CVE-2023-20068

A vulnerability in the web-based management interface of Cisco Prime Infrastructure Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface on an affected device. This vulnerability is due to insufficient...

Cisco Small Business 跨站脚本漏洞

Cisco Small Business is a switch from Cisco USA. A security vulnerability exists in the Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325, which stems from insufficient validation of inputs to the web-based management interface...

WiFi Flaws Allow Network Traffic Interception on Linux, iOS, and Android

By Deeba Ahmed The findings are to be presented at the Usenix Security Symposium. This is a post from HackRead.com Read the original post: WiFi Flaws Allow Network Traffic Interception on Linux, iOS, and Android...

The vulnerability of the OneDrive file sharing service, related to deficiencies in access control, allows attackers to escalate their privileges.

The vulnerability of the OneDrive for Windows file sharing service is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges through a specially created application...

Apple's iOS 16.4: Security Updates Are Better Than New Emoji

Plus: Microsoft Outlook and Android patch serious flaws, Chrome and Firefox get fixes, and much more...

The vulnerability in the web browser Epiphany, related to access control deficiencies, allows attackers to disclose protected information.

The vulnerability of the Web browser Epiphany is related to access control deficiencies. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose protected information...

The vulnerability of Merten KNX programmable logic controllers is related to deficiencies in authentication procedures, allowing attackers to gain access to the devices.

The vulnerability of Merten KNX programmable logic controllers is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the device...

The vulnerability of TP-Link MR3020 router’s microprogramming software, related to the lack of measures taken to clean data at the control level, allows attackers to execute arbitrary commands.

The vulnerability of TP-Link MR3020 router’s microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by sending a specially crafted tftp request to the destination...

The vulnerability of the index.php script of the PHP Xextplorer file manager allows a hacker to execute arbitrary code.

The vulnerability of the index.php script of the PHP Xextplorer file manager is related to deficiencies in access control. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

The vulnerability of the memcached data caching service provided by the libmemcached-awesome library allows a hacker to gain unauthorized access to protected information.

The vulnerability of the memcached data caching service provided by the libmemcached-awesome library is related to insufficient protection of operational data when processing the POLLTIMEOUT parameter, which controls the wait time for requests. Exploiting this vulnerability can allow an attacker ...

Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5978-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5978-1 advisory. It was discovered that the Traffic-Control Index TCINDEX implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker...

The vulnerability of the Mozilla Firefox browser, related to deficiencies in access control, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Mozilla Firefox browser is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information when a specially crafted document is opened in the browser...

The vulnerability of the client request handler of the security access control system, IED Siemens RUGGEDCOM CROSSBOW, allows a perpetrator to perform arbitrary actions.

The vulnerability of the client request handler of the Siemens RUGGEDCOM CROSSBOW access control system is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions remotely...

The vulnerability of the administration interface of the Fortinet FortiSOAR software for coordinating the operation of cybersecurity systems and for managing real-time incident responses allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the administration interface of the software for coordinating the operation of cybersecurity systems and for managing incident responses in real-time with Fortinet FortiSOAR is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker,...

Medium: systemd

Issue Overview: A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp. CVE-2021-3997 A vulnerability was found in systemd. This security flaw can cause a local information leak d...

Important: samba

Issue Overview: A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required. CVE-2016-2124 It was found that the Kerberos Key Distribution Center KDC delegatio...

The vulnerability of the monitoring system for critical equipment, StruxureWare Data Center Expert, is related to deficiencies in authentication procedures. This allows unauthorized users to perform unauthorized functions, modify or delete arbitrary content.

The vulnerability of the StruxureWare Data Center Expert monitoring system is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to perform unauthorized functions, modify or delete arbitrary content...

Important: libtiff

Issue Overview: A flaw was found in libtiff where a NULL source pointer passed as an argument to the memcpy function within the TIFFFetchStripThing in tifdirread.c. This flaw allows an attacker with a crafted TIFF file to exploit this flaw, causing a crash and leading to a denial of service...

Important: libXpm

Issue Overview: A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. CVE-2022-44617 A flaw was found ...

Medium: libarchive

Issue Overview: An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extra...