June 28, 2023—KB5027292 (OS Build 22000.2124) Preview

None None...

Server side request forgery (ssrf)

BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery SSRF vulnerability. In an insertDocument API request the user is able to supply a URL from which the presentation should be...

UBUNTU-CVE-2023-35169

PHP-IMAP is a wrapper for common IMAP communication without the need to have the php-imap module installed / enabled. Prior to version 5.3.0, an unsanitized attachment filename allows any unauthenticated user to leverage a directory traversal vulnerability, which results in a remote code executio...

CVE-2023-29860

An insecure permissions in /Taier/API/tenant/listTenant interface in DTStack Taier 1.3.0 allows attackers to view sensitive information via the getCookie method...

CVE-2023-29860

An insecure permissions in /Taier/API/tenant/listTenant interface in DTStack Taier 1.3.0 allows attackers to view sensitive information via the getCookie method...

Security feature bypass

An insecure permissions in /Taier/API/tenant/listTenant interface in DTStack Taier 1.3.0 allows attackers to view sensitive information via the getCookie method...

DTStack Taier 安全漏洞

Taier is a distributed scheduling system open-sourced by Kangaroo Cloud DTStack. It is designed to reduce the cost of ETL, clarify complex dependencies between tasks, and reduce labor costs for committing, scheduling, and operations. DTStack Taier version 1.3.0 there is a security vulnerability ,...

PT-2023-22451 · Dtstack · Dtstack Taier

Name of the Vulnerable Software and Affected Versions: DTStack Taier version 1.3.0 Description: The issue is related to insecure permissions in the "/Taier/API/tenant/listTenant" interface, allowing attackers to view sensitive information via the getCookie method. Recommendations: For DTStack Tai...

CVE-2023-29860

An insecure permissions in /Taier/API/tenant/listTenant interface in DTStack Taier 1.3.0 allows attackers to view sensitive information via the getCookie method...

CVE-2023-32571

Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed...

CVE-2023-32571

Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed...

GHSA-CH48-9R3Q-PV7X Vaadin vulnerable to possible information disclosure of class and method names in RPC response

Description Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests...

Possible information disclosure of class and method names in RPC response

Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests. See CWE-1295:...

Dynamic Linq 安全漏洞

Dynamic Linq is a free open source LINQ dynamic query library. A security vulnerability exists in Dynamic Linq versions 1.0.7.10 through 1.2.25 that could allow an attacker to execute arbitrary code and commands while parsing methods on untrusted inputs such as Where, Select, and OrderBy...

CVE-2020-21325

An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the setchache method of the function\common.func.php file...

PT-2023-11582 · Wuzhicms · Wuzhi Cms

Name of the Vulnerable Software and Affected Versions: WUZHI CMS version 4.1.0 Description: An issue in the software allows a remote attacker to execute arbitrary code via the set chache method of the functioncommon.func.php file. Recommendations: For WUZHI CMS version 4.1.0, consider disabling t...

CVE-2020-21325

An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the setchache method of the function\common.func.php file...

CVE-2020-21325

CVE-2020-21325 affects WUZHI CMS v4.1.0. A remote attacker can execute arbitrary code via the set_chache method in function/common.func.php. CVSS v3.1 base score 8.8 (HIGH) with network attack vector, low attack complexity, and privileges required. In the provided PT-2023-11582 documentation, a t...

GCP ESPv2 Hit with Critical API Authorization Bypass CVE-2023-30845

This post delves into a very impactful JWT Authentication Bypass vulnerability CVE-2023-30845 found in ESP-v2, an open-source service proxy that provides API management capabilities using Google Service Infrastructure. This vulnerability allows malicious API clients to bypass JWT authentication...

JeecgBoot vulnerable to SQL injection in queryFilterTableDictInfo

JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictInfo in method org.jeecg.modules.api.controller.SystemApiController...