29153 matches found
CVE-2023-43955
CVE-2023-43955 affects the com.phlox.tvwebbrowser TV Bro Android app (version 2.0.0 and earlier). The root cause is mishandling of external intents via WebView, enabling an attacker to execute arbitrary code, create arbitrary files, and perform arbitrary downloads using JavaScript that calls take...
WordPress Download Monitor Plugin < 4.8.4 Arbitrary File Upload Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpchill:downloadmonitor"; if description...
CVE-2023-5991
The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server...
PT-2023-32464 · WordPress · Hotel Booking Lite
Name of the Vulnerable Software and Affected Versions: Hotel Booking Lite WordPress plugin versions prior to 4.8.5 Description: The issue arises from the plugin's failure to validate file paths provided via user input and its lack of proper CSRF and authorisation checks. This allows unauthenticat...
WordPress Ultimate Addons for Beaver Builder Plugin <= 1.35.13 is vulnerable to Arbitrary File Download
Software Ultimate Addons for Beaver Builder Type Plugin Vulnerable versions = 1.35.13 Fixed in 1.35.14 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2023-51401 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 8fb95010e714 Credits Rafi...
Arbitrary File Download Vulnerability in Electronic Document Security Management System of Beijing Yisetong Technology Development Co., Ltd (CNVD-2024-05347)
Electronic document security management system is a controllable authorization of electronic document security sharing management system, using real-time dynamic encryption and decryption protection technology and real-time rights recovery mechanism, to provide all kinds of electronic documents...
kylinos kylin-system-updater OS Command Injection Vulnerability
kylinos kylin-system-updater is an operating system component from China's KylinSoft kylinos. An operating system command injection vulnerability exists in KylinSoft kylin-system-updater 2.0.5.16-0k2.33 and earlier versions, which originates in /usr/share/kylin-system-...
GLSA-202312-11 : SABnzbd: Remote Code Execution
The remote host is affected by the vulnerability described in GLSA-202312-11 SABnzbd: Remote Code Execution - SABnzbd is an open source automated Usenet download tool. A design flaw was discovered in SABnzbd that could allow remote code execution. Manipulating the Parameters setting in the...
`bit-flags` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user alexrichton to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer...
CVE-2023-37519
Unauthenticated Stored Cross-Site Scripting XSS vulnerability. This XSS vulnerability is in the Download Status Report, which is served by the BigFix Server...
Cross site scripting
Unauthenticated Stored Cross-Site Scripting XSS vulnerability. This XSS vulnerability is in the Download Status Report, which is served by the BigFix Server...
CVE-2023-37519 HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)
Unauthenticated Stored Cross-Site Scripting XSS vulnerability. This XSS vulnerability is in the Download Status Report, which is served by the BigFix Server...
CVE-2023-37519 HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)
Unauthenticated Stored Cross-Site Scripting XSS vulnerability. This XSS vulnerability is in the Download Status Report, which is served by the BigFix Server...
Security Bulletin: AIX is affected by multiple vulnerabilities due to Python (CVE-2023-43804, CVE-2023-37920)
Summary Vulnerabilities in Python could allow a remote authenticated attacker to obtain sensitive information CVE-2023-43804. AIX's Python packaging also includes Certifi, which is vulnerable to CVE-2023-37920. Python is used by AIX as part of Ansible node management automation. Vulnerability...
PT-2023-26006 · Ibm · Bigfix Server
Name of the Vulnerable Software and Affected Versions: BigFix Server affected versions not specified Description: The issue is an Unauthenticated Stored Cross-Site Scripting XSS vulnerability. This vulnerability is located in the Download Status Report, which is served by the BigFix Server...
Security Bulletin: IBM® Db2® federated server is vulnerable to a denial of service when a specially crafted cursor is used. (CVE-2023-46167)
Summary IBM® Db2® federated server is vulnerable to a denial of service when a specially crafted cursor is used. Vulnerability Details CVEID:CVE-2023-46167 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server federated server is vulnerable to a denial of service when a...
Security Bulletin: IBM® Db2® could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. (CVE-2023-47701)
Summary IBM® Db2® could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. Vulnerability Details CVEID:CVE-2023-47701 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes Db2 Connect Server could allow an authenticated user with...
Security Bulletin: IBM® Db2® is vulnerable to denial of service with a specially crafted query. (CVE-2023-43020)
Summary IBM® Db2® is vulnerable to denial of service with a specially crafted query. Vulnerability Details CVEID:CVE-2023-43020 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to denial of service with a specially crafted query. CVSS Base score: 6.5 CVSS...
Security Bulletin: IBM® Db2® is vulnerable to privilege escalation with DATAACCESS. (CVE-2023-38003)
Summary IBM® Db2® could allow a user with DATAACCESS privileges to execute routines that they should not have access to. Vulnerability Details CVEID:CVE-2023-38003 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server could allow a user with DATAACCESS privileges to execute...
