10191 matches found
CVE-2023-51763
ActiveAdmin CSV injection CVE-2023-51763 affects csv_builder.rb in ActiveAdmin prior to 3.2.0. The underlying issue is that spreadsheet formulas could be uploaded/exported via CSV, allowing injection when opened in programs like LibreOffice. The Red Hat and GitHub advisories corroborate the issue...
PT-2023-31887 · Unknown · Activeadmin
Name of the Vulnerable Software and Affected Versions: ActiveAdmin versions prior to 3.2.0 Description: The issue allows CSV injection, which can lead to remote code execution and private data exfiltration when maliciously crafted spreadsheet formulas are uploaded and imported into a spreadsheet...
PT-2023-9220 · Nextcloud +2 · Nextcloud Enterprise Server +3
Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 26.0.9 and 27.1.4 Nextcloud Enterprise Server versions prior to 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 Description: The issue is related to Nextcloud Server, an open source cloud platform, wher...
CVE-2022–26923 aka Certifried
Active Directory Domain Services Elevation of Privilege Vulnerability. Recent assessments: cdelafuente-r7 at January 10, 2023 3:08pm UTC reported: This vulnerability enables a low-privileged user to escalate privileges in a default Active Directory environment with the Active Directory Certificat...
CVE-2023-50707
Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device...
CVE-2023-50707
Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device...
CVE-2023-50707
CVE-2023-50707 affects EFACEC BCU 500 (EC/automation control IED). The vulnerability enables uncontrolled resource consumption (DoS) by exploiting active user sessions to send custom requests, leading to device denial of service (impact as described in Red Hat/CISA/EFACEC advisories). Affected pr...
CVE-2023-50707 Uncontrolled Resource Consumption in EFACEC BCU 500
Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device...
PT-2023-31613 · Efacec · Bcu 500 +1
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows an attacker to send custom requests to cause a denial-of-service condition on the device through the exploitation of active user...
EFACEC BCU 500 Resource Management Error Vulnerability
The EFACEC BCU 500 is a programmable control system from EFACEC Portugal. The EFACEC BCU 500 suffers from a resource management error vulnerability that originates from the fact that by exploiting an active user session, an attacker can send a custom request to cause a denial of service on the...
QNAP QTS / QuTS hero Vulnerabilities in Samba (QSA-23-20)
The version of QNAP QTS / QuTS hero installed on the remote host is affected by multiple vulnerabilities as referenced in the QSA-23-20 advisory. - A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory...
CVE-2023-50715
Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. Version 2023.12.3 contains a patch for this issue. When starting the Home Assistant...
Cross site request forgery (csrf)
Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. Version 2023.12.3 contains a patch for this issue. When starting the Home Assistant...
CVE-2023-50715 User accounts disclosed to unauthenticated actors on the LAN
Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. Version 2023.12.3 contains a patch for this issue. When starting the Home Assistant...
Find Users Without Pre-Auth Required (ASREP-roast)
This module searches for AD users without pre-auth required. Two different approaches are provided: - Brute force of usernames does not require a user account; should not lock out accounts - LDAP lookup requires an AD user account Module Options msf use auxiliary/gather/asrep msf auxiliaryasrep...
Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2023-3286)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2023-9843 · Qualcomm · Qualcomm Embedded Platform
Name of the Vulnerable Software and Affected Versions: Qualcomm embedded platform software affected versions not specified Description: The issue is related to a memory corruption vulnerability in the Network Stack module of Qualcomm's embedded platform software. This occurs when processing IPA...
Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2023-3258)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2023-49956
An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP Open Charge Point Protocol for electric vehicles. A StopTransaction message with any random transactionId terminates active transactions...
CVE-2023-49956
An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP Open Charge Point Protocol for electric vehicles. A StopTransaction message with any random transactionId terminates active transactions...