May 23, 2023-KB5026958 Cumulative Update Preview for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 22H2

None None...

Sitecore Experience Platform 路径遍历漏洞

Sitecore Experience Platform XP is a suite of customer digital experience platforms from Sitecore, Denmark. A security vulnerability exists in Sitecore Experience Platform 10.2 and prior versions, which stems from a directory traversal vulnerability that allows remote attackers to download...

PT-2023-23741 · Teltonika · Teltonika'S Remote Management System

Name of the Vulnerable Software and Affected Versions: Teltonika’s Remote Management System versions prior to 4.10.0 Description: The issue concerns the virtual private network VPN hub feature in Teltonika’s Remote Management System, which utilizes OpenVPN for cross-device communication. This...

PT-2023-20928 · Sitecore · Sitecore Experience Platform

Name of the Vulnerable Software and Affected Versions: Site Core Experience Platform versions 10.2 and earlier Description: The issue allows authenticated remote attackers to download arbitrary files via Urlhandle. This is a Directory Traversal vulnerability. Recommendations: For Site Core...

PT-2023-20929 · Sitecore · Sitecore Experience Platform

Name of the Vulnerable Software and Affected Versions: Sitecore Experience Platform versions prior to 10.2 Description: The issue allows remote attackers to download arbitrary files via a crafted command to the "download.aspx" endpoint. This is achieved by exploiting a Directory Traversal...

Sitecore Experience Platform 路径遍历漏洞

Sitecore Experience Platform XP is a suite of customer digital experience platforms from Sitecore, Denmark. A security vulnerability exists in Sitecore Experience Platform 10.2 and prior versions, which stems from a directory traversal vulnerability that could allow an authenticated, remote...

CVE-2023-31655

redis v7.0.10 was discovered to contain a segmentation violation. This vulnerability allows attackers to cause a Denial of Service DoS via unspecified vectors...

kernel: md-raid10: fix KASAN warning

In the Linux kernel, the following vulnerability has been resolved: md-raid10: fix KASAN warning There's a KASAN warning in raid10removedisk when running the lvm test lvconvert-raid-reshape.sh. We fix this warning by verifying that the value "number" is valid. BUG: KASAN: slab-out-of-bounds in...

kernel: md/raid0, raid10: Don't set discard sectors for request queue

In the Linux kernel, the following vulnerability has been resolved: md/raid0, raid10: Don't set discard sectors for request queue It should use diskstacklimits to get a proper maxdiscardsectors rather than setting a value by stack drivers. And there is a bug. If all member disks are rotational...

PT-2023-21085 · Tongda Oa · Tongda Oa

Name of the Vulnerable Software and Affected Versions: Tongda OA version 11.10 Description: A critical vulnerability has been found in Tongda OA, affecting the actionGetdata function of the GatewayController.php file. This vulnerability leads to unrestricted upload and can be initiated remotely...

AZL-26736 CVE-2023-2700 affecting package libvirt for versions less than 7.10.0-5

A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's gautoptr cleanup...

CVE-2023-28522

IBM API Connect V10 could allow an authenticated user to perform actions that they should not have access to. IBM X-Force ID: 250585...

IBM API Connect 安全漏洞

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from International Business Machines IBM. The product supports creating, running, managing, and securing APIs, microservices, and more. A security vulnerability exists in IBM API Connect version V10 that...

Teltonika Remote Management System 授权问题漏洞

Teltonika Remote Management System is a Teltonika remote management system for managing Teltonika products. An authorization issue vulnerability exists in Teltonika Remote Management System versions prior to 4.10.0. An attacker could use this vulnerability to execute arbitrary commands as root by...

CVE-2023-27382

Incorrect default permissions in the Audio Service for some IntelR NUC P14E Laptop Element software for Windows 10 before version 1.0.0.156 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2022-41687

Insecure inherited permissions in the HotKey Services for some IntelR NUC P14E Laptop Element software for Windows 10 before version 1.1.44 may allow an authenticated user to potentially enable escalation of privilege via local access...

PoDoFo 资源管理错误漏洞

PoDoFo is a free portable C++ library open-sourced by PoDoFo. A resource management error vulnerability exists in PoDoFo version 0.10.0, which stems from the function PoDoFo::PdfEncrypt::IsMetadataEncrypted containing heap reuse after release. A remote attacker can exploit this vulnerability to...

Pimcore 跨站脚本漏洞

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. A cross-site scripting vulnerability exists in...

kernel: md/raid0, raid10: Don't set discard sectors for request queue

In the Linux kernel, the following vulnerability has been resolved: md/raid0, raid10: Don't set discard sectors for request queue It should use diskstacklimits to get a proper maxdiscardsectors rather than setting a value by stack drivers. And there is a bug. If all member disks are rotational...

PT-2023-2696 · Microsoft · Remote Desktop Client +2

Name of the Vulnerable Software and Affected Versions: Windows 10 version 22H2 Description: The issue exists due to insufficient input validation in the Remote Desktop Client of the Windows operating system. This allows an attacker to execute arbitrary code, potentially impacting the system. The...