CVE-2023-1263

The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via the cmpgetpostdetail function. This can allow unauthenticated individuals to obtain the contents of any non-password-protected, published post or page even wh...

CVE-2022-41329

An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in Fortinet FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiOS version 7.2.0 through 7.2.3 and 7.0.0 through 7.0.9 allows an unauthenticated attackers to obtain sensitive logging informations ...

CVE-2022-41333

An uncontrolled resource consumption vulnerability CWE-400 in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may allow an unauthenticated attacker to make the device unavailable via crafted GET requests...

Design/Logic Flaw

An access of uninitialized pointer vulnerability CWE-824 in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.11 and FortiProxy version 7.2.0 through 7.2.1, version 7.0.0 through 7.0.7 and before 2.0.11 allows a remote authenticated...

Design/Logic Flaw

An uncontrolled resource consumption vulnerability CWE-400 in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may allow an unauthenticated attacker to make the device unavailable via crafted GET requests...

CVE-2022-41329

An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in Fortinet FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiOS version 7.2.0 through 7.2.3 and 7.0.0 through 7.0.9 allows an unauthenticated attackers to obtain sensitive logging informations ...

CVE-2022-45861

An access of uninitialized pointer vulnerability CWE-824 in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.11 and FortiProxy version 7.2.0 through 7.2.1, version 7.0.0 through 7.0.7 and before 2.0.11 allows a remote authenticated...

CVE-2022-45861

An access of uninitialized pointer vulnerability CWE-824 in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.11 and FortiProxy version 7.2.0 through 7.2.1, version 7.0.0 through 7.0.7 and before 2.0.11 allows a remote authenticated...

CVE-2022-41333

An uncontrolled resource consumption vulnerability CWE-400 in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may allow an unauthenticated attacker to make the device unavailable via crafted GET requests...

CVE-2022-41333

An uncontrolled resource consumption vulnerability CWE-400 in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may allow an unauthenticated attacker to make the device unavailable via crafted GET requests...

CVE-2022-41333

FortiRecorder is affected by an uncontrolled resource consumption (DoS) vulnerability in the login authentication mechanism. Affected versions are FortiRecorder 6.4.3 and earlier and 6.0.11 and earlier. An unauthenticated attacker can exhaust resources via crafted GET requests to render the devic...

Cross-Site Request Forgery (CSRF)

jenkins-2-plugins is vulnerable to Cross-Site Request Forgery CSRF. An attacker is able to connect to an attacker-specified HTTP server using GET requests resulting in cross-site request forgery vulnerability...

Fortinet FortiRecorder 资源管理错误漏洞

Fortinet FortiRecorder is the U.S. fly tower Fortinet company's set of Web-based network video recorder management system. A resource management error vulnerability exists in Fortinet FortiRecorder, which arises from improper management of system resources e.g., memory, disk space, files, etc. by...

FortiRecorder - DoS in login authentication mechanism

An uncontrolled resource consumption vulnerability CWE-400 in FortiRecorder login authentication mechanism may allow an unauthenticated attacker to make the device unavailable via crafted GET requests...

SUSE CVE-2023-23004

In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidpplanes.c misinterprets the getsgtable return value expects it to be NULL in the error case, whereas it is actually an error pointer...

ShadowsocksX-NG 安全漏洞

ShadowsocksX-NG is an open source encrypted transport protocol based on the Socks5 proxy by shadowsocks, which can also refer to various development packages that implement this protocol. A security vulnerability exists in ShadowsocksX-NG version 1.10.0, which stems from the use of...

PT-2023-21217 · Unknown · Shadowsocksx-Ng

Name of the Vulnerable Software and Affected Versions: ShadowsocksX-NG version 1.10.0 Description: The issue arises from ShadowsocksX-NG 1.10.0 being signed with com.apple.security.get-task-allow entitlements due to CODE SIGNING INJECT BASE ENTITLEMENTS. Recommendations: For ShadowsocksX-NG versi...

Cross-Site Request Forgery (CSRF)

froxlor/froxlor is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists in the updateTablelisting and resetTablelisting functions in ajax.php due to improper sanitization which allows an attacker to change the request to get so that a user cannot use any functions on the page...

PT-2023-2369 · Finixbit · Elf-Parser

Name of the Vulnerable Software and Affected Versions: finixbit elf-parser affected versions not specified Description: The issue is related to insufficient input validation in the elf parser::Elf parser::get segments function of the elf parser.cpp component in the elf-parser program. This can le...

SQL Injection in 'core/ajax/ajax_data.php'

Description There exists an SQL injection affecting the edition parameter located in the file core/ajax/ajaxdata.php php $productEditionFilter = isset$GET"edition" and !empty$GET"edition" ? " productedition = '$GET"edition"' " : " producttype != 'Child' "; We see that $GET"edition" is appended...