CVE-2023-27881

A user could use the “Upload Resource” functionality to upload files to any location on the disk...

CVE-2023-27881

A user could use the “Upload Resource” functionality to upload files to any location on the disk...

Design/Logic Flaw

A user could use the “Upload Resource” functionality to upload files to any location on the disk...

CVE-2023-27881 PTC Vuforia Studio Unrestricted Upload of File with Dangerous Type

A user could use the “Upload Resource” functionality to upload files to any location on the disk...

CVE-2023-27881

CVE-2023-27881 affects PTC Vuforia Studio. Affected: Vuforia Studio (all versions prior to 9.9). Vulnerability: Unrestricted Upload of File with Dangerous Type via the Upload Resource feature allows a user to upload files to arbitrary locations on disk. Impact: potential unauthorized file placeme...

PT-2023-21392 · Ptc · Vuforia Studio

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A user could use the “Upload Resource” functionality to upload files to any location on the disk. There is no additional information about the estimated...

CKAN < 2.9.9 / 2.10.1 RCE

The version of CKAN installed on the remote host is prior to 2.9.9 or 2.10 prior to 2.10.1. It is, therefore, affected by a remote code execution vulnerability. A remote attacker with permissions to create or edit a dataset can upload a resource with a specially crafted id to write the uploaded...

A week in security (May 22-28)

Last week on Malwarebytes Labs: Update now: 9 vulnerabilities impact Cisco Small Business Series ChatGPT: Cybersecurity friend or foe? Webinar recap: EDR vs MDR for business success Identity crisis: How an anti-porn crusade could jam the Internet, featuring Alec Muffett: Lock and Code S04E11...

Google to pay $40m for "deceptive and unfair" location tracking practices

Google is going to pay $39.9 million to Washington State to put to rest a lawsuit about its location tracking practices which has been in play since last year. Google was accused of "misleading consumers" by State Attorney General Bob Ferguson. From the AG press release: Attorney General Bob...

ESXi < 7.0 Reflected Denial of Service

The remote VMware ESXi host is less than version 7.0 and is affected by a reflected denial of service vulnerability: - The Service Location Protocol SLP, RFC 2608 allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to...

CVE-2023-29552 - Abuse of the Service Location Protocol May Lead to DoS Attacks

The Service Location Protocol SLP, RFC 2608 allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor. More at:...

CVE-2023-30780

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in TheGuideX User IP and Location plugin = 2.2 versions...

Cross site scripting

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in TheGuideX User IP and Location plugin = 2.2 versions...

CVE-2023-30780

CVE-2023-30780 is a stored XSS vulnerability in the WordPress plugin “User IP and Location” by TheGuideX, affecting versions ≤ 2.2. The issue arises from improper handling of user-supplied input, enabling authenticated users with contributor or higher roles to inject script into stored content. I...

CVE-2023-30780 WordPress User IP and Location Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in TheGuideX User IP and Location plugin = 2.2 versions...

PT-2023-23777 · Apple · Ipados +6

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 9.5 tvOS versions prior to 16.5 macOS Ventura versions prior to 13.4 iOS versions prior to 15.7.6 and prior to 16.5 iPadOS versions prior to 15.7.6 and prior to 16.5 macOS Monterey versions prior to 12.6.6 Descriptio...

About the security content of watchOS 9.5

About the security content of watchOS 9.5 This document describes the security content of watchOS 9.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

About the security content of macOS Ventura 13.4

About the security content of macOS Ventura 13.4 This document describes the security content of macOS Ventura 13.4. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases...

部分Apple产品 日志信息泄露漏洞

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A log information disclosure vulnerability exists in some Apple products, which stems from an application that may be able to read sensitive location information. The following products and versions are...

PT-2023-4785 · Apple · Macos Ventura +5

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 16.5 iPadOS versions prior to 16.5 tvOS versions prior to 16.5 macOS Ventura versions prior to 13.4 watchOS affected versions not specified Description: The issue is related to the disclosure of protected information,...