CVE-2023-46758

Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the device...

CVE-2023-46758

Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the device...

CVE-2023-46758

CVE-2023-46758 relates to Huawei’s HarmonyOS/EMUI privilege management in the multi-screen interaction module. The connected PT-2023-30188 and CNVD/CNNVD entries describe a privilege-management weakness that can lead to a denial of service on affected devices. Specific affected versions, root cau...

CVE-2023-46768

Multi-thread vulnerability in the idmap module. Successful exploitation of this vulnerability may cause features to perform abnormally...

CVE-2023-46768

Multi-thread vulnerability in the idmap module. Successful exploitation of this vulnerability may cause features to perform abnormally...

Design/Logic Flaw

Multi-thread vulnerability in the idmap module. Successful exploitation of this vulnerability may cause features to perform abnormally...

CVE-2023-46768

CVE-2023-46768 describes a multi-thread vulnerability in the idmap module of Huawei HarmonyOS. The NVD entry attributes a CVSS v3.1 base score of 7.5 (HIGH) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (I=NONE, ...

CVE-2023-46768

Multi-thread vulnerability in the idmap module. Successful exploitation of this vulnerability may cause features to perform abnormally...

PT-2023-29435 · Unknown · The Bastion

Name of the Vulnerable Software and Affected Versions: The Bastion versions prior to 3.14.15 Description: The Bastion provides authentication, authorization, traceability, and auditability for SSH accesses. However, SCP and SFTP plugins do not honor group-based Just-In-Time JIT Multi-Factor...

Bastion Access Control Error Vulnerability

Bastion is a group of machines used as a single entry point for operational teams to securely connect to devices. An Access Control Error vulnerability exists in Bastion versions 3.0.0 through 3.14.0, which originates in MFA where a group or individual can force an SCP/SFTP connection through...

PT-2023-30188 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns a permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause...

CVE-2023-5819

The Amazonify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

Cross site scripting

The Amazonify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVE-2023-5819 Amazonify <= 0.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The Amazonify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVE-2022-46809

Improper Neutralization of Formula Elements in a CSV File vulnerability in WPDeveloper ReviewX – Multi-criteria Rating & Reviews for WooCommerce.This issue affects ReviewX – Multi-criteria Rating & Reviews for WooCommerce: from n/a through 1.6.7...

kernel: wifi: iwlwifi: fix iwl_mvm_max_amsdu_size() for MLO

A NULL pointer dereference vulnerability was found in the Intel iwlwifi wireless driver in the Linux kernel. When using Multi-Link Operation MLO mode, the iwlmvmmaxamsdusize function incorrectly accesses vif-bssconf.chandef.chan-band, which leads to a NULL pointer dereference because bssconf is n...

kernel: regulator: core: Use different devices for resource allocation and DT lookup

In the Linux kernel, the following vulnerability has been resolved: regulator: core: Use different devices for resource allocation and DT lookup Following by the below discussion, there's the potential UAF issue between regulator and mfd...

kernel: blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none

In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix NULL dereference on q-elevator in blkmqelvswitchnone After grabbing q-sysfslock, q-elevator may become NULL because of elevator switch. Fix the NULL dereference on q-elevator by checking it with lock...

grafana: account takeover possible when using Azure AD OAuth

A flaw was found in Grafana, which validates Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique across Azure AD tenants, which enables Grafana account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant AzureAD OAuth...

SideCopy Exploiting WinRAR Flaw in Attacks Targeting Indian Government Entities

The Pakistan-linked threat actor known as SideCopy has been observed leveraging the recent WinRAR security vulnerability in its attacks targeting Indian government entities to deliver various remote access trojans such as AllaKore RAT, Ares RAT, and DRat. Enterprise security firm SEQRITE describe...