CVE-2023-4792

The Duplicate Post Page Menu & Custom Post Type plugin for WordPress is vulnerable to unauthorized page and post duplication due to a missing capability check on the duplicateppmcpostasdraft function in versions up to, and including, 2.3.1. This makes it possible for authenticated attackers with...

WordPress plugin Duplicate Post Page Menu & Custom Post Type security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

IBM AIX 安全漏洞

IBM AIX is an open standards-based UNIX operating system developed for the IBM Power architecture by International Business Machines IBM. A security vulnerability exists in IBM AIX that stems from an unauthorized file access issue in OpenSSH that allows unprivileged local users to access files...

CVE-2022-26838

Path traversal vulnerability in Importing Mobile Device Data of Cybozu Remote Service 3.1.2 allows a remote authenticated attacker to cause a denial-of-service DoS condition...

PT-2023-27142 · Mingsoft · Mingsoft Mcms

Name of the Vulnerable Software and Affected Versions: Mingsoft MCMS versions up to 5.3.1 Description: A problematic vulnerability has been found in Mingsoft MCMS, affecting an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style...

CVE-2022-31200

creationtimestamp| type| source ---|---|--- 2023-07-27 22:28:45+00:00| seen| https://t.me/cibsecurity/67342...

Vulnerability fixed in Atlassian Bamboo

Atlassian has fixed a vulnerability in Bamboo Server and Bamboo Data Center. An authenticated malicious person can exploit the exploit the vulnerability to use command-injection to execute arbitrary execute arbitrary code with application privileges and thus potentially gain access to sensitive...

CVE-2022-31457

creationtimestamp| type| source ---|---|--- 2023-07-26 02:27:10+00:00| seen| https://t.me/cibsecurity/67277...

SuiteCRM 跨站请求伪造漏洞

SuiteCRM is an open source enterprise-level customer relationship management CRM software application. A cross-site request forgery vulnerability exists in SuiteCRM versions prior to 8.3.1, which can be exploited by an attacker to spoof a user's identity and send malicious requests...

Important: kernel-livepatch-4.14.311-233.529

Issue Overview: An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores an XFS image after failure with a dirty log journal. This flaw allows a local user to crash or potentially escalate their privileges on the system. CVE-2023-2124...

PT-2023-21949 · WordPress · Formidable Forms

Name of the Vulnerable Software and Affected Versions: Formidable Forms WordPress plugin versions prior to 6.3.1 Description: The issue allows a user with a low role, such as Subscriber, to install and activate arbitrary plugins of any version from the WordPress.org plugin repository, leading to...

INEX IXP-Manager 跨站脚本漏洞

INEX IXP-Manager is an INEX open source web application. A security vulnerability exists in INEX IXP-Manager versions prior to 6.3.1. An attacker exploited the vulnerability to perform cross-site scripting attacks...

CVE-2023-23953

Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to an Elevation of Privilege vulnerability...

KaiOS 安全漏洞

KaiOS is an application software. application for smart feature phones. A security vulnerability exists in KaiOS versions 3.0 and 3.1, which originates from binary public server information and can be exploited by an attacker to read specific information...

Tornado 输入验证错误漏洞

Tornado is a Python web framework and asynchronous networking library from the Chinese Tornado Technology Tornado community. The library scales to thousands of open connections through the use of non-blocking network I/O, making it well suited for long-time polling, WebSockets, and other...

PT-2023-9854

Name of the Vulnerable Software and Affected Versions Tornado versions 6.3.1 and earlier Description The issue allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having the user access a specially crafted URL. This is related to t...

GHSA-83FM-W79M-64R5 Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.3.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...

CVE-2022-31643

creationtimestamp| type| source ---|---|--- 2023-04-28 20:27:35+00:00| seen| https://t.me/cibsecurity/63084...

GHSA-X422-6QHV-P29G Relative path traversal in mlflow

Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1...

PT-2023-21732 · Pretalx · Pretalx

Name of the Vulnerable Software and Affected Versions: pretalx versions 2.3.1 through 2.3.1 Description: The issue allows path traversal in HTML export, a non-default feature. Users can upload crafted HTML documents that trigger the reading of arbitrary files. Recommendations: For pretalx version...