windows from Shibboleth, UK. A security vulnerability exists in Shibboleth Service Provider SP Windows versions prior to 3.4.1, which stems from the installation being located under C:opt instead of C:Program Files by defaul...

CVE-2022-45093

Siemens SINEC INS exposes CVE-2022-45093 affecting all versions prior to V1.0 SP2 Update 1. An authenticated remote attacker who can reach both the Web Based Management interface (443/tcp) and the SFTP service (22/tcp) could read and write arbitrary files on the device file system, potentially le...

CVE-2022-45092

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 1. An authenticated remote attacker with access to the Web Based Management 443/tcp of the affected product, could potentially read and write arbitrary files from and to the device's file system. An attacker might...

CVE-2023-0014

CVE-2023-0014 affects SAP NetWeaver ABAP Server and ABAP Platform on multiple SAP_BASIS versions (700…757) and kernel/CR components (e.g., 7.22, 7.53, 7.77, 7.81, 7.85, 7.89; KRNL64UC/NUC) where the system identity is created in an ambiguous format. This behavior can enable a capture-replay vulne...

CVE-2022-36929

The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to the SYSTEM user...

Zoom Rooms 安全漏洞

Zoom Rooms is a software-based conferencing system from Zoom USA. A system that allows web conferencing on fixed endpoints, similar to traditional video conferencing systems. A security vulnerability exists in Zoom Rooms for Windows installers versions prior to 5.13.0. An attacker could exploit t...

PT-2023-12766 · Nokia · Asik Airscale

Name of the Vulnerable Software and Affected Versions: Nokia ASIK AirScale system module versions 474021A.101 through 474021A.102 Description: A vulnerability exists in Nokia’s ASIK AirScale system module that could allow an attacker to place a script on the file system accessible from Linux. A...

PT-2023-1099 · Zoom · Zoom Rooms For Windows

Name of the Vulnerable Software and Affected Versions: Zoom Rooms for Windows versions prior to 5.13.0 Description: The issue is related to an uncontrolled search path element in the Zoom video conferencing software. Exploitation of this issue could allow an attacker to elevate their privileges t...

Design/Logic Flaw

Prosys OPC UA Simulation Server version prior to v5.3.0-64 and UA Modbus Server versions 1.4.18-5 and prior do not sufficiently protect credentials, which could allow an attacker to obtain user credentials and gain access to system data...

Authentication Bypass

rdiffweb is vulnerable to authentication bypass. The vulnerability exists because the user authentication mechanism is not properly implemented, which allows an attacker to bypass permission checks and gain access to the system...

PT-2023-13094 · Meta · Meta Wifi

Name of the Vulnerable Software and Affected Versions: Meta WiFi affected versions not specified Description: The issue is related to a possible out of bounds write due to a missing bounds check in Meta WiFi. This could lead to local escalation of privilege with System execution privileges needed...

Improper Access Control

github.com/usememos/memos is vulnerable to improper access control. The vulnerability exists because the values are not properly handled which allows an attacker to gain access to system...