Siemens RUGGEDCOM ROX Cross-Site Request Forgery (CVE-2022-29561)

A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.16.0, RUGGEDCOM ROX MX5000RE All versions V2.16.0, RUGGEDCOM ROX RX1400 All versions V2.16.0, RUGGEDCOM ROX RX1500 All versions V2.16.0, RUGGEDCOM ROX RX1501 All versions V2.16.0, RUGGEDCOM ROX RX1510 All versions V2.16.0...

Vulnerability of the CMS system: 1C-Bitrix – Website management related to authentication procedures’ flaws, allowing attackers to access confidential information and perform operations with privileged access rights of compromised accounts.

Vulnerability of the CMS system: 1C-Bitrix. Website management is associated with deficiencies in authentication procedures. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information and perform operations under the privileges of a compromised account...

CVE-2023-21521

An SQL Injection vulnerability in the Management Console Operator Audit Trail of BlackBerry AtHoc version 7.15 could allow an attacker to potentially read sensitive data from the database, modify database data Insert/Update/Delete, execute administration operations on the database, recover the...

CVE-2023-40730

A vulnerability has been identified in QMS Automotive All versions V12.39. The QMS.Mobile module of the affected application lacks sufficient authorization checks. This could allow an attacker to access confidential information, perform administrative functions, or lead to a denial-of-service...

CVE-2023-4307 Lock User Account <= 1.0.3 - Arbitrary Account Lock/Unlock via CSRF

The Lock User Account WordPress plugin through 1.0.3 does not have CSRF check when bulk locking and unlocking accounts, which could allow attackers to make logged in admins lock and unlock arbitrary users via a CSRF attack...

CVE-2023-4816

A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On SSO with password validation in T214. This vulnerability can be exploited by an authenticated user per-forming an Equipment Tag Out holder action Accept, Release, and Clear for another user and...

Hitachi Energy Asset Suite Authorization Issues Vulnerability

Hitachi Energy Asset Suite is a powerful suite from Hitachi, Japan. standardizes and streamlines enterprise asset management workflows to maximize employee productivity and improve asset performance. A security vulnerability exists in Hitachi Energy Asset Suite versions 9.6.3.11.1 and earlier, an...

PT-2023-18740 · Samsung · Samsung Knox Sdk

Name of the Vulnerable Software and Affected Versions: Samsung Knox SDK versions 2.8.60 and earlier Description: The issue allows an attacker to bypass the authentication process and gain access to sensitive data. Recommendations: For Samsung Knox SDK versions 2.8.60 and earlier, at the moment,...

A security community success story of mitigating a misconfiguration

Learn about the process of preventing security issues by changing things outside of your environment by looking at how a misconfiguration was occurring when Github Actions were integrated with AWS IAM roles and the improvements made that have now made this misconfiguration much less likely...

Improper Check For Unusual Or Exceptional Conditions

Electron is vulnerable to Improper Check For Unusual Or Exceptional Conditions. The vulnerability is caused by not implementing error handling correctly in case of an API exposed to the main world via contextBridge returning an object or array that contains a JS object which cannot be serialized...

PT-2023-5297 · Unknown · Modulys Gp

Name of the Vulnerable Software and Affected Versions: MODULYS GP MOD3GP-SY-120K affected versions not specified Description: The issue is related to weaknesses in the user management level of a web application, allowing an attacker to obtain necessary information from headers to create specially...

PT-2023-5299 · Unknown · Modulys Gp

Name of the Vulnerable Software and Affected Versions: MODULYS GP MOD3GP-SY-120K affected versions not specified Description: The issue is related to incorrect session management within the web application, allowing attackers to steal session cookies and perform various actions on the device. Thi...

Design/Logic Flaw

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps using contextIsolation and contextBridge are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach...

CVE-2023-30710

Improper input validation vulnerability in Knox AI prior to SMR Sep-2023 Release 1 allows local attackers to launch privileged activities...

CVE-2023-32438

This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in tvOS 16.3, macOS Ventura 13.2, watchOS 9.3, iOS 16.3 and iPadOS 16.3. An app may be able to bypass Privacy preferences...

CVE-2023-32438

This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in tvOS 16.3, macOS Ventura 13.2, watchOS 9.3, iOS 16.3 and iPadOS 16.3. An app may be able to bypass Privacy preferences...

CVE-2023-32438

This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in tvOS 16.3, macOS Ventura 13.2, watchOS 9.3, iOS 16.3 and iPadOS 16.3. An app may be able to bypass Privacy preferences...

CVE-2023-32438

CVE-2023-32438 concerns a privacy-bypass issue in Apple platforms. The vulnerability could allow an app to bypass Privacy preferences due to insufficient checks, with the issue fixed in tvOS 16.3, macOS Ventura 13.2, watchOS 9.3, iOS 16.3 and iPadOS 16.3. The impact is described as an unauthorize...

CVE-2023-4485

ARDEREG ​Sistema SCADA Central versions 2.203 and prior login page are vulnerable to an unauthenticated blind SQL injection attack. An attacker could manipulate the application's SQL query logic to extract sensitive information or perform unauthorized actions within the database. In this case, th...

PT-2023-22196 · Electron · Electron

Name of the Vulnerable Software and Affected Versions: Electron versions prior to 22.3.6 Electron versions prior to 23.2.3 Electron versions prior to 24.0.1 Electron versions prior to 25.0.0-alpha.2 Description: Electron is a framework for writing cross-platform desktop applications using...