CVE-2023-0217

CVE-2023-0217 is an OpenSSL vulnerability: an invalid pointer dereference on read when validating a malformed DSA public key via EVP_PKEY_public_check(), likely crashing the application and enabling denial of service. Affected context in connected documents confirms OpenSSL-related advisories and...

Combating the Ever-Increasing Cyber Attacks in 2023

By Owais Sultan Cyber attacks are a real and common issue surrounding businesses and personal accounts, especially if they have sensitive… This is a post from HackRead.com Read the original post: Combating the Ever-Increasing Cyber Attacks in 2023...

CVE-2022-40691

The CVE-2022-40691 issue affects Moxa SDS-3008 Series Industrial Ethernet Switch (web UI, version 2.1). A vulnerability in the web application allows information disclosure via specially crafted HTTP requests, with examples such as accessing /auth/accountpassword.asp/ (and with a trailing backsla...

CVE-2021-37492

The CVE-2021-37492 entry pertains to Ravencoin Core (

GHSA-84MM-PRJG-49XM tinymighty WikiSEO is vulnerable to cross-site scripting via modifyHTML function

A vulnerability was found in tinymighty WikiSEO 1.2.1. This affects the function modifyHTML of the file WikiSEO.body.php of the component Meta Property Tag Handler. The manipulation of the argument content leads to cross site scripting. It is possible to initiate the attack remotely. The exploit...

CVE-2023-20606

CVE-2023-20606 describes an out-of-bounds read in the apusys component due to a missing bounds check, potentially allowing local information disclosure with SYSTEM privileges. Exploitation is reported to not require user interaction. A patch is available (ALPS07571104; Issue ID ALPS07571104). Con...

CVE-2023-25016

CVE-2023-25016 affects Couchbase Server: versions prior to 6.6.6, 7.x prior to 7.0.5, and 7.1.x prior to 7.1.2. The issue exposes sensitive information to an unauthorized actor . The Red Hat advisory RH:CVE-2023-25016 corroborates the description. No root-cause or exploitation details are provide...

Design/Logic Flaw

An issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with agent permissions to view information about tickets they are not authorized to see...

CVE-2022-47070

NVS365 V01 is vulnerable to Incorrect Access Control. After entering a wrong password, the url will be sent to the server twice. In the second package, the server will return the correct password information...

Anyone can call the DripsHub.split function to frontrun the DripsHub.setSplits function call of the trusted user who owns the splittable funds

Lines of code Vulnerability details Impact As mentioned by the following DripsHub.split function's comment, the user, who owns the splittable funds, needs to be trusted by the receivers for such splittable funds. Yet, when this trusted user wants to call the DripsHub.setSplits function below to...

CVE-2022-22486

IBM Tivoli Workload Scheduler (versions 9.4, 9.5, 10.1) is vulnerable to an XML External Entity (XXE) injection when processing XML data. Root cause: XXE in XML processing. Impact per sources: potential exposure of sensitive information and resource consumption. Remediation in connected documents...

CVE-2023-0576

...

CVE-2022-3083

CVE-2022-3083 affects all versions of Landis+Gyr E850 (ZMQ200). The vulnerability is CWE-784: Reliance on Cookies Without Validation and Integrity, where web application navigation depends on the session cookie value; an attacker changing cookie values could render the web interface inaccessible....

ASB-A-230630526

In dropFramesUntilIframe of AAVCAssembler.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-0591

The CVE-2023-0591 entry affects ubi-reader before 0.8.5 and describes a path traversal vulnerability in ubireader_extract_files. A node name (dent_node.name) is treated as trusted and joined to the extraction directory path during processing, with the node content written to the joined path. By c...

Vulnerability in Driver Distributor where passwords are stored in a recoverable format

Overview Driver Distributor provided by FUJIFILM Business Innovation Corp. contains a vulnerability where passwords are stored in a recoverable format CWE-257. Sato Ryo, Yokoi Hiroshi, and Shiga Takuma of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the...

Successful get balance request to victim contract from attack contract and also costing the victim contract gas fees

Lines of code Vulnerability details Impact Successful get balance request to victim contract from attack contract and also costing the victim contract gas fees One can view the balance of the victim's contract without permission. URL:...

CVE-2023-22611

CVE-2023-22611 describes an information disclosure vulnerability (CWE-200) in EcoStruxure Geo SCADA Expert 2019–2021 (formerly ClearSCADA) where sensitive data could be exposed via specific messages sent to the database server TCP port. The CVSSv3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) yi...

CVE-2022-40135

CVE-2022-40135 concerns an information-leak in the Smart USB Protection SMI Handler affecting Lenovo devices. The vulnerability may allow a local attacker with elevated privileges to read SMM memory. The PT-2022-25236 entry confirms the issue but provides no specific affected models/versions or a...

stratacafe.com Cross Site Scripting vulnerability OBB-3171586

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...