CVE-2023-27243

CVE-2023-27243 concerns Makves DCAP, version 3.0.0.122, where an access-control flaw can let unauthenticated attackers retrieve cleartext credentials via a crafted request to the product API. The public description and connected documents consistently identify the root cause as improper access co...

The vulnerability of the microprogrammed software for Zyxel NAS326, NAS540, and NAS542 lies in the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary code.

The vulnerability of the microprogrammed software for Zyxel NAS326, NAS540, and NAS542 lies in the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially...

SolarWinds Serv-U File Server 安全漏洞

SolarWinds Serv-U File Server is a file transfer server from SolarWinds USA. A security vulnerability exists in SolarWinds Serv-U File Server version 15.3.2 and earlier, which originates from submitting an HTTP request when changing or updating the properties of a file share or a file request,...

Fortinet FortiManager 代码问题漏洞

Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet devices, and the ability to group devices into different management domains ADOM to further simplify multi-device security deployment a...

Mozilla Firefox Buffer Overflow Vulnerability (CNVD-2023-55350)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox, which can be exploited by a remote attacker to submit a specially crafted web request that can be tricked into being parsed by the user, which can...

Mozilla Firefox 缓冲区错误漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox, which can be exploited by a remote attacker to submit a specially crafted web request that can be tricked into being parsed by the user, which can...

CVE-2023-33518

emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request...

Information disclosure

emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request...

CVE-2023-33518

emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request...

Splunk 安全漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

PT-2023-21274 · Prestashop · Tshirtecommerce

Name of the Vulnerable Software and Affected Versions: tshirtecommerce aka Custom Product Designer version 2.1.4 for PrestaShop Description: An issue allows a remote attacker to forge an HTTP request with the file name parameter in the "tshirtecommerce/ajax.php?type=svg" endpoint to traverse...

Splunk 路径遍历漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

The vulnerability in the web interface of Cisco NX-OS and FXOS router devices from Cisco UCS Fabric Interconnect allows a attacker to trigger a service failure.

The vulnerability of the web interface of Cisco NX-OS and FXOS router devices from Cisco UCS Fabric Connect is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to trigger a service failure by sending a specially crafted HTTP request...

PT-2023-22356 · Npm +1 · Proxy

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A remote attacker can trigger a denial of service by sending a crafted HTTP request, affecting the socket.remoteAddress variable. The usage of this...

CVE-2023-33280

In the Store Commander scquickaccounting module for PrestaShop through 3.7.3, multiple sensitive SQL calls can be executed with a trivial HTTP request and exploited to forge a blind SQL injection...

PrestaShop SQL注入漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution offers multiple payment methods, short message alerts, and product image scaling. A security vulnerability exists in PrestaShop version 2023-05-09 and earlier, which stems from a sensitive SQ...

PT-2023-24265 · Prestashop +1 · Store Commander Scquickaccounting Module +1

Name of the Vulnerable Software and Affected Versions: Store Commander scquickaccounting module for PrestaShop versions through 3.7.3 Description: The issue allows multiple sensitive SQL calls to be executed with a trivial HTTP request, which can be exploited to forge a blind SQL injection...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload or delete certain files.

The vulnerability of the Cisco Identity Services Engine’s web management interface relates to the implementation of security functions at the client side. Exploiting this vulnerability allows a malicious actor to upload or delete certain files using a specially created HTTP request...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to execute arbitrary commands.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform exists because measures to neutralize special elements used in the operating system command line are not taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a malicious actor to read arbitrary files.

The vulnerability of the Cisco Identity Services Engine ISE’s web management interface is related to deficiencies in path name checking for access-limited directories. Exploiting this vulnerability could allow a malicious actor, operating remotely, to read arbitrary files using a specially create...