CVE-2023-1750 CVE-2023-1750

The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could retrieve device history, set device settings, and retrieve device information...

Corel CorelDRAW Graphics Suite buffer overflow vulnerability (CNVD-2023-29422)

Corel CorelDRAW Graphics Suite is a vector graphics editing software from Corel Digital Technology Canada. Corel CorelDRAW Graphics Suite version 23.5.0.506 contains a buffer overflow vulnerability, which stems from a lack of proper validation of user-supplied data when parsing JP2 files and can ...

CVE-2023-28670

Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stored cross-site scripting XSS vulnerability exploitable by authenticated attackers with Overall/Read permission...

Adobe Experience Manager URL Redirection Vulnerability (CNVD-2023-45911)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Audobee Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A URL...

Fortinet FortiWeb OS Command Injection Vulnerability (CNVD-2023-18291)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. An operating system command injection...

Google Android elevation of privilege vulnerability (CNVD-2023-36112)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by attackers to elevate privileges...

Google Android elevation of privilege vulnerability (CNVD-2023-36107)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by attackers to elevate privileges...

The vulnerability of the Windows iSCSI Discovery Service allows a hacker to trigger a service failure.

The vulnerability of the Windows iSCSI Discovery Service in Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS. An attacker exploited the vulnerability to make the face feature unavailable...

PT-2023-1680 · Aruba · Arubaos

Name of the Vulnerable Software and Affected Versions: ArubaOS affected versions not specified Description: The issue is related to the lack of input sanitization in the command line interface of ArubaOS, which can be exploited by a remote attacker to execute arbitrary commands as a privileged us...

Sales Tracker Management System 跨站请求伪造漏洞

Sales Tracker Management System is a sales tracker management system by Carlo Montero Personal Developer. A cross-site request forgery vulnerability exists in SourceCodester Sales Tracker Management System version 1.0. An attacker could exploit this vulnerability to conduct a cross-site request...

Oracle Database Server Java VM Component Denial of Service Vulnerability

Oracle Database Server is a set of relational database management system of the United States Oracle Oracle. The database management system provides data management, distributed processing and other functions. Oracle Database Server has a denial of service vulnerability that can be exploited by a...

PT-2023-19258 · Sap · Sap Netweaver As Abap +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS for ABAP and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790 Description: The issue is caused by insufficient input validation, allowing an unauthenticated attacker to send a crafted URL to a user...

PT-2023-1392 · Schneider Electric · Struxureware Data Center Expert

Name of the Vulnerable Software and Affected Versions: StruxureWare Data Center Expert versions 7.9.2 and prior Description: A Cross-site Scripting vulnerability exists due to improper neutralization of input during web page generation. This issue affects the logging capabilities of the webserver...

Dell PowerScale OneFS 加密问题漏洞

Dell PowerScale OneFS is an operating system from Dell USA Inc. Dell PowerScale OneFS is vulnerable to an encryption issue that could be exploited by an attacker to cause a data breach...

PT-2023-12754 · Dell · Dell Bios

Name of the Vulnerable Software and Affected Versions: Dell BIOS affected versions not specified Description: The issue allows an unauthenticated local attacker with physical access to the system and knowledge of the system configuration to potentially exploit it and read system information via...

Zammad Access Control Error Vulnerability (CNVD-2023-97829)

Zammad is a suite of ticket management software from the German company Zammad. An access control error vulnerability exists in Zammad version v5.3.0, which stems from an improper access control error in the component /api/v1/mentions, and can be exploited by an authenticated attacker with proxy...

Moxa SDS-3008 Denial of Service Vulnerability

Moxa SDS-3008 is a series of industrial switches from MOXA China. A denial of service vulnerability exists in the Moxa SDS-3008, which can be exploited by an attacker to send a specially crafted HTTP message header resulting in a denial of service...

Apache Portable Runtime Utility Integer Overflow Vulnerability

Apache Portable Runtime is the United States Apache Apache Foundation for the upper tier applications to provide the underlying support for multiple operating system platforms across the use of the interface library . An integer overflow vulnerability exists in the Apache Portable Runtime Utility...

CVE-2022-38389 IBM Tivoli Workload Scheduler XML external entity injection

IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 233975...