Github fish security breach

Github fish is a smart and user-friendly command line shell. A security vulnerability exists in Github fish versions prior to 3.6.2 that stems from allowing certain Unicode non-characters to be used internally to mark wildcards and extensions...

CVE-2023-39256

Dell Rugged Control Center, version prior to 4.7, contains an improper access control vulnerability. A local malicious standard user could potentially exploit this vulnerability to modify the content in an unsecured folder during product installation and upgrade, leading to privilege escalation o...

Improper access control

Dell Rugged Control Center, version prior to 4.7, contains an improper access control vulnerability. A local malicious standard user could potentially exploit this vulnerability to modify the content in an unsecured folder during product installation and upgrade, leading to privilege escalation o...

Dreamer CMS Security Vulnerability

Dreamer CMS is a Dreamer Content Management System by Junnan Wang, an individual developer in China. A security vulnerability exists in Dreamer CMS versions prior to 4.0.1, which stems from a directory traversal vulnerability. An attacker can exploit this vulnerability to modify template files or...

AZL-33492 CVE-2023-42366 affecting package busybox for versions less than 1.35.0-12

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the nexttoken function at awk.c:1159...

Trellix Application and Change Control Path Traversal Vulnerability

Trellix Application and Change Control Trellix ACC is an application and change control program from FireEye USA Trellix. A path traversal vulnerability exists in Trellix Application and Change Control TACC versions prior to 8.4.0, which stems from a path traversal vulnerability in the TACC ePO...

m-privacy TightGate-Pro Server Security Vulnerability

The m-privacy TightGate-Pro Server is a remote control browser system from the German company m-privacy. A security vulnerability exists in m-privacy TightGate-Pro Server versions prior to 2.0.406g, which originates from an easily compromised access control on X11 server sockets, allowing an...

Devellion CubeCart Cross-Site Request Forgery Vulnerability

Devellion CubeCart is a free and open source e-commerce shopping cart software from the company of Devellion UK. The software supports selling products, adding/editing products or images in an online store, etc. A cross-site request forgery vulnerability exists in Devellion CubeCart versions prio...

PT-2023-30878

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.176 Description An issue was discovered in the app/Model/AppModel.php file, where it mishandles filters. Recommendations For versions prior to 2.4.176, update to version 2.4.176 or later to resolve the issue...

ManageEngine SupportCenter Plus < 14.2 Build 14200

The version of ManageEngine SupportCenter Plus installed on the remote host is prior to 14.2 Build 14200. It is, therefore, affected by a vulnerability as referenced in the support-centerCVE-2023-38331 advisory. - Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS i...

CVE-2023-47609

SQL injection vulnerability in OSS Calendar versions prior to v.2.0.3 allows a remote authenticated attacker to execute arbitrary code or obtain and/or alter the information stored in the database by sending a specially crafted request...

PT-2023-30483 · Unknown · Photo Feed

Name of the Vulnerable Software and Affected Versions: Photo Feed plugin versions prior to 2.2.1 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the website, potentially allowing them t...

Fortinet Fortigate DOS in headers management (FG-IR-23-151)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-151 advisory. - A numeric truncation error in Fortinet FortiProxy version 7.2.0 through 7.2.4, FortiProxy version 7.0.0 through 7.0.10,...

Kyverno security breach

Kyverno is a policy engine for Kubernetes open-sourced by Kyverno. A security vulnerability exists in versions prior to Kyverno v1.11.0. An attacker exploited the vulnerability to cause a denial of service on the system...

DOMPurify Security Vulnerability

DOMPurify is a DOM Document Object Model written in JavaScript for HTML, MathML and SVG. A security vulnerability exists in versions of DOMPurify prior to 1.0.11, which stems from a missing attribute for links...

AZL-31759 CVE-2023-38472 affecting package avahi for versions less than 0.8-3

A vulnerability was found in Avahi. A reachable assertion exists in the avahirdataparse function...

F5 Networks BIG-IP : Multi-blade VIPRION Configuration utility session cookie vulnerability (K29141800)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 16.1.4 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K29141800 advisory. - An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG- ...

CVE-2023-26583

Unauthenticated SQL injection in the GetCurrentPeriod method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers...

PT-2023-23093 · Unknown · Gotham Orbital-Simulator

Name of the Vulnerable Software and Affected Versions: Gotham Orbital-Simulator service versions prior to 0.692.0 Description: The issue allows an unauthenticated user to read arbitrary files on the file system due to a Path traversal problem. Recommendations: For versions prior to 0.692.0, updat...

CVE-2023-46298

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN...