PT-2023-8222 · Hyland · Hyland Alfresco Community Edition

Name of the Vulnerable Software and Affected Versions: Hyland Alfresco Community Edition versions through 7.2.0 Description: The issue exists due to the failure to neutralize special elements in the folder.get.html.ftl component of the Hyland Alfresco Community Edition content management system...

GHSA-P8Q6-QRGJ-7GX2 Microweber allows a remote attacker to obtain sensitive information via the HTTP GET method

An issue present in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method...

Microweber allows a remote attacker to obtain sensitive information via the HTTP GET method

An issue present in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method...

CVE-2023-48122

An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method...

Design/Logic Flaw

An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method...

CVE-2023-48122

An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method...

Golang 1.20.x < 1.20.12, 1.21.x < 1.21.5 Multiple Vulnerabilities

The version of Golang running on the remote host is prior to 1.20.12 or 1.21.x prior to 1.21.5. It is, therefore, is affected by multiple vulnerabilities : - A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from t...

The vulnerability of the DataLogView.php, EventsView.php, and AlarmsView.php scripts of the microprogramming software for Osprey Pump Controller controllers allows a perpetrator to execute arbitrary commands.

The vulnerability of the DataLogView.php, EventsView.php, and AlarmsView.php scripts of the Osprey Pump Controller microprogrammed software exists due to the failure to take measures to neutralize certain special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrar...

CVE-2023-48122

The CVE-2023-48122 issue affects microweber v2.0.1 and is fixed in v2.0.4. It enables a remote attacker to obtain sensitive information via HTTP GET, indicating a remote information disclosure vulnerability with a CVSSv3.1 base score of 7.5 (High). Mitigation: upgrade to microweber v2.0.4 or late...

DEBIAN-CVE-2023-49464

libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::getlumabitsperpixelfromconfigurationunci...

Directory traversal

An issue was discovered in server.js in etcd-browser 87ae63d75260. By supplying a /../../../ Directory Traversal input to the URL's GET request while connecting to the remote server port specified during setup, an attacker can retrieve local operating system files from the remote system...

Server-Side Request Forgery (SSRF)

Microcks is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the /jobs and /artifact/download components, which allow an attacker to access network resources and sensitive information via a crafted GET request, resulting in SSRF...

Code injection

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module...

CVE-2023-45285 Command 'go get' may unexpectedly fallback to insecure git in cmd/go

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module...

GO-2023-2383 Command 'go get' may unexpectedly fallback to insecure git in cmd/go

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module...

PT-2023-8188 · Go +9 · Go +9

Name of the Vulnerable Software and Affected Versions: Go versions prior to 1.21.5 Go versions prior to 1.20.12 Description: The issue is related to the use of the "go get" command to fetch modules with the ".git" suffix. If the module is unavailable via secure protocols, it may fallback to the...

CVE-2023-40089

In getCredentialManagerPolicy of DevicePolicyManagerService.java, there is a possible method for users to select credential managers without permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2023-24048

Cross Site Request Forgery CSRF vulnerability in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain control of the device via crafted GET request to /manpassword.htm...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain control of the device via crafted GET request to /manpassword.htm...

Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download

Microcks up to version 1.17.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...