Unisoc Chipsets 安全漏洞

UNISOC Chipsets are chipsets from China's Zilight Spreadtrum UNISOC. A security vulnerability exists in some Unisoc Chipsets, which stems from a lack of privilege checking. An attacker exploiting this vulnerability could disclose sensitive information. The following chipsets are affected: SC9863A...

Multiple vulnerabilities in FUJI ELECTRIC FRENIC RHC Loader

Overview FRENIC RHC Loader provided by FUJI ELECTRIC CO., LTD. contains multiple vulnerabilities listed below. Stack-based buffer overflow CWE-121 - CVE-2023-29160 Out-of-bounds read CWE-125 - CVE-2023-29167 Improper restriction of XML external entity reference CWE-611 - CVE-2023-29498 Michael...

Fuji Electric FRENIC RHC Loader 缓冲区错误漏洞

Fuji Electric FRENIC RHC Loader is a software tool developed by Fuji Electric Japan for debugging and monitoring inverters, mainly serving the industrial automation field. The Fuji Electric FRENIC RHC Loader suffers from an out-of-bounds read vulnerability, which can be exploited by an attacker t...

The vulnerability of Autofill interfaces in Google Chrome and Microsoft Edge browsers allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of Autofill interfaces in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information through a specially...

The vulnerability of the aiven-extras extension of the PostgreSQL database management system allows a hacker to gain superuser privileges, execute arbitrary code, and disclose sensitive information.

The vulnerability of the aiven-extras extension in the PostgreSQL database management system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain superuser privileges, execute arbitrary code, and disclose sensitive information...

Hackers Win $105,000 for Reporting Critical Security Flaws in Sonos One Speakers

Multiple security flaws uncovered in Sonos One wireless speakers could be potentially exploited to achieve information disclosure and remote code execution, the Zero Day Initiative ZDI said in a report published last week. The vulnerabilities were demonstrated by three different teams from Qrious...

Papaya Medical Viewer 1.0 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Title ===== SCHUTZWERK-SA-2022-001: Cross-Site-Scripting in Papaya Medical Viewer Status ====== PUBLISHED Version ======= 1.0 CVE reference ============= CVE-2023-33255 Link ==== https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2022-001/ Text-onl...

The vulnerability of the IOSurface component in MacOS operating systems allows attackers to disclose protected information.

The vulnerability of the IOSurface component in MacOS operating systems relates to reading data beyond the buffer boundaries within IOSurface. Exploiting this vulnerability can allow an attacker to disclose protected information...

The vulnerability of the web page rendering module in WebKit operating systems for iOS, iPadOS, watchOS, tvOS, and the Safari browser allows attackers to disclose protected information.

The vulnerability of the web page rendering module in WebKit operating systems for iOS, iPadOS, watchOS, tvOS, and the Safari browser is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information through a...

The vulnerability in the web interface of the Cisco Prime Collaboration Deployment software allows a attacker to disclose sensitive information, alter the appearance of the web page, and perform phishing attacks as well as “drive-down” attacks.

The vulnerability in the Cisco Prime Collaboration Deployment software’s web interface exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to disclose sensitive information, alter the appearance of the website, and perfor...

AZL-26792 CVE-2023-28322 affecting package curl for versions less than 8.0.1-2

An information disclosure vulnerability exists in curl v8.1.0 when doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request...

CVE-2023-33355

IceCMS v1.0.0 has Insecure Permissions. There is unauthorized access to the API, resulting in the disclosure of sensitive information...

PT-2023-24306 · Icecms · Icecms

Name of the Vulnerable Software and Affected Versions: IceCMS version 1.0.0 Description: The issue is related to Insecure Permissions, allowing unauthorized access to the API. This results in the disclosure of sensitive information. Recommendations: For IceCMS version 1.0.0, consider restricting...

CVE-2023-23299

The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious application with specially crafted code and data sections could access restricted CIQ modules, call their functions and disclose sensitive data...

Code injection

The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious application with specially crafted code and data sections could access restricted CIQ modules, call their functions and disclose sensitive data...

PT-2023-18893 · Garmin · Ciq Api +1

Name of the Vulnerable Software and Affected Versions: GarminOS TVM component in CIQ API versions 1.0.0 through 4.1.7 Description: The permission system implemented by the GarminOS TVM component can be bypassed entirely, allowing a malicious application with specially crafted code and data sectio...

CVE-2023-23304

The CVE-2023-23304 entry concerns GarminOS CIQ/TVM (Garmin Connect IQ): CIQ API versions 2.1.0 through 4.1.7 allow a specially crafted head section to access the Toybox.SensorHistory module without user consent, enabling a malicious app to call functions in that module and potentially disclose pr...

Schneider Electric PowerLogic 安全漏洞

Schneider Electric PowerLogic is an industrial control device from Schneider Electric, France. Provides increased power factor to improve power quality and troubleshoot power failures to protect networks, devices, and operators. A security vulnerability exists in the Schneider Electric PowerLogic...

CVE-2023-2716

The Groundhogg plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'ajaxuploadfile' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2022-45459

Sensitive information disclosure due to insecure registry permissions. The following products are affected: Acronis Agent Windows before build 30025, Acronis Cyber Protect 15 Windows before build 30984...