CVE-2023-37274 Python code execution sandbox escape in non-docker version in Auto-GPT

Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. When Auto-GPT is executed directly on the host system via the provided run.sh or run.bat files, custom Python code execution is sandboxed using a temporary dedicated docker container which...

The vulnerability of the virtualization management tool used in the Podman-machine software for managing and launching OCI containers allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Podman-machine management tool, a software solution for managing and starting OCI containers, relates to insufficient protection of sensitive data due to the redirection of host ports to virtual machine ports during the process of mapping ports using gvproxy. Exploiting...

AZL-31659 CVE-2023-3354 affecting package qemu for versions less than 6.2.0-19

A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake phase and fails, QE...

PT-2023-17467 · Amd · Amd Processors

Name of the Vulnerable Software and Affected Versions: AMD processors affected versions not specified Description: A potential power side-channel issue in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a program’s execution inside an AM...

WPAxFuzz - A Full-Featured Open-Source Wi-Fi Fuzzer

This tool is capable of fuzzing either any management, control or data frame of the 802.11 protocol or the SAE exchange. For the management, control or data frames, you can choose either the "standard" mode where all of the frames transmitted have valid size values or the "random" mode where the...

Malicious code in ecorp-secret-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d0bf7826238a624701946507e61cf63dc75ea421397e13d125e2721546c812f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-37286

SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service...

Design/Logic Flaw

SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service...

CVE-2023-37286

SmartSoft SmartBPM.NET is affected by a vulnerability due to a hard-coded machine key. An unauthenticated remote attacker could use the machine key to send a serialized payload to the server, potentially achieving arbitrary code execution and disrupting service. CVSS 3.1 base score 9.8 (CRITICAL)...

PT-2023-25883 · Smartisoft · Smartbpm.Net

Name of the Vulnerable Software and Affected Versions: SmartSoft SmartBPM.NET affected versions not specified Description: The issue is related to the use of a hard-coded machine key in SmartSoft SmartBPM.NET. This allows an unauthenticated remote attacker to send a serialized payload to the...

CVE-2023-37286 SmartBPM.NET - Use of Hard-Coded Credentials - 1

SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service...

RLSA-2023:3948 Low: open-vm-tools security update

The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Security Fixes: open-vm-tools: authentication bypass vulnerability in the...

RLSA-2023:3949 Low: open-vm-tools security update

The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Security Fixes: open-vm-tools: authentication bypass vulnerability in the...

Rocky Linux 8 : open-vm-tools (RLSA-2023:3949)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:3949 advisory. - A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest...

Rocky Linux 9 : open-vm-tools (RLSA-2023:3948)

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:3948 advisory. - A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest...

UBUNTU-CVE-2023-36808

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native...

CVE-2023-36808 GLPI vulnerable to SQL injection through Computer Virtual Machine information

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native...

CVE-2023-36808 GLPI vulnerable to SQL injection through Computer Virtual Machine information

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native...

SUSE CVE-2023-22387

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption...

GLPI vulnerable to SQL injection through Computer Virtual Machine information

[email protected] reports: GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue...