The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.

...

PT-2023-3748 · Sap · Sap Netweaver

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Change and Transport System versions 702 through 757 Description: The issue is related to a lack of resource control mechanism in the Change and Transport System component of SAP NetWeaver. This allows an authenticated user with...

Chamilo LMS 代码问题漏洞

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, distance training, and online question and answer sessions. A security vulnerability exists in Chamilo LMS versions 1.11.0 through 1.11.1...

org.apache.nifi:nifi-dbcp-service-nar (>=1.16.0 <=1.21.0), org.apache.nifi:nifi-snowflake-services-nar (>=1.16.0 <=1.18.0) potentially affected by CVE-2023-34468 via org.apache.nifi:nifi-hikari-dbcp-service (>=1.16.0 <=1.21.0)

org.apache.nifi:nifi-hikari-dbcp-service MAVEN version =1.16.0, =1.16.0, =1.16.0, =1.18.0 Source cves: CVE-2023-34468 Source advisory: OSV:GHSA-XM2M-2Q6H-22JW...

datapoints (>=0.0.1 <=0.0.2), hvl-ccb (>=0.12.0 <=0.12.3) potentially affected by CVE-2023-26151 via asyncua (>=0.9.94 <=0.9.95)

asyncua PYPI version =0.9.94, =0.0.1, =0.12.0, =0.12.3 Source cves: CVE-2023-26151 Source advisory: SNYK:PYTHON-ASYNCUA-5673709...

PT-2023-18358 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.7 through 15.10.7 GitLab CE/EE versions 15.11 through 15.11.6 GitLab CE/EE versions 16.0 through 16.0.1 Description: A Regular Expression Denial of Service issue was discovered, allowing attackers to send crafted...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab CE/EE, which stems from a regular...

PT-2023-23159 · Samsung · Samsung Exynos Modem

Name of the Vulnerable Software and Affected Versions: Samsung Exynos Modem versions 5123 through 5300 Description: An issue was discovered in the Shannon RCS component. Incorrect resource transfer between spheres can cause changes to the activation mode of RCS via a crafted application...

CVE-2023-33651

An issue in the MVC Device Simulator of Sitecore Experience Platform XP, Experience Manager XM, and Experience Commerce XC v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules...

@alioth_91/alita (>=3.3.9-patch.1 <=3.3.9-patch.2), @alitajs/vue-i18n (>=0.0.7 <=0.0.8) +98 more potentially affected by CVE-2023-34092 via vite (>=4.3.0 <=4.3.8)

vite NPM version =4.3.0, =3.3.9-patch.1, =0.0.7, =0.0.7, =0.0.7, =0.0.7, =0.0.7, =0.0.1, =0.0.1, =16.0.0, =2.0.0, =12.0.0, =0.0.0-canary-20230426131112, =0.0.1, =0.0.12 - @deconz-community/directus-extension-ddf-store =0.1.0 and more Source cves: CVE-2023-34092 Source advisory:...

@4399ywkf/bundler-vite (>=4.0.61 <=4.0.84), @4399ywkf/js (>=4.0.61 <=4.0.84) +46 more potentially affected by CVE-2023-34092 via vite (>=4.1.0 <=4.1.4)

vite NPM version =4.1.0, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.0-canary-20230215113341, =4.6.2, =11.6.5, =5.3.8, =5.0.0, =5.0.1 and more Source cves: CVE-2023-34092 Source advisory: OSV:GHSA-353F-5XF4-QW67...

PT-2023-2999 · Unknown · Nexus Series +2

Name of the Vulnerable Software and Affected Versions: ASPECT-Enterprise versions 3.0;0 through 3.07.01 NEXUS Series versions 3.0;0 through 3.07.01 MATRIX Series versions 3.0;0 through 3.07.01 Description: The issue is related to improper privilege management, which can allow an attacker to...

ReadyMedia 缓冲区错误漏洞

ReadyMedia formerly known as MiniDLNA is a suite of media service software compatible with LNA/UPnP-AV clients. The software supports music, picture, video and other media files. A security vulnerability exists in ReadyMedia versions 1.1.15 through 1.3.2, which stems from the presence of a buffer...

Wireshark 缓冲区错误漏洞

Wireshark formerly Ethereal is a suite of network packet analysis software from the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. A security vulnerability exists in Wireshark that stems from an IEEE C37.118 Synchronized Phase...

CVE-2023-2545

The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOfUsers' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2023-2549

The Feather Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions starting from 1.0.7 up to, and including, 1.1.1. This is due to missing nonce validation in the 'createTempAccountLink' function. This makes it possible for unauthenticated attackers to create a ne...

PT-2023-24358 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R versions V9.1.0u.6118 B20201102 through V9.1.0u.6369 B20230113 Description: The issue is a post-authentication buffer overflow that occurs via the sPort/ePort parameter in the addEffect function. Recommendations: For TOTOLINK...

CVE-2022-36244

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripting XSS vulnerabilities via Shop Beat Control Panel found at www.shopbeat.co.za controlpanel.shopbeat.co.za...

CVE-2022-36249

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API...

PT-2023-24198 · Xibo · Xibo

Name of the Vulnerable Software and Affected Versions: Xibo versions 3.0.0 through 3.3.4 Description: Xibo is a content management system CMS that has an issue where some API routes print a stack trace when called with missing or invalid parameters, revealing sensitive information about the...