PT-2023-32828 · WordPress +1 · Backup Migration +1

Name of the Vulnerable Software and Affected Versions: Backup Migration plugin for WordPress versions 1.0.8 through 1.3.9 Description: The issue allows unauthenticated attackers to include remote files on the server, resulting in code execution, via the content-dir HTTP header. Successful...

CVE-2023-47093

An issue was discovered in Stormshield Network Security SNS 4.0.0 through 4.3.21, 4.4.0 through 4.6.8, and 4.7.0. Sending a crafted ICMP packet may lead to a crash of the ASQ engine...

PT-2023-30705 · Smartertools · Smartermail

Name of the Vulnerable Software and Affected Versions: SmarterTools SmarterMail versions 8495 through 8664 Description: The issue allows stored XSS via a crafted description of a Calendar appointment. Recommendations: For versions 8495 through 8664, update to version 8747 or later to resolve the...

SmarterTools SmarterMail Security Breach

SmarterTools SmarterMail is a set of mail server software from SmarterTools. The software supports spam filtering, statistics, Simple Mail Transfer Protocol SMTP authentication, and other features. A security vulnerability exists in SmarterTools SmarterMail versions 8495 through 8664, which stems...

CVE-2023-49148

Cross-Site Request Forgery CSRF vulnerability in Kulwant Nagi Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates.This issue affects Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates: from n/a through 3.0.5...

CVE-2023-48050

SQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance aka odoo-biometric-attendance v. 13.0 through 16.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the db parameter in the controllers/controllers.py...

ZKTeco ZKBio Time Security Vulnerability

ZKTeco ZKBio Time is a powerful web-based time and attendance management software from China-based ZKTeco. Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance A security vulnerability exists in versions 13.0 through 16.0.1, which stems from an SQL injection...

CVE-2023-45184

IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority checks. IBM X-Force ID: 268270...

PT-2023-29889 · Ibm · Ibm Sterling Secure Proxy

Name of the Vulnerable Software and Affected Versions: IBM Sterling Secure Proxy versions 6.0.3 through 6.1.0 Description: This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trust...

PT-2023-8845 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions 10.0.0 through 10.0.10 Description: The issue is related to the saved search feature in GLPI, which can be used to perform a SQL injection. This allows a remote attacker to execute arbitrary code. The vulnerability is due to the...

Checkmk Security Vulnerabilities

Checkmk is an editor. A security vulnerability exists in Checkmk versions 2.2.0p10 through 2.2.0p16, which stems from the use of user-controlled LDLIBRARYPATH in an agent, allowing an attacker to escalate privileges by injecting a malicious library...

Dasan W-Web OS Command Injection Vulnerability

Dasan W-Web is a network appliance from Dasan. An operating system command injection vulnerability exists in Dasan W-Web versions 1.22-1.27, which stems from the presence of an operating system command injection vulnerability...

GNU Tar Security Vulnerability

GNU Tar is a set of tools for creating tar-formatted files from the US GNU community. A security vulnerability exists in GNU Tar versions 1.0 through 1.34, which stems from improper handling of extended attributes in the PAX archive, allowing remote attackers to execute arbitrary code on the targ...

Infinite decoding loop through specially crafted payload

The Candid library causes a Denial of Service while parsing a specially crafted payload with empty data type. For example, if the payload is record ; empty and the canister interface expects record then the rust candid decoder treats empty as an extra field required by the type. The problem with...

Candid Security Breach

Candid is an Interface Description Language IDL used to interact with containers running on Internet computers. A security vulnerability exists in Candid versions 0.9.0 through 0.9.10, which stems from a denial of service when the Candid library parses a specially crafted payload with a data type...

CloudPanel Security Vulnerabilities

CloudPanel is a free software from CloudPanel open source. It is used to configure and manage servers. A security vulnerability exists in MGT CloudPanel versions 2.0.0 through 2.3.2, which stems from a vulnerability that allows a low-privileged user to achieve operating system command injection b...

PT-2023-9063 · Oracle · Oracle E-Business Suite +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.13 Description: The issue is related to insufficient input validation in the Campaign LOV component of Oracle Marketing, allowing an unauthenticated attacker with network access via HTTP to...

PT-2023-25109 · WordPress · Password Reset With Code For Wordpress Rest Api

Name of the Vulnerable Software and Affected Versions: Password Reset with Code for WordPress REST API versions 0.0.0 through 0.0.15 Description: The issue is related to an Improper Restriction of Excessive Authentication Attempts vulnerability in the Password Reset with Code for WordPress REST...

CVE-2023-44295

Dell PowerScale OneFS versions 8.2.2.x through 9.6.0.x contains an improper control of a resource through its lifetime vulnerability. A low privilege attacker could potentially exploit this vulnerability, leading to loss of information, and information disclosure...

PT-2023-27878 · Samsung · Escargot

Name of the Vulnerable Software and Affected Versions: Escargot versions 3.0.0 through 4.0.0 Description: The issue is related to improper input validation in Samsung Open Source Escargot, which can lead to a stack overflow and segmentation fault. Recommendations: For Escargot versions 3.0.0...