PT-2023-7927 · Hitachi Vantara · Hitachi Vantara Hnas

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara HNAS versions prior to 14.8.7825.01 Description: The issue allows authenticated users to access sensitive information through Insecure Direct Object Reference IDOR. This can be achieved by manipulating URLs, enabling users in...

PT-2023-26030 · Softing · Softing Opc Suite

Name of the Vulnerable Software and Affected Versions: Softing OPC Suite versions 5.25 and before Description: The issue is related to Incorrect Access Control, allowing attackers to obtain sensitive information via weak permissions in the OSF discovery service. This could enable changes to the...

The vulnerability of the TFTP protocol implementation in ASUS RT-AC87U router microsoftware allows a hacker to gain access to read, modify, or delete files.

The vulnerability of the TFTP protocol implementation in ASUS RT-AC87U router microsoftware is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain read, modify, or delete file access rights remotely...

The vulnerability of the command-line interface (CLI) of microprogramming software for network devices such as ZyXEL VPN, USG FLEX, and ATP allows a intruder to gain unauthorized access to protected information.

The vulnerability of the command-line interface CLI of microprogrammed network devices such as ZyXEL VPN, USG FLEX, and ATP is related to deficiencies in access control. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to weakened security in Python Cryptographic Authority [CVE-2023-38325]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to weakened security in Python Cryptographic Authority, caused by an encoding mismatch regarding critical options with OpenSSH CVE-2023-38325. Python Cryptographic Authority is used for cryptography in our our...

The vulnerability of the printing control software in PaperCut MF and PaperCut NG, related to deficiencies in authentication procedures, allows attackers to escalate their privileges.

The vulnerability of the printing control software in PaperCut MF and PaperCut NG is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the Symfony software platform for developing and managing web applications allows attackers to exploit it to disclose sensitive information, perform phishing attacks, and carry out diskloading attacks.

The vulnerability of the Symfony software platform for developing and managing web applications exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to disclose sensitive information, perform phishing attacks, and...

Fedora 38 : golang-github-nats-io / golang-github-nats-io-jwt-2 / etc (2023-66966ae3d0)

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-66966ae3d0 advisory. Updated NATS stack for CVE-2023-39325 and CVE-2023-46129 Tenable has extracted the preceding description block directly from the Fedora security...

PT-2023-7876 · WordPress · Mw Wp Form

Name of the Vulnerable Software and Affected Versions: MW WP Form plugin for WordPress versions up to, and including, 5.0.1 Description: The issue is related to insufficient file type validation in the single file upload function, allowing unauthenticated attackers to upload arbitrary files on th...

The vulnerability of the sub_4CCE4 function in ASUS RT-AX57 Wi-Fi router’s microprogramming system allows a hacker to execute arbitrary code.

The vulnerability of the sub4CCE4 function in ASUS’ Wi-Fi router software ASUS RT-AX57 exists due to insufficient verification of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by using a specially crafted request to the ifname field...

agsasesoria.com Improper Access Control vulnerability OBB-3791621

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

IBM CICS TX Advanced 安全漏洞

IBM CICS TX is a comprehensive, single transaction runtime package from International Business Machines IBM. A weak algorithmic vulnerability exists in IBM CICS TX Advanced version 10.1, which stems from the use of a weak encryption algorithm that can be exploited by an attacker to decrypt highly...

VulnCheck KEV: CVE-2010-0219

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service...

The vulnerability of the XML Sitemap Generator plugin for the WordPress content management system allows attackers to execute XSS attacks.

The vulnerability of the XML Sitemap Generator plugin for the WordPress content management system exists due to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...

The vulnerability of the software for managing devices in the Zoho ManageEngine Device Control Plus system, related to insufficient access control, allows a perpetrator to circumvent restrictions on USB drives usage.

The vulnerability of the software for managing devices in the Zoho ManageEngine Device Control Plus network is related to deficiencies in access control. Exploiting this vulnerability could allow a hacker to circumvent restrictions on the use of USB drives...

WordPress Plugin YOP Poll Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2023-32444 · Byzoro · Byzoro Smart S85F Management Platform

Name of the Vulnerable Software and Affected Versions: Byzoro Smart S85F Management Platform version V31R02B10-01 Description: A problematic issue was found in the Byzoro Smart S85F Management Platform, affecting an unknown function of the file /login.php. The manipulation of the txt newpwd...

The vulnerability of the Zoho ManageEngine ServiceDesk Plus system, which exists due to the lack of measures taken to protect the website structure, allows attackers to carry out XSS attacks.

The vulnerability of the Zoho ManageEngine ServiceDesk Plus system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerabilities of the `pmdm_wp_change_user_meta` and `pmdm_wp_change_post_meta` functions in the Post Meta Data Manager plugin for the WordPress content management system allow a hacker to increase their privileges.

The vulnerability of the pmdmwpchangeusermeta and pmdmwpchangepostmeta functions in the Post Meta Data Manager plugin for the WordPress content management system is related to an incorrect authentication process. Exploiting this vulnerability can allow a malicious actor to gain increased privileg...

CVE-2023-43018

IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. IBM X-Force ID: 266163...