CVE-2023-25837

There is a Cross‑Site Scripting XSS vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could result in the execution of arbitrary JavaScript code in the target’s browser...

CVE-2023-25836

There is a Cross-site Scripting vulnerability in Esri Portal for ArcGIS Sites in versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victims browser. The privileges required...

CVE-2023-25835

There is a stored Cross‑Site Scripting XSS vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that may allow a remote, authenticated attacker with high‑privileged access to create a crafted link that is persisted within the site configuration. When accessed by a victim, the...

PT-2023-20343

Name of the Vulnerable Software and Affected Versions Esri ArcGIS Enterprise Sites versions 10.8.1 through 10.9 Description The issue is a Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could potentially...

Veritas InfoScale Operations Manager prior to 8.0.0.410 Insecure File Upload (VTS23-009)

The Veritas InfoScale Operations Manager application installed on the remote host is prior to 8.0.0.410. It is, therefore, affected by an insecure file upload vulnerability. - The VIOM XPRTLD web application allows an authenticated attacker to upload all types of files to the server. An...

CVE-2023-32265

A potential security vulnerability has been identified in the Enterprise Server Common Web Administration ESCWA component used in Enterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server. An attacker would need to be authenticated into ESCWA to attempt to...

CVE-2023-32481

Wyse Management Suite versions prior to 4.0 contain a denial-of-service vulnerability. An authenticated malicious user can flood the configured SMTP server with numerous requests in order to deny access to the system...

Dell Wyse Management Suite 授权问题漏洞

Wyse Management Suite is a scalable solution for managing and optimizing Wyse endpoints from Dell, USA. The product includes centralized management of Wyse endpoints, asset tracking and automated device discovery. A security bypass vulnerability exists in prior versions of Wyse Management Suite...

Dell Wyse Management Suite 安全漏洞

Wyse Management Suite is a scalable solution for managing and optimizing Wyse endpoints from Dell, USA. The product includes centralized management of Wyse endpoints, asset tracking and automated device discovery. A denial of service vulnerability exists in Wyse Management Suite prior to version...

Dell Wyse Management Suite 安全漏洞

Wyse Management Suite is a scalable solution for managing and optimizing Wyse endpoints from Dell, USA. The product includes centralized management of Wyse endpoints, asset tracking and automated device discovery. An information disclosure vulnerability exists in versions prior to Wyse Management...

PT-2023-20341

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS Enterprise Sites versions 10.8.1 through 11.1 Description There is a stored Cross-site Scripting issue in Esri Portal for ArcGIS Enterprise Sites that may allow a remote, authenticated attacker to create a crafted link...

CVE-2023-30799

MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface. The attacker can abuse this vulnerability to execute arbitrary...

Privilege escalation

MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface. The attacker can abuse this vulnerability to execute arbitrary...

CVE-2023-30799

CVE-2023-30799 affects MikroTik RouterOS, with vulnerable versions: RouterOS 6.49.7 and earlier (including long-term 6.48.6). The issue is a privilege escalation that allows a remote, authenticated attacker to raise privileges from admin to super-admin via the Winbox or HTTP interface, enabling a...

CVE-2023-20575

A flaw was found in hw, where a potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a program’s execution inside an AMD SEV VM, potentially resulting in a leak of sensitive information. Mitigatio...

CVE-2023-29260

IBM Sterling Connect:Express for UNIX 1.5 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 252135...

CVE-2023-22506

This High severity Injection and RCE Remote Code Execution vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo Data Center. This Injection and RCE Remote Code Execution vulnerability, with a CVSS Score of 7.5, allows an authenticated attacker to modify the actions...

PT-2023-5450 · Tp Link · Deco M4

Name of the Vulnerable Software and Affected Versions: Deco M4 firmware versions prior to 'Deco M4JP V2 1.5.8 Build 20230619' Description: The issue allows a network-adjacent authenticated attacker to execute arbitrary OS commands. This is related to the failure to neutralize special elements in...

PT-2023-22226 · Ibm · Ibm Sterling Connect:Express For Unix

Name of the Vulnerable Software and Affected Versions: IBM Sterling Connect:Express for UNIX version 1.5 Description: The issue allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. This is due to ...

CVE-2023-22508

This High severity RCE Remote Code Execution vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Center & Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high...