NewStart CGSL MAIN 6.06 : kernel Multiple Vulnerabilities (NS-SA-2023-0083)

The remote NewStart CGSL host, running version MAIN 6.06, has kernel packages installed that are affected by multiple vulnerabilities: - There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2capcore.c's l2capconnect and l2capleconnectreq functions which may allow code...

NewStart CGSL MAIN 6.06 : gnutls Multiple Vulnerabilities (NS-SA-2023-0100)

The remote NewStart CGSL host, running version MAIN 6.06, has gnutls packages installed that are affected by multiple vulnerabilities: - An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a norenegotiation alert is sent with...

The vulnerability of the main() function in the tiffcp.c component of the LibTIFF library allows a attacker to compromise data integrity and cause service failures.

The vulnerability of the main function in the tiffcp.c component of the LibTIFF library is related to buffer overflow on the stack. Exploiting this vulnerability can allow an attacker to compromise data integrity and also cause service failures through the use of a specially created TIFF file...

CVE-2022-43675

An issue was discovered in NOKIA NFM-T R19.9. Reflected XSS in the Network Element Manager exists via /oms1350/pages/otn/cpbLogDisplay via the filename parameter, under /oms1350/pages/otn/connection/E2ERoutingDisplayWithOverLay via the id parameter, and under /oms1350/pages/otn/mainOtn via all...

PT-2023-14284 · Nokia · Nokia Nfm-T

Name of the Vulnerable Software and Affected Versions: NOKIA NFM-T version R19.9 Description: An issue exists in the Network Element Manager, specifically a Reflected XSS. This issue can be exploited via several API endpoints, including "/oms1350/pages/otn/cpbLogDisplay" via the filename paramete...

CVE-2023-7075

A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /main/checkout.php. The manipulation of the argument pt leads to cross site scripting. The attack may be...

CVE-2023-7075

CVE-2023-7075 affects code-projects Point of Sales and Inventory Management System 1.0. A cross-site scripting vulnerability exists in the /main/checkout.php file, triggered by manipulating the pt parameter. The issue is exploitable remotely and public exploits have been disclosed. No patch/versi...

New KV-Botnet Targeting Cisco, DrayTek, and Fortinet Devices for Stealthy Attacks

A new botnet consisting of firewalls and routers from Cisco, DrayTek, Fortinet, and NETGEAR is being used as a covert data transfer network for advanced persistent threat actors, including the China-linked threat actor called Volt Typhoon. Dubbed KV-botnet by the Black Lotus Labs team at Lumen...

CVE-2023-6572

Command Injection in GitHub repository gradio-app/gradio prior to main...

PYSEC-2023-255

Command Injection in GitHub repository gradio-app/gradio prior to main...

PYSEC-2023-255

Command Injection in GitHub repository gradio-app/gradio prior to main...

PT-2023-30678 · Cybrosys Techno Solutions · Cybrosys Techno Solutions Website Blog Search

Name of the Vulnerable Software and Affected Versions: Cybrosys Techno Solutions Website Blog Search aka website search blog versions 13.0 through 13.0.1.0.1 Description: A SQL injection issue allows a remote attacker to execute arbitrary code and gain privileges via the name parameter in the...

PT-2023-32700 · Gradio · Gradio

Name of the Vulnerable Software and Affected Versions: gradio versions prior to main Description: The issue concerns Exposure of Sensitive Information to an Unauthorized Actor in the GitHub repository gradio-app/gradio. Recommendations: For versions prior to main, update to the main version or...

PYSEC-2023-262

main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution...

Command injection

Command injection in main/lp/openofficepresentation.class.php in Chamilo LMS = v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters...

CVE-2023-4222

CVE-2023-4222 concerns Chamilo LMS versions

PT-2023-32598 · Apryse · Apryse Itext

Name of the Vulnerable Software and Affected Versions: Apryse iText version 8.0.2 Description: A vulnerability was found in the function main of the file PdfDocument.java, which affects the improper validation of array index. The attack can be initiated remotely. The real existence of this...

UBUNTU-CVE-2023-30581

The use of proto in process.mainModule.proto.require can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time...

samba: "rpcecho" development server allows denial of service via sleep() call on AD DC

A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in...

DrayTek Vigor2960 Path Traversal Vulnerability

DrayTek Vigor2960 is a dual WAN broadband router/VPN gateway from China's DrayTek. A path traversal vulnerability exists in the Draytek Vigor2960 v1.5.1.4 , v1.5.1.5 versions, which stems from a vulnerable directory traversal attack on the option parameter in the mainfunction.cgi dumpSyslog,...