Exploit for Uncontrolled Resource Consumption in Cbm Control_De_Ciber

CVE-2022-48474 & CVE-2022-48475 PoC & exploits for CVE-2022-48...

DEBIAN-CVE-2023-21939

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Swing. Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Easily exploitable...

PT-2023-2481 · Oracle · Oracle Weblogic Server

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 12.2.1.3.0 through 12.2.1.4.0 Oracle WebLogic Server version 14.1.1.0.0 Description: The issue allows an unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful...

ManageEngine ADSelfService Plus < build 6218 DoS

According to its self-reported version, the ManageEngine ADSelfService Plus application running on the remote host is prior to build 6218. It is, therefore, affected by a denial of service DoS vulnerability which allows any unauthenticated remote user to cause an application restart by sending a...

CVE-2023-28489

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05, CP-8050 MASTER MODULE All versions CPCI85 V05. Affected devices are vulnerable to command injection via the web server port 443/tcp, if the parameter “Remote Operation” is enabled. The parameter is disabled by...

PT-2023-2156 · Cisco · Cisco Small Business Rv082 +5

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers affected versions not specified Description: The issue exists due to insufficient input validation by the web-based management interface, allowing an unauthenticated,...

CVE-2023-0325

Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the message sent by the clients in the ticket...

CVE-2022-43939

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented. Recent assessments: gwillcox-r7 at May 10, 2023 5:02pm UTC reported: This is an authentication bypass in Hitachi...

CVE-2022-45460

Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow an unauthenticated and remote user to exploit a stack-based buffer overflow and crash the web server, resulting in a system reboot. An unauthenticat...

CVE-2023-22300

An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unauthorized actions by viewing the logs. This action would also grant the attacker privilege escalation...

CVE-2023-22300

CVE-2023-22300 affects SAUTER EY-modulo 5 Building Automation Stations (EY-AS525F001 with moduWeb). The ICS advisory describes an unauthenticated remote attacker who can force all authenticated users (including admins) to perform unauthorized actions by viewing logs, enabling privilege escalation...

Input validation

The validate JSON endpoint of the Secvisogram csaf-validator-service in versions 0.1.0 processes tests with unexpected names. This insufficient input validation of requests by an unauthenticated remote user might lead to a partial DoS of the service. Only the request of the attacker is affected b...

CVE-2023-25909 HGiga Inc. OAKlouds - Arbitrary File Upload

HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary command or disrupt service...

CVE-2023-24842 HGiga MailSherlock - Broken Access Control

HGiga MailSherlock has vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to access partial content of another user’s mail by changing user ID and mail ID within URL...

Exploit for OS Command Injection in Netgate Pfblockerng

pfBlockerNG T...

CVE-2023-20107

A vulnerability in the deterministic random bit generator DRBG, also known as pseudorandom number generator PRNG, in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software for Cisco ASA 5506-X, ASA 5508-X, and ASA 5516-X Firewalls could allow an...

CVE-2023-20107

A vulnerability in the deterministic random bit generator DRBG, also known as pseudorandom number generator PRNG, in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software for Cisco ASA 5506-X, ASA 5508-X, and ASA 5516-X Firewalls could allow an...

Design/Logic Flaw

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to create arbitrary users on the platform. A successful exploit allows an attacker to achieve total cluster compromise...

CVE-2023-27855

In affected versions, a path traversal exists when processing a message in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker could potentially exploit this vulnerability to upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed...

CVE-2023-27856

In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed...