CVE-2023-3006

A known cache speculation vulnerability, the Branch History Injection BHI or Spectre-BHB, was found in new hw that are cores Cortex: A57, A72, A76, A77, A78, A78AE, A78C, A710, X1, X2; Neoverse: N1, N2, V1; Ampere1. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared...

CVE-2023-1336 RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'ajax_deactivate'

The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the ajaxdeactivate function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to...

PT-2023-1711 · Sap · Sap Netweaver Application Server For Abap/Abap Platform

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791 Description: The issue is related to a directory traversal flaw in an available service, allowing an...

K23605346: BIG-IP iControl REST vulnerability CVE-2022-1388

Security Advisory Description Undisclosed requests may bypass iControl REST authentication. CVE-2022-1388 Impact This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system...

Design/Logic Flaw

An issue in Mojoportal v2.7.0.0 allows an unauthenticated attacker to register a new user even if the Allow User Registrations feature is disabled...

PT-2023-12767 · Nokia · Nokia Asik Airscale

Name of the Vulnerable Software and Affected Versions: Nokia ASIK AirScale system module versions 474021A.101 through 474021A.102 Description: The bootloader in the Nokia ASIK AirScale system module loads public keys for firmware verification signature. If an attacker modifies the flash contents ...

CVE-2020-36564

Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid...

The vulnerability of the EndType parameter in the web interface of the POWER METER SICAM Q100 microprogramming system allows a hacker to disable the device (with subsequent automatic reboot) or execute arbitrary code.

The vulnerability of the EndType parameter in the web interface of the POWER METER SICAM Q100 measurement software is related to errors in processing input data. Exploiting this vulnerability can allow an attacker to disable the device remotely, causing it to shut down automatically, or execute...

The vulnerability of the “Language” parameter in the web interface of the POWER METER SICAM Q100 microprogramming system allows a hacker to disable the device (with subsequent automatic reboot) or execute arbitrary code.

The vulnerability of the “Language” parameter in the web interface of the POWER METER SICAM Q100 microprogramming system for power measurement devices is related to errors in processing input data. Exploiting this vulnerability can allow an attacker to disable the device remotely, causing it to...

The vulnerability of the RecordType parameter in the web interface of the POWER METER SICAM Q100 software allows a hacker to disable the device (with subsequent automatic reboot) or execute arbitrary code.

The vulnerability of the RecordType parameter in the web interface of the POWER METER SICAM Q100 measurement software is related to errors in processing input data. Exploiting this vulnerability can allow an attacker to disable the device remotely, causing it to shut down automatically, or execut...

Design/Logic Flaw

A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands capable of modifying zoning, disabling the switch, disabling ports, and modifying the switch IP...

PT-2022-25094 · Samsung · Exynos Baseband

Name of the Vulnerable Software and Affected Versions: Exynos baseband versions prior to SMR DEC-2022 Release 1 Description: The issue is related to improper authentication in the Exynos baseband, which allows a remote attacker to disable network traffic encryption between the User Equipment UE a...

CVE-2022-3564

A use-after-free flaw was found in the Linux kernel’s L2CAP bluetooth functionality in how a user triggers a race condition by two malicious flows in the L2CAP bluetooth packets. This flaw allows a local or bluetooth connection user to crash the system or potentially escalate privileges. Mitigati...

CVE-2022-42896

A use-after-free flaw was found in the Linux kernel's implementation of logical link control and adaptation protocol L2CAP, part of the Bluetooth stack in the l2capconnect and l2capleconnectreq functions. An attacker with physical access within the range of standard Bluetooth transmission could...

Design/Logic Flaw

A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary...

Contract LooksRareAggregator Ownership renouncement may leave a deficient smart contract in operation and there is no way to fix it

Lines of code Vulnerability details Impact LooksRareAggregator can renounce ownership and the system can still operate with already set parameters. However, many important functions cannot be called any more in this situation such as setFee, addFunction rescureERC721, rescueETH, etc. This means...

PT-2022-18504 · Sick · Sick Sim4000

Name of the Vulnerable Software and Affected Versions: SICK SIM4000 PPC Partnumber 1078787 versions =1.10.1 Description: A password recovery issue allows an unprivileged remote attacker to invoke the password recovery mechanism method, gaining access to the user level defined as...

CVE-2022-42488

OpenHarmony CVE-2022-42488 affects OpenHarmony versions 3.1.2 and earlier. The root cause is missing permission validation in the param service of the startup subsystem, which could let a malicious app elevate privileges to root, disable security features, or cause denial of service by stopping s...

OpenHarmony 安全漏洞

OpenHarmony is an open source project of the OpenAtom Foundation in China for a kind of Hongmeng operating system. A security vulnerability exists in OpenHarmony v3.1.2 and earlier versions, which stems from a lack of proper privilege validation in the parameter service of its boot subsystem that...

Linktree: A malicious admin can be able to permanently disable a Owner(Admin) to access his account

Ability to disable access to account While exploring the Multiple Admin feature in the application. I noticed a behavior that can lead to permanently disabling an Owner Admin to access his account...