PT-2023-12211 · Dpic +1 · Dpic +1

Name of the Vulnerable Software and Affected Versions: dpic version 2021.04.10 Description: The issue is related to a use-after-free in the deleteStringBox function in dpic.y. Recommendations: For dpic version 2021.04.10, consider disabling the deleteStringBox function as a temporary workaround...

Machine catalog updates failure with error the master VM as an invalid configuration

VMWARE Hypervisor When updating a particular machine catalog with a new master image, the operation fails early on with one of the following: "action name: updatemachinecatalogprovisiningscheme" "action name: MCUpdateMachineCatalog" Error : The master VM as an invalid configuration Same issue...

Pimcore Cross-site Scripting (XSS) vulnerability in DataObject datetime fields

Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.6.8 or apply this patch manually...

PT-2023-4712 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 4.1M2 through 14.10.4 XWiki Platform versions prior to 14.10.5 and 15.1RC1 Description: The issue is related to a stored XSS vulnerability that can be exploited by any registered user through their user profile by...

PT-2023-26715 · Weaviate · Weaviate

Name of the Vulnerable Software and Affected Versions: Weaviate versions 1.20.0 and earlier Description: The issue is a type conversion problem that allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function. This affects users of Weaviate Server versions...

JVN#19661362: Multiple vulnerabilities in Proself

Proself provided by North Grid Corporation is an online storage server software. Proself contains multiple vulnerabilities listed below. Improper authentication CWE-287 - CVE-2023-39415 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N| Base Score: 7.5 CVSS...

PT-2023-4468 · D Link · D-Link Dir-880L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-880 A1 FW107WWb08 Description: The issue is related to a NULL pointer dereference in the FUN 00010824 function. This can potentially allow a remote attacker to cause a denial of service. Recommendations: For D-Link DIR-880 A1...

PT-2023-26620 · Unknown · Kidus Minimati

Name of the Vulnerable Software and Affected Versions: Kidus Minimati version 1.0.0 Description: The issue allows a remote attacker to obtain sensitive information via the "edit.php" component. This is due to a SQL injection vulnerability. Recommendations: For Kidus Minimati version 1.0.0, consid...

PT-2023-4469 · D Link · D-Link Dir-880L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-880 A1 FW107WWb08 Description: The issue is related to a buffer overflow in the function FUN 0001be68 of the D-Link DIR-880 A1 router's firmware. This buffer overflow can be exploited by a remote attacker to execute arbitrary code...

Server side request forgery (ssrf)

Flarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to conduct a Blind Server-Side Request Forgery SSRF attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofi...

Flarum vulnerable to LFI and Blind SSRF via Avatar upload

Impact The Flarum forum software is affected by a vulnerability that allows an attacker to conduct a Blind SSRF attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type, an attacker can manipulat...

PT-2023-4620 · Moxa · Moxa Tn-5900 Series +1

Name of the Vulnerable Software and Affected Versions: Moxa TN-4900 Series firmware versions v1.2.4 and prior Moxa TN-5900 Series firmware versions v3.3 and prior Description: The issue stems from insufficient input validation in the key-generation function, which could potentially allow maliciou...

GHSA-9CVC-V7WM-992C When `ui.isAccessAllowed` is `undefined`, the `adminMeta` GraphQL query is publicly accessible

Summary When ui.isAccessAllowed is undefined, the adminMeta GraphQL query is publicly accessible, that is to say, no session is required for the query. This is different to the behaviour of the default AdminUI middleware, which by default will only be publicly accessible if a session strategy is...

When `ui.isAccessAllowed` is `undefined`, the `adminMeta` GraphQL query is publicly accessible

Summary When ui.isAccessAllowed is undefined, the adminMeta GraphQL query is publicly accessible, that is to say, no session is required for the query. This is different to the behaviour of the default AdminUI middleware, which by default will only be publicly accessible if a session strategy is...

Multiple vulnerabilities in ELECOM and LOGITEC network devices

Overview Multiple network devices provided by ELECOM CO.,LTD. and LOGITEC CORPORATION contain multiple vulnerabilities listed below. Hidden Functionality CWE-912 - CVE-2023-32626, CVE-2023-35991, CVE-2023-39445 Telnet service access restriction failure CWE-284 - CVE-2023-38132 Hidden Functionalit...

PT-2023-26641 · Langchain · Langchain

Name of the Vulnerable Software and Affected Versions: LangChain versions 0.0.231 through 0.0.246 Description: An issue in LangChain allows a remote attacker to execute arbitrary code via the prompt parameter. This enables the attacker to potentially gain control over the system, leading to sever...

PT-2023-26673 · Harrison Chase · Langchain

Name of the Vulnerable Software and Affected Versions: Harrison Chase langchain versions 0.0.194 and before Harrison Chase langchain versions prior to 0.0.236 Description: An issue in Harrison Chase langchain allows a remote attacker to execute arbitrary code via the from math prompt and from...

PT-2023-5600 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: InsydeH2O versions 5.0 through 5.5 Description: An issue was discovered in SysPasswordDxe, where system password information could optionally be stored in cleartext, potentially leading to information disclosure. This might allow a remote...

SUSE CVE-2023-39952

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1, a user can access files inside a subfolder of a groupfolder accessible to them, even if advanced...

Security Bulletin: Multiple Linux Kernel vulnerabilities may affect IBM Elastic Storage System

Summary There are some vulnerabilities in the Linux kernel, used by IBM Elastic Storage System, which could allow a denial of service. Fixes for these vulnerabilities are available. Vulnerability Details CVEID:CVE-2022-42703 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused b...