WordPress ProfileGrid Plugin <= 5.0.3 is vulnerable to Broken Access Control

Software ProfileGrid Type Plugin Vulnerable versions = 5.0.3 Fixed in 5.0.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-36352 Patch priority High CVSS severity High 6.3 Developer Claim ownership PSID 97a93e8f05e7 Credits István Márton Required privileg...

PT-2023-35701 · Git +1 · Libxslt

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type known as Heap-double-free. The crash state involves several functions: xsltCompileStepPattern,...

PT-2023-1776 · Microsoft · Onedrive

Name of the Vulnerable Software and Affected Versions: Microsoft OneDrive for iOS affected versions not specified Description: The issue is related to a security feature bypass vulnerability in the file hosting service. It is associated with a lack of protection for service data. Exploitation of...

PT-2023-1765 · Microsoft · Onedrive

Name of the Vulnerable Software and Affected Versions: Microsoft OneDrive for Android affected versions not specified Description: The issue is related to insufficient protection of service data in the file hosting service. Exploitation of this issue may allow an attacker to gain unauthorized...

PT-2023-16204 · Akuvox · Akuvox E11

Name of the Vulnerable Software and Affected Versions: Akuvox E11 affected versions not specified Description: The issue concerns the Akuvox E11 password recovery webpage, which can be accessed without proper authentication. This allows an attacker to download the device key file and subsequently...

GSD-2023-1002376 net/sched: tcindex: update imperfect hash filters respecting rcu

net/sched: tcindex: update imperfect hash filters respecting rcu This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.169 by commit...

PT-2023-13267 · Qualcomm · Snapdragon +61

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to memory corruption due to improper validation of an array index in the Multi-mode call processor. No information is provided abou...

PT-2023-36063 · Git +1 · Opensc

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read crash. The crash state involves several functions: sc hsm write ef, sc hsm update binary, and sc upda...

PT-2023-35993 · Hdf5 · Hdf5

Name of the Vulnerable Software and Affected Versions: HDF5 affected versions not specified Description: A heap buffer overflow read issue has been identified. The crash state indicates involvement of the H5O fsinfo decode, H5O msg iterate real, and H5O msg remove real functions. Recommendations:...

SUSE CVE-2018-8088

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series...

SUSE CVE-2019-1010189

mgetty prior to version 1.2.1 is affected by: Infinite Loop. The impact is: DoS, the program does never terminates. The component is: g3/g32pbm.c. The attack vector is: Local, the user should open a specially crafted file. The fixed version is: 1.2.1...

SUSE CVE-2021-29618

TensorFlow is an end-to-end open source platform for machine learning. Passing a complex argument to tf.transpose at the same time as passing conjugate=True argument results in a crash. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFl...

SUSE CVE-2022-38150

In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend responses. An attack uses a crafted reason phrase of the backend response status line. This is fixed in 7.0.3 and 7.1.1...

CVE-2023-25567

GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the avpair is not checked properly for two of the elements which can trigger an out-of-bound read. The...

PT-2023-15673 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The IHwAttestationService interface has a defect in authentication. Successful exploitation of this issue may affect data confidentiality. There is no...

PT-2023-8970 · Qualcomm · Qualcomm

Name of the Vulnerable Software and Affected Versions: Qualcomm affected versions not specified Description: The issue is related to a buffer overflow in the memory of Qualcomm's embedded platform software, which can be exploited to execute arbitrary code. It is also described as memory corruptio...

PT-2023-15682 · Unknown · Ams Module

Name of the Vulnerable Software and Affected Versions: AMS module affected versions not specified Description: The issue is related to a lack of permission verification in APIs, which may impact data confidentiality. Recommendations: At the moment, there is no information about a newer version th...

PT-2023-3793 · NetGear · Netgear Prosafe Network Management System

Name of the Vulnerable Software and Affected Versions: NETGEAR ProSAFE Network Management System affected versions not specified Description: The issue is related to the SettingConfigController class in the NETGEAR ProSAFE Network Management System, which lacks an authorization procedure. This...

PT-2023-15244 · Unknown · Wlan Driver

Name of the Vulnerable Software and Affected Versions: WLAN driver affected versions not specified Description: The issue is related to a possible missing permission check in the WLAN driver, which could lead to local information disclosure. Recommendations: At the moment, there is no information...

PT-2023-1440 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge affected versions not specified Description: The issue is related to incorrect resource release in Microsoft Edge, allowing a remote attacker to cause a denial of service. Recommendations: At the moment, there is no information...