CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-2868 Barracuda Networks ESG Appliance Improper Input Validation Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber acto...

Barracuda Networks ESG Appliance Improper Input Validation Vulnerability

Barracuda Email Security Gateway ESG appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection...

Improper Input Validation

github.com/kubernetes/ingress-nginx is vulnerable to Improper Input Validation. The vulnerability exists when a newline character is used in spec.rules.http.paths.path which allows an attacker to create or update ingress objects and gain access to sensitive information...

K000134781: Multiple Intel Server Board BMC vulnerabilities

Security Advisory Description CVE-2023-22661 Buffer overflow in some IntelR Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via local access. CVE-2023-22297 Access of memory location after end of buffer in some IntelR Server Board BMC...

Minova Technology eTrace SQL注入漏洞

Minova Technology eTrace is an eSports application from Minova Technology. An SQL injection vulnerability exists in Minova Technology eTrace versions prior to 23.05.20, which stems from improper neutralization of the particular element used...

Rockwell ArmorStart Improper Input Validation (CVE-2023-29027)

A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause...

Rockwell ArmorStart Improper Input Validation (CVE-2023-29028)

A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause...

Rockwell ArmorStart Improper Input Validation (CVE-2023-29022)

A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause...

Adam Retail Automation Systems Mobilmen Terminal Software 3 SQL注入漏洞

Adam Retail Automation Systems Mobilmen Terminal Software is a retail automation system terminal software. A SQL injection vulnerability exists in versions prior to Adam Retail Automation Systems Mobilmen Terminal Software 3, which arises from improper neutralization of specific elements used,...

(Pwn2Own) Lexmark MC3224i snmpUTIL Improper Input Validation Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark MC3224i printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the snmpUTIL binary. The issue results from the lack of proper...

CVE-2021-27131

Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting XSS due to the improper input sanitization on the "Additional HTML Section" via "Header and Footer" parameter in /admin/settings.php. This vulnerability is leading an attacker to steal admin and all user account cookies by...

Snap One OvrC Cloud (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Snap One Equipment: OvrC Cloud, OvrC Pro Devices Vulnerabilities: Improper Input Validation, Observable Response Discrepancy, Improper Access Control, Cleartext Transmission of Sensitive Information,...

PT-2023-8735 · Aruba · Aruba Edgeconnect Enterprise

Name of the Vulnerable Software and Affected Versions: Aruba EdgeConnect Enterprise affected versions not specified Description: The issue exists due to the lack of neutralization of special elements used in the operating system command. This allows remote authenticated users to run arbitrary...

CVE-2023-20721

In isp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07162155; Issue ID: ALPS07162155...

Input validation

In several functions of PhoneAccountRegistrar.java, there is a possible way to prevent an access to emergency services due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for...

Design/Logic Flaw

In m4u, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07771518; Issue ID: ALPS07680084...

GHSA-8J28-34QQ-GMCH Apache Sling Commons JSON bundle vulnerable to Improper Input Validation

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The org.apache.sling.commons.json bundle has been...

CVE-2022-47937

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to conside...

CVE-2022-22508

Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type...

CVE-2022-47378

Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requests that use the vulnerability leading to a denial-of-service condition...