PT-2023-24835 · Peplink · Peplink Surf Soho

Name of the Vulnerable Software and Affected Versions: peplink Surf SOHO HW1 version 6.3.5 Description: A stored cross-site scripting XSS issue exists in the upload brand.cgi functionality. This allows an attacker to execute arbitrary javascript in another user's browser by making a specially...

Peplink Surf SOHO HW1 Operating System Command Injection Vulnerability

Peplink Surf SOHO HW1 is a small router from Peplink. An operating system command injection vulnerability exists in Peplink Surf SOHO HW1 v6.3.5, which stems from an operating system command injection vulnerability in the admin.cgi MVPNtrialinit function. An attacker can exploit this vulnerabilit...

Peplink Surf SOHO HW1 Operating System Command Injection Vulnerability

The Peplink Surf SOHO HW1 is a small router from Peplink. An OS command injection vulnerability exists in Peplink Surf SOHO HW1 v6.3.5, which stems from an OS command injection vulnerability in the data.cgi xferdns function. An attacker can exploit this vulnerability to execute commands via...

QDocs Smart School SQL Injection Vulnerability

QDocs Smart School is a Smart School application from QDocs, Inc. QDocs Smart School version 6.4.1 has a SQL injection vulnerability that originates from the parameter searchdata0title/searchdata0searchfield/searchdata0 searchvalue can cause sql injection...

Snipe-IT Cross-Site Scripting Vulnerability

Snipe-IT is an open source IT asset/license management system. A cross-site scripting vulnerability exists in Snipe-IT versions prior to v6.2.2 that stems from the presence of a stored cross-site scripting XSS vulnerability...

CVE-2023-38381

Cross-Site Request Forgery CSRF vulnerability in Cyle Conoly WP-FlyBox plugin = 6.46 versions...

eeroOS Security Vulnerabilities

eeroOS is eero's operating system for managing and optimizing wireless networks. A security vulnerability exists in eeroOS version 6.16.4-11 and prior versions. An attacker has exploited the vulnerability to cause a denial of service on the system...

DedeBIZ SQL Injection Vulnerability

DedeBIZ is a content management system from China Muyun Intelligent Technology DedeBIZ company. A SQL injection vulnerability exists in DedeBIZ version 6.2, which stems from the fact that incorrect manipulation of the parameter ids can lead to sql injection...

DedeBIZ SQL Injection Vulnerability

DedeBIZ is a content management system from China Muyun Intelligent Technology DedeBIZ company. A SQL injection vulnerability exists in DedeBIZ version 6.2, which stems from the fact that incorrect manipulation of the mktime parameter can lead to sql injection...

CVE-2023-20187

A vulnerability in the Multicast Leaf Recycle Elimination mLRE feature of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause the affected device to reload, resulting in a denial of service DoS condition. This...

CVE-2023-43234

DedeBIZ v6.2.11 was discovered to contain multiple remote code execution RCE vulnerabilities at /admin/filemanagecontrol.php via the $activepath and $filename parameters...

PT-2023-27066 · Prestashop · Simpleimportproduct Prestashop Module

Name of the Vulnerable Software and Affected Versions: SimpleImportProduct Prestashop Module version 6.2.9 Description: The issue is a SQL injection vulnerability. It can be exploited via the key parameter at the "send.php" endpoint. Recommendations: For SimpleImportProduct Prestashop Module...

CVE-2023-30729

Improper Certificate Validation in Samsung Email prior to version 6.1.82.0 allows remote attacker to intercept the network traffic including sensitive information...

PT-2023-4827 · Freebsd · Freebsd

Name of the Vulnerable Software and Affected Versions: FreeBSD affected versions not specified Description: The issue is related to errors in the packet filter component of FreeBSD, specifically with the 'scrub fragment reassemble' rule. This can allow a remote attacker to bypass existing firewal...

CVE-2023-4587

An IDOR vulnerability has been found in ZKTeco ZEM800 product affecting version 6.60. This vulnerability allows a local attacker to obtain registered user backup files or device configuration files over a local network or through a VPN server...

OESA-2023-1588 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connectio...

OESA-2023-1587 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connectio...

CVE-2023-28801

An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin UI: from 6.2 before 6.2r...

Malicious code in mc-dxp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5e1d1ce854f3d738b8c31b31ebec021661db3328cba71ffcbb8a8f9f2377b97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-0654

Due to a misconfiguration, the WARP Mobile Client 6.29 for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim's device, the attacker would be able to trick the user into believing that the app shown on...