CVE-2023-40957

A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management aka pdm v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, and pdm-16.0.1.0.0 allows a remote authenticated attacker to execute arbitrary code via the request parameter in models/baseclient.py compone...

PT-2023-27718 · Didotech Srl · Didotech Srl Engineering & Lifecycle Management +1

Name of the Vulnerable Software and Affected Versions: Didotech srl Engineering & Lifecycle Management aka pdm versions 14.0 through 16.0 Description: A SQL injection issue allows a remote authenticated attacker to execute arbitrary code via the select parameter in the models/base client.py...

CVE-2023-40218

An issue was discovered in the NPU kernel driver in Samsung Exynos Mobile Processor 9820, 980, 2100, 2200, 1280, and 1380. An integer overflow can bypass detection of error cases via a crafted application...

LLMs and Tool Use

Last March, just two weeks after GPT-4 was released, researchers at Microsoft quietly announced a plan to compile millions of APIs--tools that can do everything from ordering a pizza to solving physics equations to controlling the TV in your living room--into a compendium that would be made...

The vulnerability of the iperf function in the set_iperf3_svr.cgi application programming interface of ASUS RT-AX55, RT-AX56U, and RT-AC86U routers allows a hacker to execute arbitrary code.

The vulnerability of the iperf function in the application programming interface for ASUS RT-AX55, RT-AX56UV2, and RT-AC86U routers is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2023-28543 Out of Bounds read in SNPE Library

A malformed DLC can trigger Memory Corruption in SNPE library due to out of bounds read, such as by loading an untrusted model e.g. from a remote source...

louisa-models.de Cross Site Scripting vulnerability OBB-3631081

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Prompt injection could be the SQL injection of the future, warns NCSC

The UK's National Cyber Security Centre NCSC has issued a warning about the risks of integrating large language models LLMs like OpenAIs ChatGPT into other services. One of the major risks is the possibility of prompt injection attacks. The NCSC points out several dangers associated with...

How to Prevent ChatGPT From Stealing Your Content & Traffic

ChatGPT and similar large language models LLMs have added further complexity to the ever-growing online threat landscape. Cybercriminals no longer need advanced coding skills to execute fraud and other damaging attacks against online businesses and customers, thanks to bots-as-a-service,...

K000135997: Multiple Node.js vulnerabilities

Security Advisory Description CVE-2023-32002 The use of Module.load can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x an...

OpenFGA Authorization Bypass

Overview Some end users of OpenFGA v1.3.0 or earlier are vulnerable to authorization bypass when calling the ListObjects API. This means that the API sometimes returns more objects than it should. Am I Affected? The vulnerability affects customers using ListObjects with specific models. The...

GHSA-JCF2-MXR2-GMQP OpenFGA Authorization Bypass

Overview Some end users of OpenFGA v1.3.0 or earlier are vulnerable to authorization bypass when calling the ListObjects API. This means that the API sometimes returns more objects than it should. Am I Affected? The vulnerability affects customers using ListObjects with specific models. The...

Hardcoded credentials

A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to unlock UEFI variables due to a hard-coded SMI handler credential...

ELECOM wireless LAN routers 操作系统命令注入漏洞

ELECOM wireless LAN routers are a family of routers from ELECOM Japan. An operating system command injection vulnerability exists in ELECOM wireless LAN routers that originates from allowing an authenticated user to execute arbitrary operating system commands by sending a specially crafted reques...

PT-2023-26957 · Elecom · Elecom Wrc-1900Ghbk-S +6

Name of the Vulnerable Software and Affected Versions: ELECOM WRC-600GHBK-A all versions ELECOM WRC-1467GHBK-A all versions ELECOM WRC-1900GHBK-A all versions ELECOM WRC-733FEBK2-A all versions ELECOM WRC-F1167ACF2 all versions ELECOM WRC-1467GHBK-S all versions ELECOM WRC-1900GHBK-S all versions...

Apple iOS and iPadOS Security Vulnerabilities

Apple iOS and Apple iPadOS are products of Apple Inc.Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS prior to 16.4 and iPadOS prior to 16.4, which originates from processing web conten...

CVE-2023-30702

Affected software: SSHDCPAPP TA on Samsung Windows Update for Galaxy Book Go, Galaxy Book Go 5G, Galaxy Book2 Go, and Galaxy Book2 Pro 360. Root cause: a stack overflow in SSHDCPAPP TA prior to the Samsung System Hardware Update dated 7/13/2023. Impact: enables a local attacker to execute arbitra...

wger Workout Manager Cross-site Scripting vulnerability

Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the licenseauthor field in the add-ingredient function in the templates/ingredients/view.html, models/ingredients.py, and views/ingredients.py components...

GHSA-8M9P-3926-GFFR wger Workout Manager Cross-site Scripting vulnerability

Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the licenseauthor field in the add-ingredient function in the templates/ingredients/view.html, models/ingredients.py, and views/ingredients.py components...

Cross site scripting

Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the licenseauthor field in the add-ingredient function in the templates/ingredients/view.html, models/ingredients.py, and views/ingredients.py components...