CVE-2023-37551 CODESYS Files or Directories Accessible to External Parties in CmpApp

In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfe...

CVE-2023-37551 CODESYS Files or Directories Accessible to External Parties in CmpApp

In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfe...

CVE-2023-37551

The CVE-2023-37551 issue affects Codesys products where, after user authentication, crafted requests can use the CmpApp component to download files with arbitrary extensions to the controller, bypassing type filtering and potentially compromising the CODESYS Runtime integrity. The attack paths de...

CVE-2023-37550

CVE-2023-37550 affects multiple Codesys products; after successful user authentication, crafted network requests can cause the CmpApp component to read from an invalid address, potentially causing a denial-of-service. CVSSv3.1 base score 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No explicit reme...

CVE-2023-37548

CVE-2023-37548 affects multiple Codesys products; after successful user authentication, crafted network requests with inconsistent content can cause the CmpApp component to read from an invalid address, potentially leading to a denial-of-service. Root cause: improper handling of crafted input in ...

CVE-2023-37547

CVE-2023-37547 affects multiple Codesys products using the Codesys Runtime System. After successful user authentication, crafted network requests with inconsistent content can cause CmpApp to read from an invalid address, potentially resulting in a denial-of-service. The description also referenc...

CVE-2023-37545

CVE-2023-37545 affects multiple Codesys products; after successful user authentication, crafted network requests can make CmpApp read from an invalid address, potentially causing a denial-of-service. No connected documents provide concrete version/product remediation details in this dataset.

CVE-2023-4116 PHP Jabbers Taxi Booking index.php cross site scripting

A vulnerability classified as problematic was found in PHP Jabbers Taxi Booking 2.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be launched remotely. The associated...

CVE-2023-26979

Bluetens Electrostimulation Device BluetensQ device app version 4.3.15 is vulnerable to Man-in-the-middle attacks in the BLE channel. It allows attackers to decrease or increase the intensity of the stimulator by hijacking the BLE communication...

CVE-2023-26979

Bluetens Electrostimulation Device BluetensQ device app version 4.3.15 is vulnerable to Man-in-the-middle attacks in the BLE channel. It allows attackers to decrease or increase the intensity of the stimulator by hijacking the BLE communication...

SUSE-SU-2023:3153-1 Security update for the Linux Kernel RT (Live Patch 0 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-15050011 fixes several issues. The following security issues were fixed: - - CVE-2023-33952: Fixed a vmwgfx Driver Double Free Local Privilege Escalation Vulnerability bsc1212348. - CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code...

Malicious code in auto-assign-team-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4d5eebeeaf5ef87c0a419e6e3716aa1a1046926c3d90905b645d03a46be860b0 The OpenSSF Package Analysis project identified 'auto-assign-team-action' @ 2000.0.0 npm as malicious. It is considered malicious because: - The...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a code execution vulnerability that is due to free usage in WebRTC. An attacker can exploit the vulnerability to execute arbitrary code on a system or cause an application to crash...

SUSE SLES12 Security Update : kernel (Live Patch 34 for SLE 12 SP5) (SUSE-SU-2023:3104-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3104-1 advisory. This update for the Linux Kernel 4.12.14-122130 fixes several issues. The following security issues were fixed: - CVE-2023-3159: Fixed...

EulerOS Virtualization 2.10.0 : kernel (EulerOS-SA-2023-2560)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in tableclear in...

SUSE SLES15 Security Update : kernel (Live Patch 30 for SLE 15 SP2) (SUSE-SU-2023:3107-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3107-1 advisory. This update for the Linux Kernel 5.3.18-15020024129 fixes several issues. The following security issues were fixed: - CVE-2023-35788: Fixed an...

Moxa ioLogik 2542-HSPA Series Controllers and IOs, and IOxpress Configuration Utility Incorrectly Specified Destination in a Communication Channel (CVE-2019-18242)

In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, frequent and multiple requests for short-term use may cause the web server to fail. This plugin only works with Tenable.ot. Please visit...

DEBIAN-CVE-2023-3727

Use after free in WebRTC in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

SUSE-SU-2023:3116-1 Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-15050053 fixes several issues. The following security issues were fixed: - - CVE-2023-33952: Fixed a vmwgfx Driver Double Free Local Privilege Escalation Vulnerability bsc1212348. - CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code...

SUSE-SU-2023:3111-1 Security update for the Linux Kernel (Live Patch 26 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059101 fixes several issues. The following security issues were fixed: - CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via TCAFLOWERKEYENCOPTSGENEVE packets in flsetgeneveopt in net/sched/clsflower.c bsc1212509. -...