CVE-2023-25609

A server-side request forgery SSRF vulnerability CWE-918 in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests...

Server side request forgery (ssrf)

A server-side request forgery SSRF vulnerability CWE-918 in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests...

CVE-2023-25609

Fortinet FortiManager and FortiAnalyzer GUI are affected by a server-side request forgery (SSRF) vulnerability (CWE-918) that may allow a remote, authenticated attacker to access unauthorized files and services via specially crafted web requests. Affected versions include FortiManager/ FortiAnaly...

CVE-2023-25609

A server-side request forgery SSRF vulnerability CWE-918 in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests...

Web和ecto 访问控制错误漏洞

SAP Plant Connectivity is a bridge between devices and MES for exchanging data between standard data sources from SAP, Germany. An access control error vulnerability exists in SAP Plant Connectivity version 15.5 and SAP Digital Manufacturing version 1.0, which stems from not validating JWT...

PT-2023-3237 · Fortinet · Fortiproxy +2

Name of the Vulnerable Software and Affected Versions: FortiOS versions 6.0 through 7.2.4 FortiProxy versions 1.0 through 7.2.3 FortiWeb versions 6.3 through 7.2.1 Description: The issue is related to a loop with an unreachable exit condition, also known as an 'infinite loop', which can be...

PT-2023-3229 · Fortinet · Fortiproxy +1

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 6.4.0 through 6.4.12 Fortinet FortiOS versions 7.0.0 through 7.0.11 Fortinet FortiOS versions 7.2.0 through 7.2.4 Fortiproxy versions 7.0.0 through 7.0.10 Fortiproxy versions 7.2.0 through 7.2.4 Description: A null...

FortiManager & FortiAnalyzer - SSRF in FortiGuard Outbreak feature

A server-side request forgery SSRF vulnerability CWE-918 in FortiManager and FortiAnalyzer GUI may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests...

Server side request forgery (ssrf)

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the getremotecontent REST API endpoint in versions up to, and including, 1.8.3. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary...

Incomplete Internal State Distinction in GRPCWebToHTTP2ServerCodec

Affected gRPC Swift servers are vulnerable to precondition failures when parsing certain gRPC Web requests. This may lead to a denial of service...

The vulnerability of the Teacher Console and Student Console components of the Faronics Insight computer network management platform allows a hacker to perform cross-site scripting attacks.

The vulnerability of the Teacher Console and Student Console components of the Faronics Insight computer network management platform is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting...

SUSE CVE-2023-33966

Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and denoruntime 0.114.0, outbound HTTP requests made using the built-in node:http or node:https modules are incorrectly not checked against the network permission allow list --allow-net. Dependencies relying on these built-in modules...

The vulnerability in the software web interface for Cisco Webex Meetings allows a perpetrator to upload arbitrary files.

The vulnerability of Cisco Webex Meetings software’s web interface is related to insufficient verification of data entered by users. Exploiting this vulnerability allows a malicious actor to upload arbitrary files by sending a specially created HTML request...

CVE-2023-32707

In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edituser’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted w...

Code injection

In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edituser’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted w...

CVE-2023-32707 ‘edit_user’ Capability Privilege Escalation

In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edituser’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted w...

Splunk 安全漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

CVE-2023-2968

A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request. Usage of the undefined variable raises a TypeError exception...

PT-2023-3153 · Yhirose · Cpp-Httplib

Name of the Vulnerable Software and Affected Versions: yhirose/cpp-httplib versions prior to 0.12.4 Description: The issue is related to the incomplete fix for a previous problem, which allows an attacker to inject arbitrary HTTP headers when untrusted user input is used to set the content-type...

PrestaShop SQL注入漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image scaling. A security vulnerability exists in PrestaShop 3.7.3 and prior versions, which stems from multiple sensitive...