Ubuntu: Security Advisory (USN-6220-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-37839

An arbitrary file upload vulnerability in /dede/filemanagecontrol.php of DedeCMS v5.7.109 allows attackers to execute arbitrary code via uploading a crafted PHP file...

PT-2023-25876 · Autogpt · Autogpt

Name of the Vulnerable Software and Affected Versions: Auto-GPT versions prior to 0.4.3 Description: The issue arises from the use of a different docker-compose.yml file when running Auto-GPT by cloning the git repo and executing docker compose run auto-gpt in the repo root. This file mounts itse...

Kofax Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsin...

Siemens Tecnomatix Plant Simulation Heap Buffer Overflow Vulnerability

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany, that uses discrete-event simulation to analyze and optimize throughput and thereby improve manufacturing system performance. Siemens Tecnomatix Plant Simulation suffers from a heap buffer overflow...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability (CNVD-2023-56537)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany, that uses discrete-event simulation to analyze and optimize throughput and thereby improve manufacturing system performance. Siemens Tecnomatix Plant Simulation suffers from an out-of-bounds write...

Siemens Tecnomatix Plant Simulation Type Obfuscation Vulnerability

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany, that uses discrete-event simulation to analyze and optimize throughput and thereby improve manufacturing system performance. A type confusion vulnerability exists in Siemens Tecnomatix Plant Simulation, whi...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to multiple vulnerabilities in Python

Summary Potential vulnerabilities in Python have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. These vulnerabilities have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2021-28861 DESCRIPTION: Python could allow a...

KLA50777 ACE vulnerability in Mozilla Firefox

Use after free vulnerability was found in Mozilla Firefox. Malicious users can exploit this vulnerability to execute arbitrary code, cause denial of service. Original advisories MFSA2023-26 Related products Mozilla-Firefox CVE list CVE-2023-3600 critical Solution Update to the latest version...

CVE-2023-3607 kodbox WebConsole Plug-In webconsole.php.txt Execute os command injection

A vulnerability was found in kodbox 1.26. It has been declared as critical. This vulnerability affects the function Execute of the file webconsole.php.txt of the component WebConsole Plug-In. The manipulation leads to os command injection. The exploit has been disclosed to the public and may be...

CVE-2023-36665

A flaw was found in the protobuf.js. The affected versions of protobuf.js could allow a remote attacker to execute arbitrary code on the system caused by prototype pollution. By sending a specially crafted message, an attacker can execute arbitrary code on the system...

CVE-2021-42082 Local Privilege Escalation to root in OSNEXUS QuantaStor before 6.0.0.355

Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl 'localhost:8154/qstor/qsupgrade.py?taskId=1&a=;whoami'...

CVE-2021-42082

CVE-2021-42082 affects OSNEXUS QuantaStor prior to 6.0.0.355, enabling local users to escalate to root by executing scripts (e.g., via a crafted upgrade script). Evidence from CVE records and related sources confirms the affected product/version and local-privilege escalation impact, with a PoC s...

Milesight UR32L set_qos function buffer overflow vulnerability (CNVD-2023-65125)

The Milesight UR32L is a 4G industrial router from China's Milesight. A buffer overflow vulnerability exists in the Milesight UR32L setqos function, which can be exploited by an attacker to cause a buffer overflow and execute arbitrary code on the system, or cause an application to crash...

Milesight UR32L vtysh_ubus tcpdump_start_cb function command injection vulnerability

The Milesight UR32L is a 4G industrial router from China's Milesight. A command injection vulnerability exists in the Milesight UR32L vtyshubus tcpdumpstartcb function, which can be exploited by an attacker to execute arbitrary commands on the system...

Milesight UR32L libzebra.so change_hostname function command injection vulnerability

The Milesight UR32L is a 4G industrial router from China's Milesight. A command injection vulnerability exists in the Milesight UR32L libzebra.so changehostname function, which can be exploited by an attacker to execute arbitrary commands on the system...

Milesight UR32L set_qos function buffer overflow vulnerability (CNVD-2023-65482)

The Milesight UR32L is a 4G industrial router from China's Milesight. A buffer overflow vulnerability exists in the Milesight UR32L setqos function, which can be exploited by an attacker to cause a buffer overflow and execute arbitrary code on the system, or cause an application to crash...

Milesight UR32L set_dmvpn function buffer overflow vulnerability

The Milesight UR32L is a 4G industrial router from China's Milesight. A buffer overflow vulnerability exists in the Milesight UR32L setdmvpn function, which can be exploited by an attacker to execute arbitrary code...

PT-2023-25419 · Kodbox · Kodbox

Name of the Vulnerable Software and Affected Versions: kodbox version 1.26 Description: A critical issue affects the function Execute of the file webconsole.php.txt in the WebConsole Plug-In component, leading to os command injection. The exploit has been disclosed publicly and may be used. The...

Milesight UR32L vtysh_ubus toolsh_excute.constprop.1 Functional Command Injection Vulnerability

The Milesight UR32L is a 4G industrial router from China's Milesight. The Milesight UR32L vtyshubus toolshexcute.constprop.1 feature suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the system...