1903 matches found
CVE-2023-27497 Multiple vulnerabilities in SAP Diagnostics Agent (EventLogServiceCollector)
Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation, the attacker can completely...
About the security content of AirPods and Beats firmware updates
About the security content of AirPods and Beats firmware updates This document describes the security content of AirPods and Beats firmware updates. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has...
Citrix Hypervisor - Unable to join server to existing pool
Unable to join the server to pool. Error from xencenter: "The server was unable to contact your domain server to enable external authentication. Check that your settings are correct and a route to the server exists."...
PT-2023-19186 · Github · Github Enterprise Server
Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.9 Description: An improper authentication issue was identified that allowed unauthorized modification of other users' secret gists by authenticating through an SSH certificate authority, provided t...
CVE-2023-28853 Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0 and prior to versions 3.5.8, 4.0.4, and 4.1.2, the LDAP query made during login is insecure and the attacker can perform LDAP injection...
PT-2023-15314 · Unknown · Wpdevart Booking Calendar +1
Name of the Vulnerable Software and Affected Versions: WpDevArt Booking calendar, Appointment Booking System plugin versions 3.2.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by authenticated users with edit...
PT-2023-14723 · Megafeis +1 · Megafeis +1
Name of the Vulnerable Software and Affected Versions: MEGAFEIS, BOFEI DBD+ Application for IOS & Android version 1.4.4 Description: An issue in the MEGAFEIS, BOFEI DBD+ Application allows an authenticated attacker to gain access to sensitive account information. Recommendations: For version 1.4....
PT-2023-1954 · Delta Electronics · Infrasuite Device Master
Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 Description: The issue is related to a lack of authentication for a critical function, which could allow an attacker to achieve unauthenticated remote code execution in the...
PT-2023-21844
Name of the Vulnerable Software and Affected Versions Ansible Semaphore versions prior to 2.8.89 Description The issue is related to the mishandling of authentication in the api/auth.go file. Recommendations For versions prior to 2.8.89, update to version 2.8.89 or later to resolve the issue...
PT-2023-17002 · Sourcecodester · Sourcecodester Medicine Tracker System
Name of the Vulnerable Software and Affected Versions: SourceCodester Medicine Tracker System version 1.0 Description: A critical issue was found in the system, affecting an unknown part of the file Users.php?f=save user. The manipulation of the arguments firstname, middlename, lastname, username...
PT-2023-9095 · Avermedia · Avercaster
Name of the Vulnerable Software and Affected Versions: AVerCaster affected versions not specified Description: The issue is related to insufficient restriction of authentication attempts, allowing a remote attacker to perform a brute force attack. Recommendations: At the moment, there is no...
PT-2023-19853 · Hashicorp +1 · Hashicorp Vault +2
Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions prior to 1.10.11 HashiCorp Vault and Vault Enterprise versions prior to 1.11.8 HashiCorp Vault and Vault Enterprise versions prior to 1.12.4 HashiCorp Vault and Vault Enterprise versions prior to...
CVE-2023-27290 IBM Observability with Instana missing authentication
Docker based datastores for IBM Instana IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0 do not currently require authentication. Due to this, an attacker within the network could access the datastores with read/write access. IBM X-Force ID: 248737...
PT-2023-2109 · Cisco · Cisco Unified Intelligence Center
Name of the Vulnerable Software and Affected Versions: Cisco Unified Intelligence Center affected versions not specified Description: The issue is related to the implementation of the application programming interface in the Cisco Unified Intelligence Center reporting tool, which lacks protection...
PT-2023-19794 · Misskey · Misskey
Name of the Vulnerable Software and Affected Versions: Misskey versions prior to 13.3.1 Description: The issue arises from insufficient validation of the redirect URL during miauth authentication, allowing arbitrary JavaScript execution when a user allows the link. This can be exploited when user...
CVE-2022-32570
Improper authentication in the IntelR Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege via local access...
CVE-2022-33946
Improper authentication in the IntelR SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalation of privilege via local access...
PT-2023-13326 · Intel · Intel Sur
Name of the Vulnerable Software and Affected Versions: IntelR SUR software versions prior to 2.4.8902 Description: The issue is related to improper authentication, which may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations: For versions...
PT-2023-13079 · Intel · Intel Quartus Prime Pro +1
Name of the Vulnerable Software and Affected Versions: IntelR Quartus Prime Pro and Standard edition software affected versions not specified Description: The issue is related to improper authentication, which may allow an authenticated user to potentially enable escalation of privilege via local...