CVE-2023-36808

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native...

UBUNTU-CVE-2023-36808

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native...

CVE-2023-36808 GLPI vulnerable to SQL injection through Computer Virtual Machine information

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native...

PT-2023-4273 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions 0.80 through 10.0.7 Description: The issue is related to a lack of protection against SQL injection attacks in the GLPI system, which manages IT assets and inventory. This can be exploited by a remote attacker to execute arbitra...

PT-2023-25713 · Unknown +1 · Uptime Kuma +1

Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.22.1 Description: The issue allows an authenticated attacker to install a maliciously crafted plugin, potentially leading to remote code execution. Uptime Kuma permits authenticated users to install plugins fro...

PT-2023-23220 · Diagon · Diagon

Name of the Vulnerable Software and Affected Versions: Diagon version 1.0.139 Description: An issue exists in the GraphPlanar::Write functionality of Diagon. A specially crafted input, such as a markdown file or a network request, can lead to memory corruption or a heap buffer overflow. This can ...

PT-2023-4241 · Tenda · Tenda F1203 +5

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 2.0 V15.03.06.23 Tenda AC7 version 1.0 V15.03.06.44 Tenda F1203 version 2.0.1.6 Tenda AC5 version 1.0 V15.03.06.28 Tenda FH1203 version 2.0.1.6 Tenda AC9 version 3.0 V15.03.06.42 multi Tenda FH1205 version 2.0.0.7775...

PT-2023-12517 · WordPress · Elasticpress

Name of the Vulnerable Software and Affected Versions: ElasticPress plugin for WordPress versions up to, and including, 3.5.3 Description: The issue is due to missing or incorrect nonce validation on the epio send autosuggest allowed function, making it possible for unauthenticated attackers to...

PT-2023-12514 · WordPress · Hm Multiple Roles

Name of the Vulnerable Software and Affected Versions: Multiple Roles plugin for WordPress versions up to, and including, 1.3.1 Description: The issue is due to missing or incorrect nonce validation on the mu add roles in signup meta and mu add roles in signup meta recently functions. This allows...

CVE-2023-30586

A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine API can be used to bypass...

CVE-2023-36812

OpenTSDB is a open source, distributed, scalable Time Series Database TSDB. OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in commit...

GHSA-76F7-9V52-V2FW Remote Code Execution for 2.4.1 and earlier

Impact OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. Patches Patched in 07c4641471c6f5c2ab5aab615969e97211eb50d9 and further refined in...

PT-2023-25703 · Opentsdb · Opentsdb

Name of the Vulnerable Software and Affected Versions: OpenTSDB versions prior to 2.4.2 Description: OpenTSDB is vulnerable to Remote Code Execution by writing user-controlled input to the Gnuplot configuration file and running Gnuplot with the generated configuration. The issue has been patched ...

PT-2023-25895 · Mediawiki +1 · Doublewiki Extension +2

Name of the Vulnerable Software and Affected Versions: MediaWiki DoubleWiki extension versions through 1.39.3 Description: An issue was discovered in the DoubleWiki extension for MediaWiki that allows XSS via the column alignment feature in includes/DoubleWiki.php. Recommendations: For MediaWiki...

PT-2023-4826 · Libtiff +7 · Libtiff +7

Name of the Vulnerable Software and Affected Versions: libtiff version 4.5.0 Description: The issue is caused by a buffer overflow on the stack in the uv encode function of the LibTIFF library. This can occur when the library reads a corrupted little-endian TIFF file and specifies the output to b...

PT-2023-25031 · Ikuai · Ikuai Router Os

Name of the Vulnerable Software and Affected Versions: Ikuai router OS versions through 3.7.1 Description: An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file. This issue allows for command injection, potentially leading to unauthorized access...

PT-2023-24976 · Telegram · Telegram

Name of the Vulnerable Software and Affected Versions: Telegram version 9.6.3 Description: The issue allows attackers to hide critical information on the User Interface by calling the function SFSafariViewController. This can potentially lead to users being unaware of important details...

CVE-2023-21190

In btmaclencryptchange of btmacl.cc, there is a possible way for a remote device to turn off encryption without resulting in a terminated connection due to an unusual root cause. This could lead to local information disclosure with no additional execution privileges needed. User interaction is...

CVE-2023-21176

In listkeyentries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...

CVE-2023-21147

In lwisi2cdevicedisable of lwisdevicei2c.c, there is a possible UAF due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID...