PT-2023-20748 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue concerns an unauthenticated SQL injection in the GetVisitors method, allowing unauthenticated attackers to extract or modify all data. Recommendations: For versions 3.1.052...

Rockwell Automation Stratix 5800 and Stratix 5200 (UPDATE A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION : Exploitable remotely/low attack complexity/known public exploitation Vendor : Rockwell Automation Equipment : Stratix 5800 and Stratix 5200 Vulnerabilities : Unprotected Alternate Channel, OS Command Injection 2. RISK EVALUATION Successful...

CVE-2023-43663

PrestaShop vulnerability CVE-2023-43663 affects PrestaShop core where, in affected versions, any module can be disabled or uninstalled from the back office—even by users with low privileges. The issue enables low-privilege users to disable portions of shop functionality, indicating an improper pr...

PT-2023-29141 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 12.9 Description: The issue is related to an arbitrary file write vulnerability. This vulnerability is present in the admin ping.php component. Recommendations: For SeaCMS version 12.9, consider disabling access to the admin...

Impact of removing vs. disabling Chrome in Android

Understand the distinction between removing and disabling Chrome on Android devices using Citrix Endpoint Management...

CVE-2023-38688

twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including...

PT-2023-26736 · Duke · Duke

Name of the Vulnerable Software and Affected Versions: Duke versions 1.2 and below Description: The issue is related to a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.init. Recommendations: For Duke versions 1.2 and below, consider disabling the...

CVE-2023-37895 Apache Jackrabbit RMI access can lead to RCE

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to including 2.20.10 stable branch and 2.21.17 unstable branch use the component "commons-beanutils", which contains a class that can be used for remote...

CVE-2023-37895

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to including 2.20.10 stable branch and 2.21.17 unstable branch use the component "commons-beanutils", which contains a class that can be used for remote...

CVE-2023-37895 Apache Jackrabbit RMI access can lead to RCE

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to including 2.20.10 stable branch and 2.21.17 unstable branch use the component "commons-beanutils", which contains a class that can be used for remote...

PT-2023-6730

Name of the Vulnerable Software and Affected Versions Open Babel versions 3.1.1 and prior Description The issue is related to an out-of-bounds write vulnerability in the translationVectors parsing functionality of Open Babel, which can be exploited by a remote attacker using a specially crafted...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker due to the module xml2js (CVE-2023-0842)

Summary IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker due to the module xml2js CVE-2023-0842. The latest Fix Pack includes xml2js version 5.0 Vulnerability Details CVEID:CVE-2023-0842 DESCRIPTION: xml2js could allow a remote attacker to execute arbitrary...

Medtronic Paceart Optima System

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Medtronic Equipment: Paceart Optima System Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could result in remote code execution or a...

Security Bulletin: Vulnerabilities in Samba shipped with IBM OS Image for Red Hat Enterprise Linux System (CVE-2022-32742)

Summary Vulnerabilities have been found in Samba shipped with IBM OS Image for Red Hat Enterprise Linux System Vulnerability Details CVEID:CVE-2022-32742 DESCRIPTION: Samba could allow a remote authenticated attacker to obtain sensitive information, caused by a memory leak when handling SMB1...

PT-2023-6434 · Adobe · Acrobat Reader +1

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader versions 23.001.20093 and earlier Adobe Acrobat Reader versions 20.005.30441 and earlier Adobe Acrobat 2020 Adobe Acrobat Reader 2020 Description: The issue is related to a Use After Free vulnerability that could result i...

CVE-2020-10134

A flaw was discovered in the Bluetooth protocol affecting the Bluetooth LE Secure Connections pairing and the BR/EDR Secure Simple Pairing. An attacker with physical access to the Bluetooth connection could perform a man-in-the-middle attack between two devices using the Numeric Comparison and...

CVE-2023-1582

A race problem was found in fs/proc/taskmmu.c in the memory management sub-component in the Linux kernel. This issue may allow a local attacker with user privilege to cause a denial of service. Mitigation This flaw can be mitigated by disabling THP on the system. How to disable THP ?...

IDOR Vulnerability Allow the owner of one Organization can disable users that belong to other oggainzation

1 first, we create two organizations: org1 and org2. The owner of them is user1 and user2 corresponding. 2 we login as user1 and click disable , then we use burpsuit to get the post. 3 The post can be like : POST /admin/api/users/2/enable/false HTTP/1.1 5 we replace user id 2 to 3. 6 check the...

Disabling self-transfer may cause integration issues with other protocols

Lines of code Vulnerability details Impact Integration errors with other protocols Proof of Concept The changes made for H-01 causes transfers to revert if from == to. This is problematic because this is non-standard ERC20 behavior that can cause integration risk/issues with other protocols. I...

CVE-2023-0811

Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII...