CVE-2019-18940

CVE-2019-18976 describes a NULL pointer dereference in res_pjsip_t38.c affecting Sangoma Asterisk up to version 13.x and Certified Asterisk up to 13.21-x. If a re-invite for T.38 faxing arrives and the SDP contains a port of 0 with no c line, a crash can occur. This vulnerability is distinct from...

CVE-2023-23336

CVE-2023-43336 affects Sangoma FreePBX prior to 15.0.18, 16.0.40, 15.0.16, and 16.0.17. The root cause is an access control issue caused by a modified parameter value (for example, changing extension=self to extension=101). This could allow bypass of access controls as described in the connected ...

CVE-2032-43016

Technical details for CVE-2032-43016 are not publicly available in the provided documents; monitoring for updates is advised.

CVE-2021-234550

CVE-2021-234550 affects IBM Spectrum Control (versions 5.4.0–5.4.5.2). The issue is a Dojo prototype pollution in setObject that could allow a remote attacker to execute arbitrary code by sending a specially crafted request. IBM lists a fix in Spectrum Control v5.4.6. Other related advisories not...

CVE-2024-21680

A RCE vulnerability (CVSS 3.0: AV=L/AC=L/PR=N/UI=R/S=U/C/H/I/H/A:H) was introduced in Sourcetree for Mac and Sourcetree for Windows version 3.4.14. The issue allows an unauthenticated attacker to execute arbitrary code with high impact to confidentiality, integrity, and availability, requiring us...

CVE-2022-45592

CVE-2022-45592 is discussed in connected documents as affecting Linux distributions (notably Debian/Ubuntu) with a set of issues: Server-Side Request Forgery (SSRF), persistent Cross-Site Scripting (XSS), and a File Upload vulnerability. The Nessus NASL notes unpatched status for Debian/Ubuntu pa...

CVE-2023-34854

CVE-2023-34854 corresponds to an authenticated remote code execution vulnerability in HotelDruid via its backup/restore functionality. Multiple connected sources (Ubuntu/Debian trackers, Veracode, PT-Security, and Nessus) confirm RCE through backup/restore, with no explicit patch/version details ...

The Treasury.sol contract changes the address for the different manager contract in one function call.

Lines of code Vulnerability details Impact In a case where either one of the manager addresses the tokenomics, depositiory or dispenser contracts are compromised or deprecated, attempting to replace the compromised manager contract address necessitates an overall replacement of all the other...

CVE-2022-43876

CVE-2022-43876 affects IBM Security Verify Access OpenID Connect Provider container. The IBM bulletin states an information-disclosure flaw where web pages can be stored locally by the OIDC Provider and read by another user on the same system. Affected IBM Security Verify Access OIDC Provider ver...

senioren-individual-reisen.de Improper Access Control vulnerability OBB-3820319

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-3283

The connected Palo Alto advisory PA-CVE-2023-6789 details a stored XSS vulnerability in PAN-OS web interface. It allows a malicious authenticated read-write administrator to store a JavaScript payload via the web interface, which executes when viewed by an authenticated administrator, proxying al...

CVE-2023-37366

CVE-2023-37366 is a DoS flaw affecting Google Pixel cellular baseband/modem components. Public details from Pixel security bulletin map it to a DoS issue for Pixel devices (2023-12 patch level). An OSV entry confirms a root cause in cd_parseMsg of cd_codec.c where improper input validation can ca...

Windows 10 gets its own extended security updates program

The day that Windows 10 machines will get their last security updates is set for October 14, 2025. So if you want to stay secure, you’d have to upgrade to a newer version. Either to Windows 11, which is not all that different, but more demanding when it comes to system requirements. Or to the...

CVE-2023-6396

GitLab CE/EE is affected by CVE-2023-6396 due to XSS and ReDoS in Markdown via the Banzai pipeline when a member has admin_group_member permission, potentially allowing escalation (e.g., adding members with higher roles) and exposure of internal project details. The issue is tied to a bypass of C...

CVE-2023-43020

CVE-2023-43020 is evidenced in IBM bulletins as a denial-of-service vulnerability in IBM Db2 (including Db2 Connect Server) when processing a specially crafted query. Affected products span Db2 on Linux/UNIX/Windows (versions 10.5, 11.1, 11.5; Db2 Big SQL is also listed in related bulletins). The...

CVE-2020-8909

Technical details for CVE-2020-8909 are not provided in the supplied documents. IBM bulletin references other CVEs and products but does not disclose specifics for this candidate. Monitor for updates.

CVE-2023-39120

Nodogsplash is affected by a directory traversal vulnerability (CVE-2023-39120) that also impacts OpenWrt. The issue allows remote attackers to read arbitrary files from the target system and is mitigated by upgrading Nodogsplash to version 5.0.1. The Nuclei template notes the vulnerability and s...

CVE-2021-28854

VICIdial Web Client is reported vulnerable to information disclosure (CVE-2021-28854). The Nuclei template describes that sensitive files are accessible from the client side, including mysqli logs, auth logs, debug information, login attempts (successful and unsuccessful) with IPs, User-Agents, a...

CVE-2018-16341

Nuxeo prior to 10.3 is vulnerable to an unauthenticated remote code execution via server-side template injection. An attacker can execute arbitrary code on the affected system. The Nucleo template-exploitation details show an SSTI path in the login flow, confirming impact as remote code execution...

CVE-2023-40118

CVE-2023-40118 is addressed in ChromeOS updates as part of the Android Runtime Container security fixes. The connected ChromeOS release notes indicate CVE-2023-40118 was fixed as a Medium severity issue on impacted platforms within the Android Runtime Container, in the context of the ChromeOS Sta...