PT-2023-23825 · Dell · Dell Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS version 9.5.0.x Description: The issue concerns an insertion of sensitive information into log files, specifically related to SNMPv3. A user with low privileges could potentially exploit this, leading to information...

Broadcom RAID Controller 安全漏洞

The Broadcom RAID Controller is a series of RAID controllers from Broadcom Corporation USA. A security vulnerability exists in the Broadcom RAID Controller, which arises from a vulnerability in the web interface that allows a client to bypass controls and cause unauthorized access to data by a...

Incorrect Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Incorrect Authorization through the authorization mechanism. A low-privileged attacker could access other users' data without requiring user interaction. Remediation Upgrad...

Incorrect Authorization

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Incorrect Authorization through the authorization mechanism. A low-privileged attacker could access other users' data without requiring user...

CVE-2023-24471

An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality. An authenticated user with reduced visibility can obtain unauthorized information via the debug functionality, obtaining data that would normal...

CVE-2023-38209 Adobe Commerce Incorrect Authorization Security feature bypass

Adobe Commerce versions 2.4.6-p1 and earlier, 2.4.5-p3 and earlier and 2.4.4-p4 and earlier are affected by an Incorrect Authorization vulnerability that could lead to a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access other user's data. Exploitation ...

CVE-2023-3570

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP DELETE request to gain full access to the device...

CVE-2023-3571

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP POST releated to certificate operations to gain full access to the device...

Knowage Path Traversal Vulnerability

Knowage is an open source suite for modern business analytics on legacy resources and big data systems from Knowage Italy. A path traversal vulnerability exists in Knowage versions prior to 6.x.x through 8.1.8, which stems from a vulnerability that allows a low-privilege attacker to upload a JSP...

answer Security breach

answer is an open source knowledge-based community software. A security vulnerability exists in versions of answer prior to 1.1.1, which stems from a misconfiguration of permissions that allows low-privileged users to create tags...

Octopus Deploy Security Vulnerability

Octopus Deploy is an automation tool for .NET, Java, and other application development and deployment from Octopus Deploy Australia. Octopus Deploy suffers from a security vulnerability that stems from the ability of a user with low privileges to interact with an extension endpoint...

Moxa AWK-3131A Series Industrial AP/Bridge/Client Buffer Copy Without Checking Size of Input (CVE-2019-5143)

An exploitable format string vulnerability exists in the iwconsole coniowritestr functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted time server entry can cause an overflow of the time server buffer, resulting in remote code execution. An attacker can send commands whil...

ASB-A-213170822

In writeToParcel of CursorWindow.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Dell Power Manager 安全漏洞

Dell Power Manager is an application from Dell Inc. that is used to configure battery maintenance practices to maximize the battery life of a system. A security vulnerability exists in Dell Power Manager versions 3.3 through 3.14 that stems from the presence of an Access Control Error...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.42 and prior and 8.0.33 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server and unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H).

...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).

...

PT-2023-4351 · Trend Micro · Trend Micro Apex Central

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central versions prior to build 6481 Trend Micro Apex Central 2019 version = Build 6394 Description: The issue is related to insufficient validation of incoming requests in the modDeepSecurity widget of the monitoring panel o...

PT-2023-4353 · Trend Micro · Trend Micro Apex Central

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central versions prior to build 6481 Description: A server-side request forgery SSRF vulnerability could allow an attacker to interact with internal or local services directly. The attacker must first obtain the ability to...

SolarWinds Platform 授权问题漏洞

SolarWinds Platform is a unified monitoring, observability, and service management platform from U.S.-based SolarWinds, Inc. SolarWinds Platform suffers from an authorization issue vulnerability that stems from an access control bypass issue. A low-privilege attacker could exploit this...

CVE-2023-3321

A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing them to run on the zenon installed hosts...