CVE-2023-47261

Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync //gettingstarted request contains a connection string for privileged SQL Server database access, and xpcmdshell can be enabled...

CVE-2023-47261

Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync //gettingstarted request contains a connection string for privileged SQL Server database access, and xpcmdshell can be enabled...

Improper Certificate Validation

jruby-openssl is vulnerable to Improper Certificate Validation. The vulnerability is due to incorrect hashing of certificate names in X509Name.java and insufficient checking of certificate path lengths in StoreContext.java. This allows an attacker to trick the client application into believing th...

Slackware Linux 15.0 / current bluez Vulnerability (SSA:2023-348-01)

The version of bluez installed on the remote host is prior to 5.71. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-348-01 advisory. - Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connectio...

The vulnerability of the Internet Connection Sharing (ICS) function of the Windows operating system, which allows a hacker to cause a service failure

The vulnerability of the Internet Connection Sharing ICS function in the Windows operating system is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability of the Internet Connection Sharing (ICS) function of the Windows operating system, which allows a hacker to execute arbitrary code.

The vulnerability of the Internet Connection Sharing ICS function in the Windows operating system is related to insufficient checking of data entered by users. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

AlmaLinux 9 : containernetworking-plugins (ALSA-2023:7766)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:7766 advisory. - Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA...

PT-2023-30397 · Unknown · Dokmee Ecm

Name of the Vulnerable Software and Affected Versions: Dokmee ECM version 7.4.6 Description: The issue allows remote code execution due to the response to a "GettingStarted/SaveSQLConnectionAsync //gettingstarted" request containing a connection string for privileged SQL Server database access...

The vulnerability of the Internet Connection Sharing (ICS) function of the Windows operating system, which allows a hacker to execute arbitrary code.

The vulnerability of the Internet Connection Sharing ICS function in the Windows operating system is related to insufficient checking of data entered by users. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of embedded software developed by Qualcomm, related to insufficient validation of input data, allows attackers to trigger service failures.

The vulnerability of embedded Qualcomm software is related to insufficient validation of input data when receiving messages related to connection configuration from the RRC. Exploiting this vulnerability can allow a remote attacker to cause service failures...

CVE-2023-50779

Missing permission checks in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified token...

Siemens SCALANCE M-800/S615 Series OS Command Injection Vulnerability

The SCALANCE M-800, MUM-800 and S615 and the RUGGEDCOM RM1224 are industrial routers. An operating system command injection vulnerability exists in the Siemens SCALANCE M-800/S615 series, which can be exploited by an attacker to execute commands on the system via a malicious local administrator...

Microsoft Windows Multiple Vulnerabilities (KB5033369)

This host is missing an important security update according to Microsoft KB5033369 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Removing maintenance mode from hosting connection fails (after certificate thumbprint update)

After the SSL certificate is updated on vCenter, updated the cert SSL thumbprint on for DaaS using remote powershell SDK 2. We put the Hosting Conneciton in maintenance mode to achieve above. 3. Updated the certificates on Trusted People store of Cloud Connectors. 4. This causes all the catalogs...

Microsoft Windows Multiple Vulnerabilities (KB5033379)

This host is missing a critical security update according to Microsoft KB5033379 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Patch Tuesday, December 2023 Edition

The final Patch Tuesday of 2023 is upon us, with Microsoft Corp. today releasing fixes for a relatively small number of security holes in its Windows operating systems and other software. Even more unusual, there are no known "zero-day" threats targeting any of the vulnerabilities in Decembers...

Design/Logic Flaw

A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by modcluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because modproxycluster...

CVE-2023-5379

CVE-2023-5379 affects Undertow/AJP handling in Red Hat JBoss EAP, where an AJP request exceeding the max-header-size can cause mod_cluster to mark the backend as an error and close the TCP connection without an AJP response, enabling potential DoS via repeated oversized requests. The connected ad...

CVE-2023-5379

A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by modcluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because modproxycluster...

Patch Tuesday - December 2023

Microsoft is addressing 34 vulnerabilities this December Patch Tuesday, including a single zero-day vulnerability and three critical remote code execution RCE vulnerabilities. December Patch Tuesday has historically seen fewer patches than a typical month, and this trend continues in 2023. This...