17614 matches found
Qrio Smart Lock Q-SL2 vulnerable to authentication bypass by capture-replay
Overview Qrio Smart Lock Q-SL2 provided by Qrio, inc. contains an authentication bypass by capture-replay vulnerability CWE-294. Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...
CVE-2023-20182 Cisco DNA Center Software API Vulnerabilities
Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container, enumerate user information, or execute arbitrary commands in a restricted container as the root user. For more information about these...
CVE-2023-29857
Teslamate v1.27.1 has an information-disclosure vulnerability that allows an attacker to obtain sensitive information by directly accessing the Teslamate link. The provided documents identify the affected product and symptom but do not disclose the root cause details or a remediation/patch. No ex...
CVE-2023-20183
CVE-2023-20183 affects Cisco DNA Center Software API. The vulnerability stems from improper API authorization, enabling an authenticated, remote attacker to read information from a restricted container, enumerate user information, or execute arbitrary commands in a restricted container as root. A...
CVE-2023-20183 Cisco DNA Center Software API Vulnerabilities
Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container, enumerate user information, or execute arbitrary commands in a restricted container as the root user. For more information about these...
Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in libcurl (CVE-2022-32221)
Summary A vulnerability in libcurl used by InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2022-32221 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security restrictions, caused by a flaw when using the read callback CURLOPTREADFUNCTION to ask for...
CVE-2023-1764
Canon IJ Network Tool v4.7.5 and earlier (OS X 10.9.5–macOS 13) and v4.7.3 and earlier (OS X 10.7.5–OS X 10.8) can disclose the printer’s Wi‑Fi connection settings through its communications. The Root Cause involves a cryptographic/communication issue in the tool, enabling an attacker to obtain s...
CVE-2023-32986
CVE-2023-32986 concerns the Jenkins File Parameter Plugin. Versions 285.v757c5b_67a_c25 and earlier allow attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system by supplying attacker-chosen content, due to an unrestricted Stashed File P...
CVE-2023-2161
Affected software : Schneider Electric OPC Factory Server. Vulnerability : XML External Entity (XXE) injection due to improper restriction of XML external entities (CWE-611). Root cause : improper handling/restriction of external entity references when parsing configuration files. Impact : could ...
CVE-2023-31677
CVE-2023-31677 affects Luowice 3.5.18. The root cause is insecure permissions that allow modification of the eseeid parameter, enabling an attacker to view information for other alarm devices. High-severity impact (confidentiality) is stated in multiple sources. Reported exploitation status is no...
CVE-2023-23449
CVE-2023-23449 affects the SICK FTMg AIR FLOW SENSOR. The issue is an observable response discrepancy that allows a remote attacker to gain information about valid usernames by analyzing challenge responses from the REST interface. Affected are partnumbers 1100214, 1100215, 1100216, 1120114, 1120...
CVE-2023-23448
CVE-2023-23448 concerns the SICK FTMg AIR FLOW SENSOR. Affected partnumbers (1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526) are vulnerable due to inclusion of sensitive information in the source code, enabling a remote attacker to obtain usernames by analyzing the code. The vulner...
CVE-2023-20719
The CVE-2023-20719 issue affects the pqframework. It describes an out-of-bounds read caused by a missing bounds check, potentially enabling local information disclosure with high confidentiality impact and requiring system privileges, with no user interaction needed. Mitigation/Remediation: Patch...
susanne-netz.com Cross Site Scripting vulnerability OBB-3335236
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Design/Logic Flaw
An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none...
CVE-2023-31913
CVE-2023-31913: JerryScript 3.0 (commit 1a2c047) contains an assertion failure in the parser component parser_parse_class (jerry-core/parser/js/js-parser-expr.c). Documented impact: availability degradation (HIGH) with local attack vector, requires user interaction, no vendor-provided patch detai...
CVE-2023-29820
CVE-2023-29820 affects Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and earlier. According to Red Hat entries, a local attacker can access sensitive information via the EXE installer, with the vulnerability stemming from (unstated) local-privilege context and exposure during ins...
