PT-2023-20831 · Prestashop · Prestashop Igbudget

Name of the Vulnerable Software and Affected Versions: PrestaShop Igbudget versions 1.0.3 and earlier Description: A SQL injection issue allows a remote attacker to gain privileges via the LgBudgetBudgetModuleFrontController::displayAjaxGenerateBudget component. This enables the attacker to...

CVE-2023-1260

An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch...

CVE-2023-25355

CoreDial sipXcom up to and including 21.04 is vulnerable to Insecure Permissions. A user who has the ability to run commands as the daemon user on a sipXcom server can overwrite a service file, and escalate their privileges to root...

PT-2023-11574 · Phpmywind · Phpmywind

Name of the Vulnerable Software and Affected Versions: PHPMyWind version 5.6 Description: A SQL injection issue allows a remote attacker to gain privileges via the delete function of the administrator management page. Recommendations: For PHPMyWind version 5.6, update to a version that includes a...

Zoom clients 安全漏洞

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. A security vulnerability exists in Zoom clients versions prior to 5.13.5 that stems from the inclusion of an incorrect trust boundary implementation vulnerability. An attacker could use this...

PrestaShop SQL注入漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, SMS alerts and product image scaling and other features. A security vulnerability exists in PrestaShop xipblog version v.2.0.1 and earlier versions, whi...

CVE-2023-26864

SQL injection vulnerability found in PrestaShop smplredirectionsmanager v.1.1.19 and before allow a remote attacker to gain privileges via the SmplTools::getMatchingRedirectionsFromPartscomponent...

KLA48686 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, gain privileges. Below is a complete list of vulnerabilities: 1. Out of bounds read vulnerability in ANGLE can be exploited to cause deni...

Input validation

A vulnerability in Cisco access points AP software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges. This vulnerability is due to improper input validation of commands that are issued from a wireless controller to an AP. An attacker...

Advisory ROSA-SA-2023-2133

Software: java-11-openjdk 11.0.18.0.10-1 OS: rosa-server79 packageevrstring: java-11-openjdk-11.0.18.0.10-1 CVE-ID: CVE-2021-2161 BDU-ID: 2021-02490 CVE-Crit: MEDIUM CVE-DESC: A vulnerability in the Libraries component of the Java SE, Java SE Embedded, and Oracle GraalVM Enterprise Edition softwa...

Tridium Niagara Improper Authorization (CVE-2019-13528)

A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 JACE 3e, JACE 6e, JACE 7, JACE-8000, Niagara 4.4u3 JACE 3e, JACE 6e, JACE 7, JACE-8000, and Niagara 4.7u1 JACE-8000, Edge 10. This plugin only works with Tenable.ot. Please visit...

CVE-2022-48422

ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgccs.so.1 in the current working directory, which may be any directory in which an ONLYOFFICE document is located...

Does Your Help Desk Know Who's Calling?

Phishing, the theft of users' credentials or sensitive data using social engineering, has been a significant threat since the early days of the internet – and continues to plague organizations today, accounting for more than 30% of all known breaches. And with the mass migration to remote working...

Actors, Threats and Vulnerabilities 27 February to 5 March 2023

For a detailed threat digest, download the pdf file here Summary For a detailed threat digest, download the pdf file here HiveForce Labs discovered six actors that have been active in the past week. TA866, APT-C-61, and DEV-0569 are cybercrime groups that focus on Financial gain. The other three...

K54606234: Linux kernel vulnerability CVE-2016-10150

Security Advisory Description Use-after-free vulnerability in the kvmioctlcreatedevice function in virt/kvm/kvmmain.c in the Linux kernel before 4.8.13 allows host OS users to cause a denial of service host OS crash or possibly gain privileges via crafted ioctl calls on the /dev/kvm device...

K15319: Linux kernel TTY vulnerability CVE-2014-0196

Security Advisory Description The nttywrite function in drivers/tty/ntty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service memory corruption and system crash or gain privileges by...

K47009044: FreeBSD vulnerability CVE-2016-1887

Security Advisory Description Integer signedness error in the sockargs function in sys/kern/uipcsyscalls.c in FreeBSD 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local users to cause a denial of service memory overwrite and kernel panic or gain privileges via a negative buflen...

K73828041: MySQL vulnerability CVE-2016-6663

Security Advisory Description Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before...

K54212139: Kernel vulnerability CVE-2017-0861

Security Advisory Description Use-after-free vulnerability in the sndpcminfo function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors. CVE-2017-0861 Impact There is no impact; F5 products are not affected by this vulnerability. Security Adviso...

K17458: Linux kernel vulnerability CVE-2015-1805

Security Advisory Description The 1 piperead and 2 pipewrite implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed copytouserinatomic and copyfromuserinatomic calls, which allows local users to cause a denial of service system crash or...