GHSA-72HH-XF79-429P Pimcore SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt()

Summary User input passed directly into an SQL statement allows non-admin backend users to execute arbitrary SQL statements. Details The /admin/object/grid-proxy endpoint calls getFilterCondition on fields of classes to be filtered for at...

kernel: wifi: nl80211: fix NULL-ptr deref in offchan check

A flaw was found in the cfg80211 module in the Linux kernel. In Access Point AP mode, if a wireless link is created by userspace but not yet activated, it may contain an invalid channel definition with no channel. This issue may cause a NULL pointer dereference that results in a denial of service...

The vulnerability of the Marked compiler/analyzer, related to incorrect processing of regular expressions, allows a hacker to trigger a service failure.

The vulnerability of the marking analyzer and compiler is related to the incorrect processing of the regular expression block.def. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

SUSE CVE-2020-14867

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to...

The vulnerability of the StorageKit component in operating systems such as iPadOS, iOS, macOS, tvOS, and watchOS allows attackers to gain unauthorized access to protected information.

The vulnerability of the StorageKit component in iPadOS, iOS, macOS, tvOS, and watchOS is related to an improper definition of the link before accessing the file. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks

A flaw was found in the FasterXML/woodstox package. This flaw allows an attacker to cause a denial of service DoS in its target via XML serialization. An attacker may benefit from the parser sending a malicious input that may cause a crash. This vulnerability is only relevant for users using the...

Splunk 代码问题漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze data and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

PT-2023-26252 · Unknown · Spotcam Fhd 2

Name of the Vulnerable Software and Affected Versions: SpotCam FHD 2 affected versions not specified Description: The hidden Telnet function in SpotCam FHD 2 has a vulnerability of OS command injection. A remote unauthenticated attacker can exploit this vulnerability to execute command injection...

Can you enable HDX 3D Pro on Server VDA?

Need to enable HDX 3D Pro on Server VDA. Policy setting for 'Optimise for 3D Graphics Workload' is enabled - VeryHighDef Policy Template applied. -https://docs.citrix.com/en-us/citrix-daas/policies/policies-templates.html HDX Graphic Status Indicator on Published Desktops States 'HDX 3D Pro:...

AZL-27926 CVE-2023-32006 affecting package nodejs18 for versions less than 18.17.1-2

The use of module.constructor.createRequire can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note th...

CVE-2023-32006

The use of module.constructor.createRequire can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note th...

Node.js Security Vulnerabilities

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js versions 16.x, 18.x, and 20.x that stems from the ability to bypass the policy mechanism and define modules other than those given...

Vulnerability of the Server component: The DDL system for database management in MySQL, which allows a hacker to cause a service failure.

Vulnerability of the Server component: The DDL system for managing databases in MySQL is vulnerable to errors during the processing of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

DOS for Handling of crafted recursive ASN.1 structures

Constructed ASN.1 types with a recursive definition such as can be found in PKCS7 could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources, s...

Part I: Implementing Effective Cyber Security Metrics That Reduce Risk Realistically

As a CISO or business leader, some burning questions that often come to your mind are: How vulnerable is our cybersecurity posture? Are we better protected than we were three months or a year ago? Have our investments improved the cybersecurity posture and yielded any tangible benefits? Are my...

PT-2023-4055 · Mysql Server +7 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.33 and prior Description: The issue is related to errors in processing input data in the MySQL Server product, specifically in the Server: DDL component. This can be exploited by a high-privileged attacker with netwo...

OESA-2023-1414 kubernetes security update

Container cluster management. Security Fixes: Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are...

Arbitrary Code Injection

@backstage/plugin-scaffolder-backend is vulnerable to Arbitrary Code Injection. The vulnerability exists due to sandbox bypass in ScaffolderEntitiesProcessor.js, which allows an attacker with write access to a registered scaffolder template to inject code through the YAML template definition...

woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks

A flaw was found in the FasterXML/woodstox package. This flaw allows an attacker to cause a denial of service DoS in its target via XML serialization. An attacker may benefit from the parser sending a malicious input that may cause a crash. This vulnerability is only relevant for users using the...

CVE-2023-35926 Insecure sandbox in Backstage Scaffolder plugin

Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been vm2, but in light of several past vulnerabilities and...