PTC KEPServerEX

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: PTC Equipment: KEPServerEX Vulnerability: Uncontrolled Resource Consumption 2. RISK EVALUATION Successful exploitation of this vulnerability could result in the affected device crashing. 3. TECHNICAL...

The vulnerability of the software platform for container deployment in the SUSE Rancher Wrangler production environment is related to insecure privilege management, allowing attackers to escalate their privileges.

The vulnerability of the software platform for container deployment in the SUSE Rancher production environment is related to insecure management of privileges. Exploiting this vulnerability could allow attackers to increase their privileges remotely...

CVE-2023-3897

Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message. This issue affects SureMDM On-premise: 6.31 and below version...

Information disclosure

Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message. This issue affects SureMDM On-premise: 6.31 and below version...

CVE-2023-3897

CVE-2023-3897 affects 42Gears SureMDM On-premise for Windows, version 6.31 and earlier. The root cause is CAPTCHA bypass that enables attacker to enumerate local usernames via error messages, leading to information disclosure. Impact is limited to credential/identity exposure as described in sour...

PT-2023-26709 · 42Gears · Suremdm

Name of the Vulnerable Software and Affected Versions: SureMDM On-premise versions 6.31 and below Description: The issue allows for username enumeration through bypassing CAPTCHA in the On-premise SureMDM Solution on Windows deployment. This enables an attacker to enumerate local user information...

OpenJDK: weakness in AES implementation (8308682)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2;...

[H] Address collisions due to lack of check on the salt parameter

Lines of code Vulnerability details Impact In ConstAddressDeployer, functions deploy and deployAndInit do not check for the same salt value being passed in by different users. This can lead to address collisions. If someone passes the same salt value as someone else, even with different bytecode...

OpenJDK: HTTP client insufficient file name validation (8302475)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle...

Docker Hub images found to expose secrets and private keys

Numerous Docker images shared on Docker Hub are exposing sensitive data, according to a study conducted by researchers at the German university RWTH Aachen. Needless to say, this poses a significant security risk. In traditional software development, programmers code an application in one computi...

Unauthorized Access Vulnerability in Damon's Big Data Analytics Platform

Wuhan Damon Database Co., Ltd. is specialized in providing big data platform architecture consulting, data technology solution planning, product deployment and implementation in one big data platform company. Unauthorized access vulnerability exists in Damon Big Data Analytics Platform, which can...

Weintek Weincloud

1. EXECUTIVE SUMMARY ​CVSS v3 7.5 ​ATTENTION: Exploitable remotely/low attack complexity ​Vendor: Weintek ​Equipment: Weincloud ​Vulnerabilities: Weak Password Recovery Mechanism for Forgotten Password, Improper Authentication, Improper Restriction of Excessive Authentication Attempts, Improper...

GE Digital CIMPLICITY

1. EXECUTIVE SUMMARY CVSS v3 6.6 ATTENTION: Low attack complexity Vendor: GE Digital Equipment: CIMPLICITY Vulnerability: Heap-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause memory corruption issues resulting in unwanted...

PT-2023-4053

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 11.0.19, 17.0.7, 20.0.1 Oracle GraalVM Enterprise Edition versions 20.3.10, 21.3.6, 22.3.2 Oracle GraalVM for JDK versions 17.0.7, 20.0.1 Description The issue is related to the Networking component of the affected...

EVERTZ 3080IPX 代码问题漏洞

EVERTZ 3080IPX is a web-based broadcast distribution solution from EVERTZ Corporation. A security vulnerability exists in the EVERTZ 3080IPX that stems from an arbitrary file upload vulnerability. An attacker can exploit this vulnerability to upload a webshell or overwrite arbitrary system files...

GHSA-F2WX-XJFW-XJV6 topgrade Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all

Summary https://github.com/advisories/GHSA-mc8h-8q98-g5hr https://github.com/XAMPPRocky/removedirall/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead tempfile v0.4.26 ships with affected removedirall v0.5.3 and so blocks my deployment of v12 to openSUSE distribution because it imposes a clean carg...

topgrade Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all

Summary https://github.com/advisories/GHSA-mc8h-8q98-g5hr https://github.com/XAMPPRocky/removedirall/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead tempfile v0.4.26 ships with affected removedirall v0.5.3 and so blocks my deployment of v12 to openSUSE distribution because it imposes a clean carg...

NSA, CISA Release Guidance on Security Considerations for 5G Network Slicing 

Today, the National Security Agency NSA and CISA published 5G Network Slicing: Security Considerations for Design, Deployment, and Maintenance. This guidance—created by the Enduring Security Framework ESF, a public-private cross-sector working group led by the NSA and CISA—presents recommendation...

PT-2023-33012 · Unknown +3 · Remove Dir All +3

Name of the Vulnerable Software and Affected Versions: tempfile versions prior to the version that updates remove dir all to a non-vulnerable version remove dir all version 0.5.3 Description: The issue concerns a problem with the remove dir all function. Updating tempfile is necessary due to its...

_deployCreate()/_deployCreate2() will not work on ZKSync Era

Lines of code Vulnerability details Bug Description In the contest's Scoping Details, the sponsor states that Universal Profiles might eventually be deployed across multiple chains: Is it multi-chain? LUKSO itself is not a multi-chain. The lsp-smart-contracts are initially intended to be used on...