CVE-2023-24530

SAP BusinessObjects Business Intelligence Platform CMC - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed by the application over the network. On successful exploitation, attacker can perform operations that may completely compromise the...

PT-2023-15952 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence platform versions 420, 430 Description: The issue allows an authenticated attacker to access sensitive information that is otherwise restricted, potentially having a high impact on confidentiality and...

Siemens RUGGEDCOM APE1808

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...

CVE-2023-21840

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PS. Supported versions that are affected are 5.7.40 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of...

CVE-2023-0022

SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On successful exploitation, an attacker can perform operations that may completely compromise the application...

PT-2023-1013 · Sap · Sap Businessobjects Business Intelligence Analysis Edition For Olap

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Analysis edition for OLAP affected versions not specified Description: The issue allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On...

CVE-2022-41264

Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791, allows an authenticated non-administrator attacker to access a system class and execute any of its public methods with parameters provided by the attacke...

CVE-2022-41267

SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Business Objects server at the operating system level, enabling the attacker to take full control of the system causing a high impact on confidentiality, integrit...

CVE-2022-41267

CVE-2022-41267 affects SAP BusinessObjects Platform 4.2 (420) and 4.3 (430). A server‑side request forgery vulnerability lets an attacker with normal BI user privileges upload/replace any file on the server at the OS level, enabling full system control and causing high impact to confidentiality, ...

CVE-2022-41264

Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791, allows an authenticated non-administrator attacker to access a system class and execute any of its public methods with parameters provided by the attacke...

Delta Electronics DVW-W02W2-E2 2.42 Command Injection Vulnerability

Delta Electronics DVW-W02W2-E2 version 2.42 suffers from an authenticated command injection vulnerability. ------------------------------------------------------------------------------- title| Authenticated Command Injection product| Delta Electronics DVW-W02W2-E2 vulnerable version| V2.42 fixed...

transfer is used on address payable

Lines of code Vulnerability details Proof of Concept The codebase makes heavy use of the deprecated transfer function of address payable. Its will inevitably make the transaction fail when: 1. The receiver smart contract does not implement a payable function. 2. The receiver smart contract does...

Users of StakingFundsVault can never redeem their LP token once staking has started

Lines of code Vulnerability details The burnLPToken of a Fees & MEV vault allow users to burn LP tokens in exchange of ETH. Quoting the documentation Every user has a right to leave the LSD network at anytime. A depositor/staker can simply sell their LP tokens to someone else or burn to redeem ET...

Vulnerabilities fixed in Mozilla Firefox and Firefox ESR

Mozilla has fixed several vulnerabilities in Firefox and Firefox ESR. A malicious party could potentially exploit the vulnerabilities to collect system data or cause a denial-of-service. To the vulnerability with attribute CVE-2022-42928, Mozilla assigns the impact 'High' and could lead to memory...

CVE-2022-35296

Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform Version Management System exposes sensitive information to an actor over the network with high privileges that is not explicitly authorized to have access to that information, leading to a high impact on...

PT-2022-28248 · Go · Github.Com/Mohammed90/Caddy-Ssh

Name of the Vulnerable Software and Affected Versions: No specific software or version is mentioned, however, the issue is related to PAM Pluggable Authentication Modules and its implementation in a certain project, implying that the affected software is a PAM-based authentication system, but the...

CVE-2022-35292

In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges. If the service is exploited by adversaries, it can be used to...

CVE-2022-35292

In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges. If the service is exploited by adversaries, it can be used to...

CVE-2022-35292

In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges. If the service is exploited by adversaries, it can be used to...

PT-2022-22692 · Sap · Sap Business One

Name of the Vulnerable Software and Affected Versions: SAP Business One affected versions not specified Description: The issue arises when a service is created in the SAP Business One application, and the executable path contains spaces without being enclosed within quotes. This leads to a...