PT-2023-8558 · Sourcecodester · Simple Customer Relationship Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Customer Relationship Management System version 1.0 Description: The issue is related to the lack of protection against SQL query structure attacks in the php-scrm/login.php component of the Simple Customer Relationship...

Security Bulletin: The IBM FlashSystem 840 & IBM FlashSystem V840 products are affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVE-ID:CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerability ...

GHSA-32JC-9P58-P82X Moodle Improper Access Control vulnerability

The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality...

CVE-2023-0822

The affected product DIAEnergie versions prior to v1.9.03.001 contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality...

Authorization

The affected product DIAEnergie versions prior to v1.9.03.001 contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality...

CVE-2023-0822 Improper Authorization

The affected product DIAEnergie versions prior to v1.9.03.001 contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality...

CVE-2023-0822 Improper Authorization

The affected product DIAEnergie versions prior to v1.9.03.001 contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality...

PT-2023-16550 · Unknown · Diaenergie

Name of the Vulnerable Software and Affected Versions: DIAEnergie versions prior to v1.9.03.001 Description: The issue concerns improper authorization in the affected product, which could allow an unauthorized user to bypass authorization and access privileged functionality. Recommendations: For...

GHSA-3JFQ-742W-XG8J Users with any cluster secret update access may update out-of-bounds cluster secrets

Impact All Argo CD versions starting with v2.3.0-rc1 are vulnerable to an improper authorization bug which allows users who have the ability to update at least one cluster secret to update any cluster secret. The attacker could use this access to escalate privileges potentially controlling...

CVE-2023-20014

A vulnerability in the DNS functionality of Cisco Nexus Dashboard Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. This vulnerability is due to the improper processing of DNS requests. An attacker could exploit this vulnerability by sending a...

SUSE SLED15: curl / libcurl-devel / libcurl-devel-32bit / libcurl4 / etc (SUSE-SU-2023:0429-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0429-1 advisory. - CVE-2023-23914: Fixed HSTS ignored on multiple requests bsc1207990. - CVE-2023-23915: Fixed HS...

Internet Bug Bounty: CVE-2023-23914: HSTS ignored on multiple requests

Multiple requests made using curl's HSTS functionality ignored the HTTPS protocol and used an insecure clear-text HTTP step instead. This was due to the state not being properly carried on, allowing the bypass of intended security controls. The vulnerability was assigned CVE-2023-23914 and had a...

SUSE CVE-2004-1073

The openexec function in the execve functionality exec.c in Linux kernel 2.4.x up to 2.4.27, and 2.6.x up to 2.6.8, allows local users to read non-readable ELF binaries by using the interpreter PTINTERP functionality...

SUSE CVE-2018-1000205

U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validation that can result in Bypass verified boot. This attack appear to be exploitable via Specially crafted FIT image and special device memory functionality...

CVE-2022-47373

Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript...

CVE-2022-47373

Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript...

Cross site scripting

Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript...

SUSE CVE-2019-18905

A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to MITM connections when deprecated and unused functionality of autoyast is used to create images. This issue affects: SUSE Linux...

SUSE CVE-2021-41868

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality...

SUSE CVE-2022-22963

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources...