CVE-2023-33355

IceCMS v1.0.0 has Insecure Permissions. There is unauthorized access to the API, resulting in the disclosure of sensitive information...

PT-2023-24306 · Icecms · Icecms

Name of the Vulnerable Software and Affected Versions: IceCMS version 1.0.0 Description: The issue is related to Insecure Permissions, allowing unauthorized access to the API. This results in the disclosure of sensitive information. Recommendations: For IceCMS version 1.0.0, consider restricting...

CVE-2023-23299

The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious application with specially crafted code and data sections could access restricted CIQ modules, call their functions and disclose sensitive data...

Code injection

The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious application with specially crafted code and data sections could access restricted CIQ modules, call their functions and disclose sensitive data...

CVE-2023-23304

The CVE-2023-23304 entry concerns GarminOS CIQ/TVM (Garmin Connect IQ): CIQ API versions 2.1.0 through 4.1.7 allow a specially crafted head section to access the Toybox.SensorHistory module without user consent, enabling a malicious app to call functions in that module and potentially disclose pr...

PT-2023-18893 · Garmin · Ciq Api +1

Name of the Vulnerable Software and Affected Versions: GarminOS TVM component in CIQ API versions 1.0.0 through 4.1.7 Description: The permission system implemented by the GarminOS TVM component can be bypassed entirely, allowing a malicious application with specially crafted code and data sectio...

Schneider Electric PowerLogic 安全漏洞

Schneider Electric PowerLogic is an industrial control device from Schneider Electric, France. Provides increased power factor to improve power quality and troubleshoot power failures to protect networks, devices, and operators. A security vulnerability exists in the Schneider Electric PowerLogic...

CVE-2023-2716

The Groundhogg plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'ajaxuploadfile' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2022-45459

Sensitive information disclosure due to insecure registry permissions. The following products are affected: Acronis Agent Windows before build 30025, Acronis Cyber Protect 15 Windows before build 30984...

CVE-2022-45450

Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Agent Linux, macOS, Windows before build 28610, Acronis Cyber Protect 15 Linux, macOS, Windows before build 30984...

CVE-2022-45458

Sensitive information disclosure and manipulation due to improper certification validation. The following products are affected: Acronis Agent Windows, macOS, Linux before build 29633, Acronis Cyber Protect 15 Windows, macOS, Linux before build 30984...

PT-2023-2903

Name of the Vulnerable Software and Affected Versions Apple WebKit versions prior to watchOS 9.5 Apple WebKit versions prior to tvOS 16.5 Apple WebKit versions prior to macOS Ventura 13.4 Apple WebKit versions prior to iOS 15.7.6 Apple WebKit versions prior to iPadOS 15.7.6 Apple WebKit versions...

Facebook Hermes 资源管理错误漏洞

Facebook Hermes is a JavaScript engine from Facebook Inc. in the United States. The engine is targeted at React Native applications to improve the performance of mobile client application apps, but not for server-side infrastructures such as browsers & Node.js. Facebook Hermes suffers from a...

Acronis Agent和Acronis Cyber Protect 信任管理问题漏洞

Acronis Agent and Acronis Cyber Protect are both products of Acronis Singapore.Acronis Agent is an agent software.Acronis Cyber Protect is an all-in-one cyber protection solution for business and enterprise. Combining backup, anti-malware, network security, and endpoint management capabilities su...

The vulnerability of the stbi__extend_receive function in the stb_image.h component of the C/C++ Libstb library allows a attacker to gain access to confidential data, compromise its integrity, and cause a service failure.

The vulnerability of the stbiextendreceive function in the stbimage.h component of the C/C++ Libstb library is related to writing beyond buffer boundaries. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause a service failure b...

CVE-2023-30510

A vulnerability exists in the Aruba EdgeConnect Enterprise web management interface that allows remote authenticated users to issue arbitrary URL requests from the Aruba EdgeConnect Enterprise instance. The impact of this vulnerability is limited to a subset of URLs which can result in the possib...

Authentication flaw

A vulnerability exists in the Aruba EdgeConnect Enterprise web management interface that allows remote authenticated users to issue arbitrary URL requests from the Aruba EdgeConnect Enterprise instance. The impact of this vulnerability is limited to a subset of URLs which can result in the possib...

CVE-2023-30510 Authenticated Server-side Request Forgery in Aruba EdgeConnect Enterprise Web Management Interface

A vulnerability exists in the Aruba EdgeConnect Enterprise web management interface that allows remote authenticated users to issue arbitrary URL requests from the Aruba EdgeConnect Enterprise instance. The impact of this vulnerability is limited to a subset of URLs which can result in the possib...

CVE-2023-30510 Authenticated Server-side Request Forgery in Aruba EdgeConnect Enterprise Web Management Interface

A vulnerability exists in the Aruba EdgeConnect Enterprise web management interface that allows remote authenticated users to issue arbitrary URL requests from the Aruba EdgeConnect Enterprise instance. The impact of this vulnerability is limited to a subset of URLs which can result in the possib...

webkitgtk: type confusion issue leading to arbitrary code execution

A vulnerability was found in webkitgtk, where a logic issue was addressed with improved state management. Processing maliciously crafted web content may disclose sensitive user information...