CVE-2023-38245 Adobe Acrobat Reader DC ActiveX Control (AxAcroPDFLib.AxAcroPDF) src NTLMv2 SSO Hash Theft Vulnerability

Adobe Acrobat Reader versions 23.003.20244 and earlier and 20.005.30467 and earlier are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to obtain NTLMv2 credentials. Exploitation of this issue requires user interaction in that a...

EZ SoftMagic MP3 Audio Converter Security Vulnerability

EZ SoftMagic MP3 Audio Converter is an MP3 audio editor from EZ SoftMagic. A security vulnerability exists in EZ SoftMagic MP3 Audio Converter version 2.7.3.700, which originated from a vulnerability that could allow an attacker to execute arbitrary code or crash the application by overflowing th...

MISP 跨站脚本漏洞

MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. MISP version 2.4174 suffers from a cross-site scripting vulnerability that stems from the...

PT-2023-25940 · WordPress · Sudipto Pratap Mahato Simple Light Weight Social Share

Name of the Vulnerable Software and Affected Versions: Sudipto Pratap Mahato Simple Light Weight Social Share plugin versions = 2.0 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inject...

CVE-2023-38348

A CSRF issue was discovered in LWsystems Benno MailArchiv 2.10.1...

CVE-2023-38348

A CSRF issue was discovered in LWsystems Benno MailArchiv 2.10.1...

CVE-2023-4242

The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about...

CVE-2023-38679

A vulnerability has been identified in Tecnomatix Plant Simulation V2201 All versions V2201.0008, Tecnomatix Plant Simulation V2302 All versions V2302.0002. The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. Thi...

PT-2023-5266 · Libreswan +5 · Libreswan +5

Name of the Vulnerable Software and Affected Versions: Libreswan versions 3.20 through 4.12 Description: An issue was discovered in Libreswan when an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1. This causes an error notify INVALID SPI to be sent back, but th...

Foswiki Path Traversal Vulnerability

Foswiki is a Wiki software developed in the Perl language.Foswiki is a truly free and open-source Wiki and user-built application platform for public and corporate environments. A security vulnerability exists in Foswiki v2.1.7 and earlier versions, which stems from a problem in the...

wger Cross-Site Request Forgery Vulnerability

wger is a self-hosted FLOSS fitness/exercise, nutrition and weight tracker written in Django. A security vulnerability exists in wger Workout Manager version v.2.2.0a3, which stems from the presence of a cross-site request forgery CSRF vulnerability that allows remote attackers to gain privileges...

WordPress plugin Custom Field Template cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Cockpit Security Vulnerabilities

Cockpit is an interactive server management interface. A security vulnerability exists in cockpit version 2.6.3, which stems from the presence of a PHP remote file inclusion vulnerability...

Chengdu Flash Flood Disaster Monitoring and Warning System Security Vulnerabilities

Chengdu Flash Flood Disaster Monitoring and Warning System is a flash flood disaster monitoring and warning system in Chengdu. A security vulnerability exists in Chengdu Flash Flood Disaster Monitoring and Warning System version 2.0, which is caused by a path traversal due to an error in the...

PT-2023-28056 · Unknown · Chengdu Flash Flood Disaster Monitoring/Warning System

Name of the Vulnerable Software and Affected Versions: Chengdu Flash Flood Disaster Monitoring and Warning System version 2.0 Description: A problematic issue was found in the Chengdu Flash Flood Disaster Monitoring and Warning System. This issue affects the file ServiceFileDownload.ashx and is...

CVE-2023-33375

Connected IO v2.1.0 and prior has a stack-based buffer overflow vulnerability in its communication protocol, enabling attackers to take control over devices...

Connected IO Operating System Command Injection Vulnerability

Connected IO is a leading hardware, software and cloud-based IoT and machine-to-machine solution from US-based Connected IO, Inc. A security vulnerability previously existed in Connected IO version v2.1.0 that stemmed from having a command as part of its communication protocol that allowed the...

PT-2023-26475 · Unknown · Metersphere

Name of the Vulnerable Software and Affected Versions: MeterSphere versions prior to 2.10.4 LTS Description: MeterSphere is an open-source continuous testing platform. Some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attacker...

golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests

A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache...

Suprema BioStar 2 License Issue Vulnerability

Suprema BioStar 2 is a web-based biometric security smart lock platform from Suprema Korea. A security vulnerability exists in Suprema BioStar version 2.0 through versions prior to 2.9.1 that stems from the presence of an authentication bypass vulnerability. It is permissible to allow an...