CVE-2023-32219 Mazda cars unlocking

A Mazda model 2015-2016 can be unlocked via an unspecified method...

Mazda cars 安全漏洞

Mazda cars is a line of automobiles from the Japanese company Mazda Mazda. Mazda cars 2015-2016 suffers from a security vulnerability that stems from allowing unlocking via an unspecified method...

GHSA-XP5H-F8JF-RC8Q rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements

NOTE: rails-ujs is part of Rails/actionview since 5.1.0. There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML...

CVE-2023-32219

A Mazda model 2015-2016 can be unlocked via an unspecified method...

CVE-2023-32220

Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method...

Unauthenticated Blind SSRF

Description The Oxeye research team found Owncast vulnerable to an Unauthenticated Blind SSRF vulnerability. This vulnerability may allow an unauthenticated attacker to force the Owncast server to send HTTP requests to arbitrary locations using the GET HTTP method. This vulnerability also allows...

PT-2023-12492 · WordPress · Ulisting

Name of the Vulnerable Software and Affected Versions: uListing plugin for WordPress versions up to, and including, 1.6.6 Description: The issue allows unauthorized access due to missing capability checks and a missing security nonce in the StmListingSingleLayout::import new layout method. This...

WordPress Plugin uListing 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Authentication flaw

IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. IBM X-Force ID: 244107...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from a security vulnerability that originates from a public interface method in the WMS being called by a malicious three-way app,...

Internet Bug Bounty: [CVE-2023-22796] Possible ReDoS based DoS vulnerability in Active Support’s underscore

A regular expression based Denial of Service DoS vulnerability was discovered in Active Support. The vulnerability allowed for a specially crafted string to cause the regular expression engine to enter a state of catastrophic backtracking, leading to excessive CPU and memory usage. The...

New Linux Ransomware Strain BlackSuit Shows Striking Similarities to Royal

An analysis of the Linux variant of a new ransomware strain called BlackSuit has covered significant similarities with another ransomware family called Royal. Trend Micro, which examined an x64 VMware ESXi version targeting Linux machines, said it identified an "extremely high degree of similarit...

Add user with useradd

Creates a new user. By default the new user is set with sudo but other options exist to make the new user automatically root but this is not automatically set since the new user will be treated as root and login may be difficult. The new user can also be set as just a standard user if desired...

CVE-2023-33717

mp4v2 v2.1.3 was discovered to contain a memory leak when a method calling MP4File::ReadBytes had allocated memory but did not catch exceptions thrown by ReadBytes...

CVE-2023-33717

mp4v2 v2.1.3 was discovered to contain a memory leak when a method calling MP4File::ReadBytes had allocated memory but did not catch exceptions thrown by ReadBytes...

PUB-A-227207653

In setInputMethodWithSubtypeIdLocked of InputMethodManagerService.java, there is a possible way to setup input methods that are not enabled due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

PT-2023-3424 · Unified Automation · Unified Automation Uagateway

Name of the Vulnerable Software and Affected Versions: Unified Automation UaGateway affected versions not specified Description: This issue allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to...

(Pwn2Own) Unified Automation UaGateway OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability. The specific flaw exists within the ImportCsv method. A crafted XML payload can cause a null...

PT-2023-23648 · Vipre · Vipre Antivirus Plus

Name of the Vulnerable Software and Affected Versions: VIPRE Antivirus Plus affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target syste...

(0Day) VIPRE Antivirus Plus SetPrivateConfig Directory Traversal Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Antivirus Plus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...