CVE-2023-20229

A vulnerability in the CryptoService function of Cisco Duo Device Health Application for Windows could allow an authenticated, local attacker with low privileges to conduct directory traversal attacks and overwrite arbitrary files on an affected system. This vulnerability is due to insufficient...

CVE-2023-20013

Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-level privileges. The attacker would need to have Administrator privileges on the affected device to exploit these vulnerabilities. These...

CVE-2023-2737

Improper log permissions in SafeNet Authentication Service Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local privilege escalation...

CVE-2023-2737 Improper securing of log directory may allow a denial of service

Improper log permissions in SafeNet Authentication Service Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local privilege escalation...

Cisco Unified Communications Manager SQL注入漏洞

Cisco Unified Communications Manager CUCM, Unified CM, CallManager is a call-processing component of a unified communications system from Cisco. The component provides a scalable, distributable and highly available enterprise IP telephony call processing solution. A security vulnerability exists ...

PT-2023-4390 · Cisco · Cisco Unified Communications Manager Session Management Edition +1

Name of the Vulnerable Software and Affected Versions: Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME affected versions not specified Description: A vulnerability in the web-based management interface could allow ...

CVE-2023-33013

A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01ABIR.1C0 could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request...

PT-2023-4362 · Zyxel · Zyxel Nbg6604

Name of the Vulnerable Software and Affected Versions: Zyxel NBG6604 firmware version V1.01ABIR.1C0 Description: A post-authentication command injection vulnerability in the NTP feature could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request...

SQL Injection

trytond is vulnerable to SQL Injection. The vulnerability is due to improper SQL sanitization in modelsql.py, allowing an authenticated attacker to inject and execute malicious SQL queries into the system when reading fields without an SQL type...

CVE-2023-4282

The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'adminpostremove' and 'removeprivatedata' functions in versions up to, and including, 3.8.2. This makes it possible for authenticated attackers with subscriber privileges or...

Sql injection

A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alertscount component, allows an authenticated attacker to execute arbitrary SQL queries on the DBMS used by the web application. Authenticated users can extract arbitrary information...

CVE-2023-22843 Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2

An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that will be stored and can later be executed by another legitimate user viewing the details of such a rule. Via stored...

CVE-2023-22843

CVE-2023-22843 is a stored XSS vulnerability in Nozomi Guardian/CMC where an authenticated administrator can inject JavaScript into Threat Intelligence rule definitions (yara content; limited HTML for packet/STYX), which then executes in other users’ sessions. Impact includes unauthorized actions...

SQL Injection

prestashop/prestashop is vulnerable to SQL Injection. The vulnerability is due to improper SQL sanitization in Db.php, allowing an authenticated attacker to inject and execute malicious SQL queries into the system...

SQL Injection

prestashop/prestashop is vulnerable to SQL Injection. The vulnerability is due to improper SQL sanitization in ProductRepository.php, allowing an authenticated attacker to inject and execute malicious SQL queries into the system...

Privilege Escalation

sentry is vulnerable to Privilege Escalation. An authenticated attacker is able to take advantage of an access token with a restricted scope by requesting a list of all user-created tokens, including those with wider scopes from the /api/0/api-tokens/ endpoint, resulting in privilege escalation...

CVE-2022-39062

A vulnerability has been identified in SICAM TOOLBOX II All versions V07.10. Affected applications do not properly set permissions for product folders. This could allow an authenticated attacker with low privileges to replace DLLs and conduct a privilege escalation...

CVE-2022-39062

A vulnerability has been identified in SICAM TOOLBOX II All versions V07.10. Affected applications do not properly set permissions for product folders. This could allow an authenticated attacker with low privileges to replace DLLs and conduct a privilege escalation...

CVE-2023-37569 OS Command Injection Vulnerability in Emagic Data Center Management Suite

This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. A remote authenticated attacker could exploit this by injecting OS commands on the targeted system. Successful exploitation of this vulnerability could allow the attacker ...

CVE-2023-37569 OS Command Injection Vulnerability in Emagic Data Center Management Suite

This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. A remote authenticated attacker could exploit this by injecting OS commands on the targeted system. Successful exploitation of this vulnerability could allow the attacker ...