PT-2023-27976 · Tenda · Tenda Ac7

Name of the Vulnerable Software and Affected Versions: Tenda AC7 version V15.03.06.44 Description: A stack overflow issue was discovered via the timeZone parameter at the "/goform/SetSysTimeCfg" API endpoint. This issue affects the Tenda AC7 router. Recommendations: For Tenda AC7 version...

PT-2023-27673 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version US AC6V1.0BR V15.03.05.16 multi TD01.bin Description: The issue is related to a Buffer Overflow that occurs via the function "initIpAddrInfo". This function reads in a user-provided parameter and passes the variable without...

PT-2023-27667 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.05.16 Description: The issue concerns a Buffer Overflow that can be triggered via the add white node function. Recommendations: For version 15.03.05.16, consider disabling the add white node function as a temporary...

GHSA-64X5-55RW-9974 cross-site inclusion (XSSI) of files in jupyter-server

Impact Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". Patches Jupyter Server 2.7.2 Workarounds Use lower performance...

PT-2023-26714 · Qdrant · Qdrant

Name of the Vulnerable Software and Affected Versions: qdrant version 1.3.2 Description: A Buffer Overflow issue allows a remote attacker to cause a denial of service via the chucnked vectors.rs component. This issue affects qdrant, enabling an attacker to disrupt service. Recommendations: For...

CVE-2023-40170

jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit 87a49272728 which h...

PT-2023-9132 · Synology · Video Station

Name of the Vulnerable Software and Affected Versions: Video Station versions prior to 5.7.2 Description: A SQL injection issue affects Video Station, related to a lack of protection against SQL query structure attacks. This could allow a remote attacker to execute arbitrary code by injecting...

PT-2023-4666 · Freerdp +8 · Freerdp +8

Name of the Vulnerable Software and Affected Versions: FreeRDP versions prior to 2.11.0 FreeRDP versions prior to 3.0.0-beta3 Description: The issue affects FreeRDP clients only and is related to an integer underflow leading to a Denial of Service DOS vulnerability. When an insufficient blockLen ...

PT-2023-8337 · Unknown · Smartnode Sn200

Name of the Vulnerable Software and Affected Versions: SmartNode SN200 aka SN200 version 3.21.2-23021 Description: The issue is related to the Network Diagnostic Commands function of the SmartNode SN200 analog telephone adapter's firmware, which fails to neutralize special elements used in an...

PT-2023-29578 · Unknown · Sourcecodester Inventory Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Inventory Management System version 1.0 Description: A critical vulnerability was found in the SourceCodester Inventory Management System. The issue affects an unknown functionality of the file staff data.php. The manipulation ...

CVE-2023-40587

Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of t...

CVE-2023-40587 Pyramid static view path traversal up one directory

Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of t...

Netmaker IDOR Allows User to Update Other User's Password

Impact An IDOR vulnerability was found in the user update function. By specifying another user's username it is possible to update the other user's password. Patches Issue is patched in 0.17.1, and fixed in 0.18.6+. If Users are using 0.17.1, they should run "docker pull gravitl/netmaker:v0.17.1"...

PT-2023-27697 · Tenda · Tenda Ax3

Name of the Vulnerable Software and Affected Versions: Tenda AX3 version 16.03.12.11 Description: The issue is a stack buffer overflow that allows attackers to cause a Denial of Service DoS via the ssid parameter. This occurs at the form fast setting wifi set function. Recommendations: For Tenda...

PT-2023-27640 · Phicomm · Phicomm K2

Name of the Vulnerable Software and Affected Versions: Phicomm k2 version 22.6.529.216 Description: The Phicomm k2 router contains a command injection vulnerability via the luci.sys.call function. This issue allows for remote command execution. Recommendations: For Phicomm k2 version 22.6.529.216...

PT-2023-27645 · Tenda · Tenda Ac23

Name of the Vulnerable Software and Affected Versions: Tenda AC23 version 16.03.07.45 cn Description: The issue arises from the sub 451784 function not validating user-entered parameters, leading to a stack overflow. Recommendations: For Tenda AC23 version 16.03.07.45 cn, as a temporary workaroun...

PT-2023-5246

Name of the Vulnerable Software and Affected Versions giflib version 5.2.1 Description The issue is related to a segmentation fault in the getarg.c component of the giflib library, which can be exploited to cause a denial of service. Recommendations For giflib version 5.2.1, consider updating to ...

PT-2023-27643 · Tenda · Tenda Ac23

Name of the Vulnerable Software and Affected Versions: Tenda AC23 version Vv16.03.07.45 cn Description: The issue is related to a Buffer Overflow vulnerability via the sub 450A4C function. Recommendations: For Tenda AC23 version Vv16.03.07.45 cn, as a temporary workaround, consider disabling the...

Oracle Linux 9 : rust (ELSA-2023-4634)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-4634 advisory. 1.66.1-2 - rust-cargo: cargo does not respect the umask when extracting dependencies CVE-2023-38497 Tenable has extracted the preceding description block direct...

PT-2023-26334 · Keylime +3 · Keylime +3

Name of the Vulnerable Software and Affected Versions: Keylime versions prior to 7.5.0 Description: A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide t...