CVE-2023-41966 Sielco Radio Link and Analog FM Transmitters Privilege Defined With Unsafe Actions

The application suffers from a privilege escalation vulnerability. A user with read permissions can elevate privileges by sending a HTTP POST to set a parameter...

The vulnerability of the GetParameterFormTemplateWithSelectionState function in the SolarWinds Access Rights Manager allows a violator to execute arbitrary code.

The vulnerability of the GetParameterFormTemplateWithSelectionState function in the SolarWinds Access Rights Manager software relates to the restoration of unreliable data in memory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...

PortlandLabs Concrete CMS 跨站脚本漏洞

PortlandLabs Concrete CMS is a team-oriented open source content management system of the United States PortlandLabs company . A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS v.9.2.1, which stems from the lack of effective filtering and escaping of user-supplied data by t...

Silicon Labs Gecko Bootloader Input Validation Error Vulnerability

Silicon Labs Gecko Bootloader is a bootloader from Silicon Labs, Inc. A security vulnerability exists in Silicon Labs Gecko Bootloader version 4.3.1 and prior versions that originated from allowing unrestricted memory access while reading or writing to a memory slot...

Artifact Hub allows unsafe rego built-in

Impact During a security audit of Artifact Hub's code base, a security researcher at OffSec identified a bug in which a default unsafe rego built-in was allowed to be used when defining authorization policies. Artifact Hub includes a fine-grained authorization mechanism that allows organizations ...

GHSA-9PC8-M4VP-GGVF Artifact Hub allows unsafe rego built-in

Impact During a security audit of Artifact Hub's code base, a security researcher at OffSec identified a bug in which a default unsafe rego built-in was allowed to be used when defining authorization policies. Artifact Hub includes a fine-grained authorization mechanism that allows organizations ...

RUSTSEC-2023-0078 Potential stack use-after-free in `Instrumented::into_inner`

The implementation of the Instrumented::intoinner method in affected versions of this crate contains undefined behavior due to incorrect use of std::mem::forget The function creates const pointers to self, calls mem::forgetselfstd::mem::forget, and then moves values out of those pointers using...

Apache InLong 代码问题漏洞

Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. Provides automated, secure and reliable data transfer capabilities. Apache InLong has a deserialization vulnerability that originates from unsafe deserialization processing of serialized data receive...

CVE-2023-35084

Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which could allow an attacker to execute commands remotely...

CVE-2023-35084

Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which could allow an attacker to execute commands remotely...

Deserialization of untrusted data

Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which could allow an attacker to execute commands remotely...

CVE-2023-35084

CVE-2023-35084 affects Ivanti Endpoint Manager (including 2022 SU3 and older versions). The issue is unsafe deserialization of user input, allowing an attacker to remotely execute commands or potentially read/exfiltrate data on the core server. Impact is described as high (remote code execution a...

PT-2023-25135 · Ivanti · Ivanti Endpoint Manager

Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager versions prior to 2022 su3 Description: The issue is related to unsafe deserialization of user input, which could lead to the execution of unauthorized operations. This could allow an attacker to execute commands...

The vulnerability of the prog.cgi component in D-Link DIR-X3260 Wi-Fi routers allows a hacker to execute arbitrary code.

The vulnerability of the prog.cgi component in D-Link DIR-X3260 Wi-Fi routers lies in the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2023-4820

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin...

CVE-2023-4821

The CVE-2023-4821 entry describes an unauthenticated stored Cross-Site Scripting vulnerability in the WordPress plugin Drag and Drop Multiple File Upload for WooCommerce (before 1.1.1). The flaw arises because the plugin does not filter all potentially dangerous file extensions (e.g., .shtml, .sv...

2023 OWASP Top-10 Series: Wrap Up

Over the past several months, we've taken a journey through the new 2023 OWASP API Security Top-10 list. In the previous 12 weekly posts, we've delved into each category, discussed what it is, how it's exploited, why it matters, and suggested effective protections for each. Now, as we conclude th...

PT-2023-36100 · Unknown · Simd-Json-Derive

Name of the Vulnerable Software and Affected Versions: simd-json-derive versions prior to 0.12.0 Description: The issue arises from an invalid use of MaybeUninit::uninit.assume init in the derive macro of simd-json-derive, leading to undefined behavior. This misuse can cause invalid memory access...

CVE-2023-5562

An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an executor for either KNIME Server or KNIME Business Hub several JavaScript-based view nodes do not sanitize the data that is displayed by...

CVE-2023-5562 Unsafe default allows for cross-site scripting attacks in KNIME Server and KNIME Business Hub

An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an executor for either KNIME Server or KNIME Business Hub several JavaScript-based view nodes do not sanitize the data that is displayed by...