1903 matches found
DEBIAN-CVE-2023-20867
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine...
CVE-2023-31196
Missing authentication for critical function in Wi-Fi AP UNIT allows a remote unauthenticated attacker to obtain sensitive information of the affected products. Affected products and versions are as follows: AC-PD-WAPU v1.05B04 and earlier, AC-PD-WAPUM v1.05B04 and earlier, AC-PD-WAPU-P v1.05B04P...
PT-2023-24861 · Percona · Percona Monitoring/Management
Name of the Vulnerable Software and Affected Versions: Percona Monitoring and Management PMM server versions 2.x through 2.37.0 Description: The issue arises from the authenticate function in auth server.go not properly formalizing and sanitizing URL paths, which fails to reject path traversal...
PT-2023-23585 · Nextcloud · User Oidc
Name of the Vulnerable Software and Affected Versions: user oidc app versions prior to 1.3.2 Description: The user oidc app, an OpenID Connect user backend for Nextcloud, has an issue where authentication can be broken or bypassed. Recommendations: For versions prior to 1.3.2, upgrade the Nextclo...
macOS 12.x < 12.6.6 Multiple Vulnerabilities (HT213759)
The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.6.6. It is, therefore, affected by multiple vulnerabilities: - A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 9.5, macOS Ventura 13.4, iOS 15.7.6 a...
PT-2023-17419 · Johnson Controls · Openblue Enterprise Manager Data Collector
Name of the Vulnerable Software and Affected Versions: OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 Description: The issue concerns improper authentication, allowing unauthorized access under certain circumstances. Recommendations: For versions prior to 3.2.5.75, update t...
macOS 13.x < 13.4 Multiple Vulnerabilities (HT213758)
The remote host is running a version of macOS / Mac OS X that is 13.x prior to 13.4. It is, therefore, affected by multiple vulnerabilities: - In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user- provided environment variables SUDOEDITOR, VISUAL, and...
The vulnerability in the web interface for managing D-Link DIR-2640-US microprogramming software allows a hacker to bypass security restrictions.
The vulnerability of the web interface for managing D-Link DIR-2640-US microprogramming software is related to deficiencies in the authentication process when processing the LoginPassword parameter. Exploiting this vulnerability allows a malicious actor to bypass security restrictions by sending ...
PT-2023-19164 · Formilla · Formilla Live Chat
Name of the Vulnerable Software and Affected Versions: Formilla Live Chat by Formilla plugin versions prior to 1.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Formilla Live Chat by...
CVE-2023-32081 Vert.x STOMP server process client frames that would not send initially a connect frame
Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4.4.2, a Vert.x STOMP server processes client STOMP frames without checking that the client send an initial CONNECT frame replied with a...
PT-2023-3024 · WordPress · Essential Addons For Elementor
Name of the Vulnerable Software and Affected Versions: Essential Addons for Elementor versions 5.4.0 through 5.7.1 Description: An improper authentication issue exists in Essential Addons for Elementor. Exploitation of this issue may allow a remote attacker to escalate their privileges. Real-worl...
CVE-2022-41610
Improper authorization in IntelR EMA Configuration Tool before version 1.0.4 and IntelR MC before version 2.4 software may allow an authenticated user to potentially enable denial of service via local access...
PT-2023-19292 · Unknown · Skybridge Mb-A100/110
Name of the Vulnerable Software and Affected Versions: SkyBridge MB-A100/110 firmware versions 4.2.0 and earlier Description: The issue concerns missing authentication for a critical function, potentially allowing a remote unauthenticated attacker to execute certain critical functions without...
CVE-2023-23906
Missing authentication for critical function exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to execute some critical functions without authentication, e.g., rebooting the product...
CVE-2023-25452
CVE-2023-25452 corresponds to a Stored Cross-Site Scripting (XSS) vulnerability in the CMS Press WordPress plugin (CMS Press) versions <= 0.2.3, with admin+ authentication required to exploit. Public sources consistently describe the vulnerability as an authenticated XSS issue affecting CMS Pr...
CVE-2023-1861 Limit Login Attempts < 1.7.2 - Subscriber+ Stored XSS
The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks...
About the security content of AirPods and Beats firmware updates
About the security content of AirPods and Beats firmware updates This document describes the security content of AirPods and Beats firmware updates. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has...
Lenovo XClarity Controller 安全漏洞
Lenovo XClarity Controller XCC is a server-embedded management engine from Lenovo China that is used to standardize and automate basic server management tasks. A security vulnerability exists in Lenovo XClarity Controller that stems from the fact that under certain conditions, valid LDAP users wi...
Apache DolphinScheduler 授权问题漏洞
Apache DolphinScheduler is a distributed DAG visualization-based workflow task scheduling system from the Apache Apache Foundation in the United States. Apache DolphinScheduler suffers from an authorization problem vulnerability that stems from the presence of incorrect authentication, which can ...
Schneider Electric StruxureWare Data Center Expert 授权问题漏洞
Schneider Electric StruxureWare Data Center Expert StruxureWare Data Center Management Expert is a monitoring software from the French company Schneider Electric Schneider Electric. It is suitable for a variety of organizations to monitor their company-wide power, cooling, security,...