Medium: git

Issue Overview: Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to git apply --reject, a path outside the working tree can be overwritten with partially controlled...

WordPress plugin Go Pricing - WordPress Responsive Pricing Tables 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Go Pricing -...

CVE-2023-28386

Snap One OvrC Pro devices versions 7.2 and prior do not validate firmware updates correctly. The device only calculates the MD5 hash of the firmware and does not check using a private-public key mechanism. The lack of complete PKI system firmware signature could allow attackers to upload arbitrar...

CVE-2023-32347

Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify devices from the user perspective for device claiming and from the device perspective for authentication. If an attacker obtained the serial number and MAC address of a device, th...

PT-2023-23418 · Wcms · Wcms

Name of the Vulnerable Software and Affected Versions: Wcms version 0.3.2 Description: The issue allows an attacker to send a crafted request from a vulnerable web application backend server via the "finish" parameter and the textAreaCode parameter in the "/wcms/wex/html.php" endpoint. This enabl...

PT-2023-8729 · Apache · Apache Inlong

Name of the Vulnerable Software and Affected Versions: Apache InLong versions 1.4.0 through 1.6.0 Description: The issue is related to the deserialization of untrusted data, which allows attackers to bypass the autoDeserialize option filtering by adding blanks. This can potentially lead to the...

CVE-2023-30505

Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the...

CVE-2023-31576

An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript file...

PT-2023-19860 · Autodesk · Autodesk 3Ds Max

Name of the Vulnerable Software and Affected Versions: Autodesk 3DS Max affected versions not specified Description: A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer, which could result in code execution. Recommendations: At the moment,...

CVE-2023-31155

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller SEL RTAC Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code. See SEL...

CVE-2023-30619 XSS in the tooltip via an artifact title

Tuleap Open ALM is a Libre and Open Source tool for end to end traceability of application and system developments. The title of an artifact is not properly escaped in the tooltip. A malicious user with the capability to create an artifact or to edit a field title could force victim to execute...

Vulnerability fixed in Dradis Pro

Dradis has fixed a vulnerability in Dradis Pro. A malicious party could exploit the vulnerability to perform a cross-site scripting attack. Such an attack can lead to execution of arbitrary code in the context of the browser of the victim, or access sensitive data within that same context of the...

MGASA-2023-0150 Updated squirrel/supertux packages fix security vulnerability

sqclass.cpp in Squirrel 3.1 allows an out-of-bounds read in the core interpreter that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as Fi...

CVE-2023-0200

NVIDIA DGX-2 contains a vulnerability in OFBD where a user with high privileges and a pre-conditioned heap can cause an access beyond a buffers end, which may lead to code execution, escalation of privileges, denial of service, and information disclosure...

PT-2023-16079 · Nvidia · Nvidia Dgx-2

Name of the Vulnerable Software and Affected Versions: NVIDIA DGX-2 affected versions not specified Description: The issue is related to a vulnerability in OFBD where a user with high privileges and a pre-conditioned heap can cause an access beyond a buffer's end. This may lead to code execution,...

PT-2023-16080 · Nvidia · Nvidia Dgx-2 Sbios

Name of the Vulnerable Software and Affected Versions: NVIDIA DGX-2 SBIOS affected versions not specified Description: The issue is related to a vulnerability in Bds, where a user with high privileges can cause a write beyond the bounds of an indexable resource. This may lead to code execution,...

CVE-2023-23579 Datakit CrossCAD/Ware

Datakit CrossCadWarex64.dll contains an out-of-bounds write past the end of an allocated buffer while parsing a specially crafted SLDPRT file. This could allow an attacker to execute code in the context of the current process...

USN-6028-1 libxml2 vulnerabilities

It was discovered that lixml2 incorrectly handled certain XML files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. CVE-2023-28484 It was discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to cause a cras...

CVE-2023-27907

A malicious actor may convince a victim to open a malicious USD file that may trigger an out-of-bounds write vulnerability which may result in code execution...

Adobe Dimension out-of-bounds write vulnerability (CNVD-2023-31286)

Adobe Dimension is the United States of America Odo than Adobe company is a set of 2D and 3D composite design tools. An out-of-bounds write vulnerability exists in Adobe Dimension 3.4.8 and earlier versions, which can be exploited by an attacker to cause arbitrary code to be executed in the curre...