The vulnerability of Google Chrome’s Autofill function allows attackers to bypass existing security restrictions.

The vulnerability of Google Chrome’s Autofill function is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions through a specially created HTML page...

CVE-2023-20223

A vulnerability in Cisco DNA Center could allow an unauthenticated, remote attacker to read and modify data in a repository that belongs to an internal service on an affected device. This vulnerability is due to insufficient access control enforcement on API requests. An attacker could exploit th...

Code injection

Dell Data Protection Central, version 19.9, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker could potentially exploit this vulnerability, allowing an attacker to recover plaintext from a block of ciphertext...

CVE-2023-42486

Fortect - CWE-428: Unquoted Search Path or Element, may be used by local user to elevate privileges...

Dell Data Protection Central 加密问题漏洞

Dell Data Protection Central is a suite of data protection solutions from Dell USA. The product provides single sign-on, dashboards, and system monitoring. A vulnerability exists in Dell Data Protection Central version 19.9 due to an encryption issue that stems from insufficient encryption...

PT-2023-28370 · Unknown · Soundminer

Name of the Vulnerable Software and Affected Versions: Soundminer affected versions not specified Description: The issue is related to improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This is a type of security weakness that can allow an attacker to...

CVE-2023-43637 Vault Key Partially Predetermined

Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be "arfoobarfoobarfo". This issue happens because "deriveVaultKey" calls "retrieveCloudKey" which will always return "foobarfoobarfoobarfoobarfoobarfo...

PT-2023-28893

Name of the Vulnerable Software and Affected Versions SoftwareX versions prior to 7.10 Description The issue arises from the implementation of deriveVaultKey, which generates a vault key with the last 16 bytes predetermined to be "arfoobarfoobarfo". This occurs because deriveVaultKey calls...

Weak Password Vulnerability in Marcum Database Auditing System of Shenzhen Marcum Technology Co.

Marcum Database Security Audit System mainly realizes visualized monitoring, analysis and summarization of users' access to database operation behaviors, providing users with electronic evidence for tracing back the root cause of accidents, and at the same time, providing efficient querying of...

The vulnerability of the software for exchanging information and events between components of the IBM Security Verify Information Queue authentication and authorization system, related to deficiencies in the error reporting mechanism, allows a perpetrator to gain access to confidential information.

The vulnerability of the information and event exchange software between the components of the IBM Security Verify Information Queue authentication and authorization system is related to deficiencies in the error reporting mechanism. Exploiting this vulnerability could allow a malicious actor,...

Design/Logic Flaw

UNSUPPPORTED WHEN ASSIGNED Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the we...

CVE-2023-41965

Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process...

CVE-2023-39446 Socomec MOD3GP-SY-120K Cross-Site Request Forgery

Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application...

The vulnerability of the ProjectInstance class in the Microsoft Exchange Server mail server allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the ProjectInstance class in Microsoft Exchange Server involves deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

N-Able's Take Control Agent Vulnerability Exposes Windows Systems to Privilege Escalation

A high-severity security flaw has been disclosed in N-Able's Take Control Agent that could be exploited by a local unprivileged attacker to gain SYSTEM privileges. Tracked as CVE-2023-27470 CVSS score: 8.8, the issue relates to a Time-of-Check to Time-of-Use TOCTOU race condition vulnerability,...

Siemens RUGGEDCOM ROX Inadequate Encryption Strength (CVE-2023-36748)

A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.16.0, RUGGEDCOM ROX MX5000RE All versions V2.16.0, RUGGEDCOM ROX RX1400 All versions V2.16.0, RUGGEDCOM ROX RX1500 All versions V2.16.0, RUGGEDCOM ROX RX1501 All versions V2.16.0, RUGGEDCOM ROX RX1510 All versions V2.16.0...

The vulnerability of the Crucible code-checking tool and the Fisheye code-searching tool lies in the insufficient protection of operational data, allowing unauthorized access by attackers to protected information.

The vulnerability of the Crucible code-checking tool and the Fisheye code-searching tool is related to insufficient protection for service data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the CMPappBP component in CODESYS software products allows a hacker to trigger a service failure.

The vulnerability of the CMPappBP component in CODESYS software products is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

PT-2023-5032 · Microsoft · Windows Kernel +1

Name of the Vulnerable Software and Affected Versions: Windows Kernel affected versions not specified Description: The issue is related to an elevation-of-privilege vulnerability in the Windows Kernel, which is associated with insufficient access control. This vulnerability can be exploited to...

PT-2023-5053 · Microsoft · Exchange Server

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The issue is related to weaknesses in the authentication procedure of the Microsoft Exchange Server, allowing a remote attacker to conduct spoofing attacks. This can...