CloudExplorer Lite 访问控制错误漏洞

CloudExplorer Lite is CloudExplorer's platform that provides out-of-the-box basic features such as cloud hosting management, cloud billing, operational analytics, and security compliance, as well as powerful extensibility to meet the customization needs of enterprises. An access control error...

PT-2023-23261 · Snap One · Ovrc Pro

Name of the Vulnerable Software and Affected Versions: Snap One OvrC Pro versions prior to 7.2 Description: The issue concerns a locally running web server in Snap One OvrC Pro that is accessible from both the local network and remotely. Additionally, there is a hidden superuser account in OvrC...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current curl Multiple Vulnerabilities (SSA:2023-137-01)

The version of curl installed on the remote host is prior to 8.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-137-01 advisory. - A use after free vulnerability exists in curl v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key...

CVE-2023-2752 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta...

Amazon Linux 2 : golang (ALAS-2023-2037)

The version of golang installed on the remote host is prior to 1.18.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2037 advisory. HTTP and MIME header parsing could allocate large amounts of memory, even when parsing small inputs. Certain unusual patterns of...

PT-2023-21350 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: mlflow versions prior to 2.3.1 Description: The issue is related to path traversal, where the sequence '..filename' can be used to bypass security restrictions. This allows unauthorized access to files and directories outside the intended...

CVE-2022-41979

Protection mechanism failure in the IntelR DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via network access...

Intel VROC software 资源管理错误漏洞

Intel VROC software is an application from Intel Corporation USA. A security vulnerability exists in Intel VROC software prior to version 7.7.6.1003, which stems from the presence of post-release reuse and could allow an authenticated user to potentially enable privilege escalation via local acce...

Amazon Linux AMI : openldap (ALAS-2023-1741)

The version of openldap installed on the remote host is prior to 2.4.40-16.36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1741 advisory. An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and...

Ping Identity Windows PingId 注入漏洞

Ping Identity Windows PingId is a software from Ping Identity USA that provides security for applications. A security vulnerability exists in Ping Identity Windows PingId versions prior to 2.9 that stems from a username conflict issue that is triggered when two people with the same username are...

AZL-28505 CVE-2023-31084 affecting package hyperv-daemons for versions less than 5.15.158.2-1

An issue was discovered in drivers/media/dvb-core/dvbfrontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASKRUNNING. In dvbfrontendgetevent, waiteventinterruptible is called; the condition is dvbfrontendtesteventfepriv,events. In dvbfrontendtestevent,...

Backdrop CMS 跨站脚本漏洞

Backdrop CMS is an open source content management system CMS. A security vulnerability exists in Backdrop CMS versions prior to 1.24.2. An attacker can exploit this vulnerability to inject arbitrary web script or html code via the name parameter...

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

...

Nextcloud 信息泄露漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An information disclosure vulnerability exists in versions of Nextcloud prior to 15.0.5, which stems from a user who is later added to a conversation being...

LibreSSL 信任管理问题漏洞

LibreSSL is an open source implementation of a secure socket layer and transport layer security protocol. A security vulnerability exists in LibreSSL versions prior to 3.4.2, which stems from an error that sometimes drops unvalidated certificate chains, and an authentication bypass...

CVE-2022-43771

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds...

PT-2023-15232 · Generex · Generex Ups Cs141

Name of the Vulnerable Software and Affected Versions: Generex UPS CS141 versions prior to 2.06 Description: The issue allows a remote attacker to upload a backup file containing a modified users.json to the web server of the device, enabling them to replace the administrator password...

Generex UPS Adapter CS141 安全漏洞

Generex UPS Adapter CS141 is a UPS Uninterruptible Power System adapter from Generex. A security vulnerability exists in Generex UPS Adapter CS141 versions prior to 2.06, which stems from a vulnerability that allows an attacker to upload a firmware file containing a misconfiguration...

haystack 安全漏洞

haystack is an open source NLP framework for interacting with your data using Transformer models and LLMs GPT-4, ChatGPT, etc.. A security vulnerability exists in haystack versions prior to 0.1.30 that stems from the use of hard-coded constants...

matrix-react-sdk 安全漏洞

Travis Ralston matrix-react-sdk is a Travis Ralston open source application. It is used to insert the Matrix chat/voice client into web pages. A security vulnerability exists in matrix-react-sdk versions prior to 3.53.0, which stems from an event sent using a special string in a critical location...