Design/Logic Flaw

Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log...

CVE-2023-48369 Log Flooding due to specially crafted requests in different endpoints

Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log...

CVE-2023-48369 Log Flooding due to specially crafted requests in different endpoints

Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log...

PT-2023-30799 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue allows an attacker to send specially crafted requests to different endpoints, potentially overflowing the log due to the lack of log size limitation of server logs...

Spring Boot server Web Observations DoS Vulnerability

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true:...

PT-2023-7527 · Squid +10 · Squid +11

Name of the Vulnerable Software and Affected Versions: Squid versions prior to 6.5 Description: The issue is related to a Buffer Overread bug in Squid, which can be exploited by a remote attacker to cause a Denial of Service DoS attack against Squid HTTP Message processing. This can be achieved b...

Vulnerability of the proxy_run_coroutine() function (proto_proxy.c) of the memcached data caching software, which allows a hacker to cause a service failure

The vulnerability of the proxyruncoroutine function protoproxy.c in the memcached data caching software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to cause service failures through a specially crafted HTTP request...

CVE-2023-47392

An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the carts of other users via sending a crafted add order request...

The vulnerability of Fortinet FortiWLM, a centralized management system for WLAN access points and LAN switches, arises from errors in processing the relative path to the catalog. This allows attackers to read arbitrary files.

The vulnerability of Fortinet FortiWLM, a centralized management system for WLAN access points and LAN switches, is related to errors in processing the relative path to the catalog. Exploiting this vulnerability allows an attacker, operating remotely, to read arbitrary files using specially creat...

The vulnerability of the Hyper-V hardware virtualization system for Windows operating systems allows attackers to escalate their privileges.

The vulnerability of the Hyper-V hardware virtualization technology for Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges by sending specially crafted requests...

CVE-2023-25603

A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an unauthorized attacker to carry out privileged actions and retrieve sensitive information via crafted web requests...

CVE-2023-36633

An improper authorization vulnerability CWE-285 in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and modify the title of address book folders of other users via crafted HTTP or HTTPs requests...

PT-2023-7756 · Fortinet · Fortiwan

Name of the Vulnerable Software and Affected Versions: FortiWAN versions 5.1.1 through 5.1.2 FortiWAN versions 5.2.0 through 5.2.1 Description: The issue is related to improper authentication in FortiWAN, stemming from the use of a static key when handling JWT tokens. This can be exploited by a...

SuiteCRM 安全漏洞

SuiteCRM is a customer relationship management system from the SuiteCRM team. SuiteCRM suffers from a path traversal vulnerability that stems from the program failing to properly filter for specific elements in the path of a resource or file. An attacker could exploit this vulnerability to retrie...

PT-2023-6911 · Microsoft · Windows Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V affected versions not specified Description: The issue is related to insufficient access controls in the Windows Hyper-V hardware virtualization system, allowing an attacker to potentially elevate their privileges by sending...

Hanwha Vision ANO-L6012R Security Vulnerability

Hanwha Vision Camera is a series of cameras from Hanwha Vision, a South Korean company. A security vulnerability exists in Hanwha Vision ANO-L6012R, which originates from allowing injection of authenticated commands on the camera, and can be exploited by an attacker to inject malicious code into ...

The vulnerability of FortiWeb web applications’ network firewalls arises from incorrect pathname restrictions for access to restricted catalogs. This allows attackers to disclose protected information.

The vulnerability of FortiWeb web applications’ network firewalls exists due to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability can allow a malicious actor to disclose protected information through specially crafted web requests...

PT-2023-9546 · Cisco · Cisco Small Business Rv042G +3

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV042, RV042G, RV320, and RV325 Routers affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated, Administrator-level, remote attacker to execute...

PT-2023-9504 · Cisco · Cisco Small Business Rv042G +3

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV042, RV042G, RV320, and RV325 Routers affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated, Administrator-level, remote attacker to cause an...

PT-2023-9616 · Cisco · Rv320 +3

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV042, RV042G, RV320, and RV325 Routers affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated, Administrator-level, remote attacker to cause an...