Default configuration

vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a default serialization module but that has known security issues. All users of vantage6 that post tasks with the default serialization are affected. Version...

CVE-2023-44763

Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting XSS. NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file types, even though pdf is one of the...

Media Library Assistant Wordpress Plugin - RCE and LFI

Exploit Title: Media Library Assistant Wordpress Plugin - RCE and LFI Date: 2023/09/05 CVE: CVE-2023-4634 Exploit Author: Florent MONTEL / Patrowl.io / @Pepitoh / Twitter @Pepitooh Exploitation path: https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/ Exploit:...

CVE-2023-4568

PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch...

CVE-2023-4813

A flaw has been identified in glibc. In an uncommon situation, the gaihinet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with...

CVE-2023-40708

The File Transfer Protocol FTP port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files...

CVE-2023-4338

Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options Headers...

DEBIAN-CVE-2023-2905

Due to a failure in validating the length of a provided MQTTCMDPUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not...

PT-2023-4336 · Triangle Microworks · Scada Data Gateway

Name of the Vulnerable Software and Affected Versions: Triangle MicroWorks SCADA Data Gateway affected versions not specified Description: The issue is related to insufficient authentication procedures in the SCADA Data Gateway system, allowing remote attackers to bypass security restrictions and...

PT-2023-11450 · Microsoft · Powershell App Deployment Toolkit

Name of the Vulnerable Software and Affected Versions: PowerShell App Deployment Toolkit versions prior to 3.8.1 Description: The issue is related to an incorrect access control vulnerability in the default configuration, which may allow an authenticated user to potentially enable escalation of...

Default configuration

RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generat...

CVE-2023-37271

RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generat...

CVE-2023-36748

A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.16.0, RUGGEDCOM ROX MX5000RE All versions V2.16.0, RUGGEDCOM ROX RX1400 All versions V2.16.0, RUGGEDCOM ROX RX1500 All versions V2.16.0, RUGGEDCOM ROX RX1501 All versions V2.16.0, RUGGEDCOM ROX RX1510 All versions V2.16.0...

Default configuration

DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. An attacker can exploit this vulnerability by injecting, at the right times, spoofed Open Drone ID ODID messages which force the DroneScout ds230 Remote ID...

Default configuration

The MC990 X and UV300 RMC component has and inadequate default configuration that could be exploited to obtain enhanced privilege...

CVE-2023-30905

CVE-2023-30905 affects Hewlett Packard Enterprise MC990 X and UV300 RMC component due to an inadequate default configuration enabling privilege escalation. The vulnerability is described as local with low privileges required and high impact across confidentiality, integrity, and availability. Mul...

CVE-2023-30905

The MC990 X and UV300 RMC component has and inadequate default configuration that could be exploited to obtain enhanced privilege...

PT-2023-5464 · Rmc +2 · Rmc +2

Name of the Vulnerable Software and Affected Versions: MC990 X and UV300 affected versions not specified Description: The issue is related to an inadequate default configuration of the RMC component in the affected servers. This configuration flaw can be exploited by a remote attacker to gain...

Hewlett Packard Enterprise MC990 X和UV300 安全漏洞

The Hewlett Packard Enterprise MC990 X and the Hewlett Packard Enterprise UV300 are both products of Hewlett Packard Enterprise, Inc. The Hewlett Packard Enterprise MC990 X is a server and the Hewlett Packard Enterprise UV300 is a data storage device. A security vulnerability exists in the Hewlet...

CVE-2023-29129

A vulnerability has been identified in Mendix SAML Mendix 7 compatible All versions = V1.17.3 = V1.16.4 = V2.3.0 = V2.2.0 = V3.3.1 = V3.1.9 = V3.3.0 = V3.1.8 = V3.3.1 = V3.3.0 = V3.1.9 = V3.1.8 V3.2.6. The affected versions of the module insufficiently verify the SAML assertions. This could allow...