CVE-2022-46799 WordPress Easy Testimonial Slider and Form Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in I Thirteen Web Solution Easy Testimonial Slider and Form plugin = 1.0.15 versions...

Apple macOS Ventura 安全漏洞

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Ventura version 13.3. An attacker can view sensitive information by exploiting the vulnerability...

PT-2023-21458 · Apple · Studio Display Firmware +1

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.3 Studio Display Firmware versions prior to 16.4 Description: A memory corruption issue was addressed with improved state management, allowing an app to potentially execute arbitrary code with kernel privileges...

ADM GUI is down and users only have access via SSH

Users are unable to get any access to ADM GUI on 13.1...

PT-2023-22348

Name of the Vulnerable Software and Affected Versions ZHENFENG13 My-Blog affected versions not specified Description A cross site scripting XSS issue allows attackers to inject arbitrary web script or HTML via editing an article in the "blog article" page due to the default configuration not...

SUSE CVE-2023-31436

qfqchangeclass in net/sched/schqfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQMINLMAX...

UBUNTU-CVE-2023-31436

qfqchangeclass in net/sched/schqfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQMINLMAX...

Linux kernel 缓冲区错误漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel versions prior to 6.2.13, which stems from an out-of-bounds write problem...

CVE-2021-44465

Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notifications and comments related to arbitrary business records in the system, via crafted RPC requests...

CVE-2021-44460

Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the deactivated account and any permission it still holds, via crafted RPC requests...

UBUNTU-CVE-2021-44460

Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the deactivated account and any permission it still holds, via crafted RPC requests...

UBUNTU-CVE-2021-44465

Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notifications and comments related to arbitrary business records in the system, via crafted RPC requests...

Odoo 安全漏洞

Odoo is an Enterprise Resource Planning ERP and Customer Relationship Management CRM system from Odoo Belgium. The system is developed in Python language, with PostgreSQL as the database, and includes modules for sales management, inventory management, and financial management. A security...

PT-2023-12546 · Odoo · Odoo Enterprise

Name of the Vulnerable Software and Affected Versions: Odoo Enterprise versions 13.0 through 15.0 Description: The issue is a cross-site scripting XSS problem in the Accounting app, allowing remote attackers who can control the contents of accounting journal entries to inject arbitrary web script...

Odoo 跨站脚本漏洞

Odoo is an Enterprise Resource Planning ERP and Customer Relationship Management CRM system from Odoo Belgium. The system is developed in Python, with PostgreSQL as the database, and includes modules for sales management, inventory management, and financial management. A security vulnerability...

In inflate of inflate.c there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-242544249

...

In Shadow 4.13 it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g. adding a new user fails because \n is in the block list) it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words an adversary may be able to convince a system administrator to take the system offline (an indirect social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.

...

Piwigo SQL注入漏洞

Piwigo is a Web-based open source photo gallery software. The software includes features such as image management, image categorization and permission management. A security vulnerability exists in Piwigo version v.13.5.0 and earlier versions. An attacker can exploit this vulnerability to execute...

CVE-2023-21091

In canDisplayLocalUi of AppLocalePickerActivity.java, there is a possible way to change system app locales due to a missing permission check. This could lead to local denial of service across user boundaries with no additional execution privileges needed. User interaction is not needed for...

CVE-2023-21080

In registernotificationrsp of btifrc.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11...