PT-2023-32437 · WordPress · Smartcrawl

Name of the Vulnerable Software and Affected Versions: SmartCrawl WordPress plugin versions prior to 3.8.3 Description: The issue allows unauthorized users to access the content of password-protected posts. Recommendations: For versions prior to 3.8.3, update to version 3.8.3 or later to resolve...

CVE-2023-50870

In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible...

OESA-2023-1930 nodejs-tough-cookie security update

RFC6265 Cookies and Cookie Jar for Node.js. Security Fixes: Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects a...

LOCKSS Daemon Security Vulnerability

LOCKSS Daemon is a research-based open source software application from LOCKSS that provides powerful peer-to-peer digital preservation. A security vulnerability exists in LOCKSS Daemon versions prior to 1.77.3 that stems from allowing an attacker to bypass access restrictions...

AZL-67467 CVE-2023-50472 affecting package apparmor for versions less than 3.1.7-1

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSONSetValuestring at cJSON.c...

CVE-2023-48661

Dell vApp Manager, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability to read arbitrary files from the target system...

Mlflow Path Traversal Vulnerability

Mlflow is an open source platform for machine learning lifecycles. A path traversal vulnerability exists in Mlflow versions prior to 2.9.2, which stems from the ability to write arbitrary files while loading a dataset...

Weseek GROWI Security Vulnerability

Weseek GROWI is a team collaboration software from Weseek Japan. A security vulnerability exists in Weseek GROWI versions prior to v3.4.0. An attacker could exploit this vulnerability to conduct cross-site scripting attacks...

PT-2023-31277 · Zoom · Zoom

Name of the Vulnerable Software and Affected Versions: Zoom versions prior to 5.16.5 Description: The issue is related to improper authentication in some Zoom clients, which may allow an authenticated user to conduct a denial of service via network access. Recommendations: For versions prior to...

Health Level 7 Security Vulnerability

Health Level 7 is a series of global standards for transferring clinical and administrative health data between applications from Health Level 7, Inc. A security vulnerability exists in Health Level 7 versions prior to 5.6.106 that stems from a package decompression feature in the core library th...

NCP Secure Enterprise Client Security Vulnerability

NCP Secure Enterprise Client is a VPN Virtual Private Network client application from NCP Germany. A security vulnerability exists in NCP Secure Enterprise Client versions prior to 12.22 that originates from a vulnerability that allows an attacker to delete arbitrary files on the operating system...

CVE-2023-46496

Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the DELETE function in api/files endpoint...

AZL-32102 CVE-2023-39326 affecting package golang for versions less than 1.21.5-1

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data up to about...

CVE-2023-37572

Softing OPC Suite version 5.25 and before has Incorrect Access Control, allows attackers to obtain sensitive information via weak permissions in OSFdiscovery service. The service executable could be changed or the service could be deleted...

Branch-names Input Validation Error Vulnerability

branch-names is a tool for retrieving branch or tag names. An input validation error vulnerability exists in branch-names versions prior to 7.0.7, which stems from incorrectly referencing context variables and can be exploited by an attacker to execute arbitrary code...

PT-2023-28443 · Unknown · Searchwidget

Name of the Vulnerable Software and Affected Versions: Search Widget versions prior to 3.4 Description: The issue allows local attackers to access data through a PendingIntent hijacking vulnerability in the Search Widget, specifically in China models. Recommendations: For versions prior to 3.4,...

SUSE CVE-2023-6345

Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. Chromium security severity: High...

CVE-2023-47877

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Perfmatters allows Stored XSS.This issue affects Perfmatters: from n/a before 2.2.0...

CVE-2023-46886

Dreamer CMS before version 4.0.1 is vulnerable to Directory Traversal. Background template management allows arbitrary modification of the template file, allowing system sensitive files to be read...

Dreamer CMS Security Vulnerability

Dreamer CMS is a dreamer content management system developed by Junnan Wang, an individual developer in China. A security vulnerability exists in Dreamer CMS versions prior to 4.0.1, which stems from an arbitrary file download vulnerability in the attachment management office feature...