HCL Sametime Cross-Site Request Forgery Vulnerability

HCL Technologies HCL Sametime is a conferencing solution from HCL Technologies, USA. A cross-site request forgery vulnerability exists in HCL Sametime. An attacker could exploit this vulnerability to perform a cross-site request forgery attack...

HID Global OMNIKEY Security Breach

HID Global OMNIKEY is a hardware device from HID Global, Inc. It is used to read cards. A security vulnerability exists in the HID Global OMNIKEY and iCLASS SE. An attacker could exploit the vulnerability to obtain sensitive information...

Hitron Systems DVR Security Vulnerability

Hitron Systems DVR is a digital video recorder from Hitron Systems, a South Korean company. A security vulnerability exists in Hitron Systems DVR LGUVR-4H versions 1.02 through 4.02, which stems from incorrect input validation. An attacker could exploit the vulnerability to trigger a cyber attack...

PT-2024-14998 · Wpblog · Wp Blogs' Planetarium Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: WP Blogs' Planetarium WordPress plugin versions 1.0 and earlier Description: The issue is related to the lack of a CSRF check when updating settings in the plugin, which could allow attackers to make a logged-in admin change them via a CSRF...

CVE-2023-4468

A vulnerability was found in Poly Trio 8500, Trio 8800 and Trio C60. It has been classified as problematic. This affects an unknown part of the component Poly Lens Management Cloud Registration. The manipulation leads to missing authorization. It is possible to launch the attack on the physical...

PT-2023-21986 · Hikvision · Localservicecomponents

Name of the Vulnerable Software and Affected Versions: plug-in affected versions not specified Description: The issue allows an attacker to exploit it by sending crafted messages to computers with the plug-in installed, modifying plug-in parameters. This could cause affected computers to download...

PT-2023-26011 · Hcl · Hcl Connections

Name of the Vulnerable Software and Affected Versions: HCL Connections affected versions not specified Description: The issue is related to reflected cross-site scripting XSS, where an attacker can execute arbitrary script code in the browser of an unsuspecting user after visiting a vulnerable UR...

GHSA-MQ6F-5XH5-HGCF Harbor timing attack risk

In the Harbor jobservice container, the comparison of secrets in the authenticator type is prone to timing attacks. The vulnerability occurs due to the following code: https://github.com/goharbor/harbor/blob/aaea068cceb4063ab89313d9785f2b40f35b0d63/src/jobservice/api/authenticator.goL69-L69 To...

PT-2023-25148 · WordPress · Ftp Access

Name of the Vulnerable Software and Affected Versions: FTP Access WordPress plugin versions 1.0 and earlier Description: The issue concerns a lack of authorization and CSRF checks when updating settings in the plugin, along with missing sanitization and escaping. This allows any authenticated use...

PT-2023-19182 · Creative Solutions.Net +1 · Creative Gallery Component For Joomla +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to an SQL Injection vulnerability due to the improper neutralization of special elements used in an SQL command. This allows for SQ...

PT-2023-4323 · Linux +7 · Linux Kernel +7

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A flaw was found in KVM AMD Secure Encrypted Virtualization SEV in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition...

PT-2023-23079 · Slate · Slate

Name of the Vulnerable Software and Affected Versions: Slate affected versions not specified Description: A missing origin validation in the Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks. Recommendations: At the moment, the...

MGASA-2023-0235 Updated firefox/nss packages fix security vulnerability

An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS CVE-2023-37201. Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free in...

ROS-2-1871

2.1871 Mozilla Firefox browser vulnerability CVE-2021-29970, CVE-2021-29976 1. Vulnerability description: CVE-2021-29970 A vulnerability in the Mozilla Firefox browser, is related to a release error in accessibility functions when processing HTML content. Exploitation of the vulnerability could...

Rockwell Automation FactoryTalk Services Platform Trust Management Issue Vulnerability

Rockwell Automation FactoryTalk Services Platform is a suite of services platforms from Rockwell Automation that provides routine services for applications such as diagnostic information, health monitoring and real-time data access. A trust management issue vulnerability exists in the Rockwell...

CVE-2023-3238 OTCMS server-side request forgery

A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62. This issue affects some unknown processing of the file /admin/read.php?mudi=getSignal. The manipulation of the argument signalUrl leads to server-side request forgery. The attack may be initiated remotely. The...

The vulnerability of Cisco SD-WAN vEdge router microprogramming software, related to the execution of operations outside the buffer in memory, allows a attacker to cause service failure.

The vulnerability of Cisco SD-WAN vEdge microprogramming software relates to the execution of operations outside the buffer in memory when handling traffic. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

PT-2023-3026 · Wago · Wago Cc100 +4

Name of the Vulnerable Software and Affected Versions: WAGO PFC100 versions =16 and =16 and =16 and =16 and =16 and =16 and =16 and =16 and =16 and =16 and =23, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the device...

Code injection

Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW...

OpenZeppelin 输入验证错误漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. An input validation error vulnerability exists in OpenZeppelin Contracts. An attacker exploiting this vulnerability could perform arbitrary actions...