File upload vulnerability in mojoPortal

mojoPortal is a cross-platform object-oriented web framework . A file upload vulnerability exists in mojoPortal, which can be exploited by a remote attacker to submit a special request that can upload malicious files and execute arbitrary code in the context of the application...

RLSA-2023:4954 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.15.0. Security Fixes: Mozilla: Memory corruption in IPC CanvasTranslator CVE-2023-4573 Mozilla: Memory corruption in IPC ColorPickerShownCallback CVE-2023-4574 Mozilla: Memory corruption...

The vulnerability of the smb3_fs_context_parse_param() function in the fs/smb/client component of the Linux operating system allows a hacker to increase their privileges.

The vulnerability of the smb3fscontextparseparam function in the fs/smb/client component of the Linux operating system is related to the use of memory after it has been freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

Delta Electronics DIAEnergie HandlerUploadCarbon Use Of Hard-Coded Credentials Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Delta Electronics DIAEnergie. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of requests to the HandlerUploadCarbon endpoint. The issue...

CVE-2023-43799

Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the underlying system. Moreover, Altair GraphQL Client also does not isolate the context of the renderer process. This affects versions of the...

CVE-2023-43799 The Altair Desktop Client Does Not Sanitize External URLs before passing them to the underlying system

Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the underlying system. Moreover, Altair GraphQL Client also does not isolate the context of the renderer process. This affects versions of the...

PT-2023-28991 · Altair · Altair

Name of the Vulnerable Software and Affected Versions: Altair versions prior to 5.2.5 Description: The Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the underlying system and does not isolate the context of the renderer process. This issue affect...

PT-2023-6102 · D Link · D-Link D-View

Name of the Vulnerable Software and Affected Versions: D-Link D-View versions affected versions not specified Description: The issue is related to the addDv7Probe function and involves improper restriction of XML External Entity XXE references. This allows remote attackers to disclose sensitive...

(0Day) D-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exists within the coreserviceactionscript action. The issue results from the exposure of a dangerous...

(0Day) D-Link Multiple Routers cli Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1260 and DIR-2150 routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the CLI service, which listens on TCP port 23. The issue...

(0Day) D-Link DAP-1325 SetSetupWizardStatus Enabled Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issu...

(0Day) D-Link DAP-1325 SetAPLanSettings Gateway Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issu...

Cross Site Scripting (XSS)

github.com/golang/go is vulnerable to Cross Site Scripting XSS. The vulnerability is caused by a lack of proper handling of occurrences of context. This will make the template parser incorrectly conclude the script context resulting in XSS...

AZL-31730 CVE-2023-5345 affecting package hyperv-daemons for versions less than 5.15.135.1-1

A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in smb3fscontextparseparam, ctx-password was freed but the field was not set to NULL which could lead to double free. We recommend upgrading pas...

PT-2023-9158 · Qualcomm · Qualcomm Embedded Platform Graphics Driver

Name of the Vulnerable Software and Affected Versions: Qualcomm embedded platform graphics driver affected versions not specified Description: The issue is related to a memory corruption problem in the graphics driver when a context is destroyed with KGSL GPU AUX COMMAND TIMELINE objects queued...

context-denken.de Cross Site Scripting vulnerability OBB-3718761

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Design/Logic Flaw

A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitrary pipeline execution under the context of another user...

CVE-2023-5207 Execution with Unnecessary Privileges in GitLab

A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitrary pipeline execution under the context of another user...

CVE-2023-5207

Removed by vendor...

Apache CouchDB < 3.1.2 Privilege Escalation

According to its banner, the version of CouchDB running on the remote host is prior 3.1,2. It is, therefore, affected by a privilege escalation vulnerability. A malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin...