CVE-2023-27062

Tenda V15V1.0 was discovered to contain a buffer overflow vulnerability via the gotoUrl parameter in the formPortalAuth function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

The vulnerability of the TrueConf Server software, related to uncontrolled resource consumption, allows a intruder to cause a service failure.

The vulnerability of the TrueConf Server software is related to an uncontrolled consumption of resources. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service interruptions through a specially crafted HTTPS request...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a use-after-free vulnerability, which stems from the presence of a memory reuse-after-free problem that can cause a system crash. An attacker could...

Enhancesoft osTicket 跨站脚本漏洞

Enhancesoft osTicket is an open-source ticketing system from Enhancesoft, USA. A cross-site scripting vulnerability exists in Enhancesoft osTicket versions prior to 1.16.6, which stems from a reflective cross-site scripting XSS vulnerability. The vulnerability can be exploited by an attacker to...

UBUNTU-CVE-2023-1084

An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A malicious project Maintainer may create a Project Access Token with Owner level privileges using a crafted request...

PT-2023-16740 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 15.7.8 GitLab CE/EE versions 15.8.0 through 15.8.3 GitLab CE/EE versions 15.9.0 through 15.9.1 Description: A malicious project Maintainer may create a Project Access Token with Owner level privileges using a...

CVE-2023-1084

Removed by vendor...

Fortinet FortiOS和Fortinet FortiProxy 安全漏洞

Fortinet FortiOS and Fortinet FortiProxy are both products of Fortinet, Inc. Fortinet FortiOS is a dedicated security operating system on the FortiGate network security platform. The system provides users with a variety of security features such as firewall, antivirus, IPSec/SSLVPN, Web content...

The vulnerability of the microprogrammed software of Arris routers such as TG2482A, TG2492, and SBG10 allows a hacker to execute arbitrary code.

The vulnerability of the microprogrammed software of Arris routers such as TG2482A, TG2492, and SBG10 is related to errors in processing input data. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code by sending a specially crafted request...

The vulnerability in the web administration interface of the Pulse Connect Secure VPN server for corporate networks allows a perpetrator to execute arbitrary code.

The vulnerability in the web-based administration interface of the Pulse Connect Secure VPN server for corporate networks is related to insufficient cleaning of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted request...

GitLab 0.0 < 15.7.8 / 15.8 < 15.8.4 / 15.9 < 15.9.2 (CVE-2023-1084)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A malicious project...

jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos

A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service...

openstack-swift: Arbitrary file access through custom S3 XML entities

A flaw was found in Swift's S3 XML parser. By supplying specially crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This issue impacts both s3api...

CVE-2023-26253

A flaw was found in Gluster, where GlusterFS is vulnerable to a denial of service caused by a stack-based buffer over-read flaw in xlators/mount/fuse/src/fuse-bridge.c. A remote attacker can cause the application to crash by sending a specially-crafted request...

WP Social Bookmarking Light <= 2.0.7 - Cross-Site Request Forgery (CSRF)

The plugin does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in user to submit a crafted request...

CVE-2023-22636

An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow a local attacker to access confidential configuration files via a crafted http request...

Maspik – Spam blacklist < 0.7.9 - Cross-Site Request Forgery (CSRF)

The plugin does not protect some of its actions in the file /admin/partials/contact-forms-anti-spam-log.php against CSRF attacks, allowing an unauthenticated attacker to clear plugin logs and stat counter by tricking a logged in user to submit a crafted request...

WP Google Tag Manager <= 1.1 - Cross-Site Request Forgery (CSRF)

The plugin does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in administrator to submit a crafted request...

CVE-2021-33387

Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request...

K08250500: Nginx vulnerability CVE-2016-4450

Security Advisory Description os/unix/ngxfiles.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service NULL pointer dereference and worker process crash via a crafted request, involving writing a client request body to a temporary file. CVE-2016-4450...