Kiwi TCMS 安全漏洞

Kiwi TCMS is a leading open source test management system for manual and automated testing from Kiwi TCMS Open Source. A security vulnerability exists in Kiwi TCMS versions prior to 12.0, which stems from the fact that the system is not rate-limited, which makes brute-force attacks on the login...

LS ELECTRIC XBC-DN32U 访问控制错误漏洞

The LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC in Korea. An Access Control Error vulnerability exists in the LS ELECTRIC XBC-DN32U version 01.80, which stems from a lack of authentication for the PLC to perform critical functions and can be exploited by an...

Stored XSS in Email Blacklist Function

Description Stored attacks are those where the injected script is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information. Stored XS...

PT-2023-35285

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.231 Description A potential security issue exists due to the lack of a return value check for the create hist field function in the trace events hist module. The actual impact and attack plausibility have no...

PT-2023-35140

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.91 Description A potential security issue exists due to the lack of a return value check for the create hist field function in the trace events hist module. The actual impact and attack plausibility have no...

PT-2023-35327

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.272 Description A potential security issue exists due to the lack of a return value check for the create hist field function in the trace events hist module. The actual impact and attack plausibility have n...

PT-2023-6915

Name of the Vulnerable Software and Affected Versions PC settings tool versions 10.1.26.0 and earlier PC settings tool versions 11.0.22.0 and earlier Description The issue is related to a lack of authentication for a critical function in the PC Settings Tool. This can be exploited to allow an...

PT-2023-15666

Name of the Vulnerable Software and Affected Versions Bundle management module affected versions not specified Description The issue is related to a lack of authentication and control mechanisms in some APIs within the bundle management module. This could potentially affect data confidentiality i...

PT-2023-15667

Name of the Vulnerable Software and Affected Versions Bundle management module affected versions not specified Description The issue is related to the lack of authentication and control mechanisms in some APIs of the bundle management module. This could potentially affect data confidentiality...

Open Design Alliance (ODA) Drawing SDK DGN File Parsing Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open Design Alliance ODA Drawing SDK. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists with...

Code injection

Lack of verification in B&R APROL Tbase server versions R 4.2-07 may lead to memory leaks when receiving messages...

CVE-2022-43762 Memory leak when receiving messages in APROL Tbase server

Lack of verification in B&R APROL Tbase server versions R 4.2-07 may lead to memory leaks when receiving messages...

CVE-2022-43761 Lack of authentication when managing APROL database

Missing authentication when creating and managing the B&R APROL database in versions R 4.2-07 allows reading and changing the system configuration...

CVE-2021-36443

Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification...

CVE-2021-36443

Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification...

CVE-2021-36443: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification...

Remote Code Execution (RCE)

openmage/magento-lts is vulnerable to Remote Code Execution RCE. The vulnerability exists due to the lack of validation in the $this, $callback, and $alias parameters in the getChildGroup function of Abstract.php, allowing an attacker to bypass the block blacklist and inject and execute malicious...

Lendgine contract can be drained through mint() function due to lack of Access Control

Lines of code Vulnerability details Impact Anybody can call the mint function on lendgine.sol and enter any amount of collateral. This allows them to mint any number of tokens to their address for free. Proof of Concept The mint function in lendgine.sol is external with no additional modifiers or...

PT-2023-7363 · Hgiga · Hgiga Powerstation

Name of the Vulnerable Software and Affected Versions: HGiga PowerStation affected versions not specified Description: The issue is related to a lack of authentication for a critical function due to insufficient protection of service data, which can allow a remote attacker to gain unauthorized...

PT-2023-15888

Name of the Vulnerable Software and Affected Versions Chained Products WordPress plugin versions prior to 2.12.0 Description The issue concerns a lack of authorization and CSRF checks in the plugin, as well as insufficient validation of options to be updated. This allows unauthenticated attackers...