Beats, Elastic Agent, APM Server, and Fleet Server 8.10.1 Security Update - Improper Certificate Validation issue (ESA-2023-16)

Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue ESA-2023-16 It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however,...

The vulnerability of the webpimage.cpp component in the Exiv2 metadata management library allows a attacker to cause a service failure.

The vulnerability of the webpimage.cpp component in the Exiv2 media metadata management library is caused by a numerical overflow. Exploiting this vulnerability could allow an attacker to cause service interruptions...

The vulnerability of the Hotspot component of Oracle’s software platform and the Oracle GraalVM Enterprise Edition virtual machine allows a perpetrator to gain access to modify, add, or delete data.

The vulnerability of the Hotspot component of Oracle’s software platform and the Oracle GraalVM Enterprise Edition virtual machine is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to gain access to modify, add, or delete data remotely...

The vulnerability of the 7z-file analyzer component of the 7-Zip archive tool allows a hacker to execute arbitrary code.

The vulnerability of the 7z-file analyzer component of the 7-Zip compressor is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

The vulnerability of the MDPR component in the Gstreamer multimedia framework allows a hacker to execute arbitrary code.

The vulnerability of the MDPR component in the Gstreamer multimedia framework is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

The vulnerability of the MDPR component in the Gstreamer multimedia framework allows a hacker to execute arbitrary code.

The vulnerability of the MDPR component in the Gstreamer multimedia framework is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

The vulnerability of the CNCSoft software for numerical control programming systems and the CNCSoft ScreenEditor, which allows a hacker to execute arbitrary code.

The vulnerability of CNCSoft’s numerical control software and CNCSoft ScreenEditor lies in buffer overflow on the stack. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

RWS WorldServer 11.7.3 Session Token Enumeration

Advisory: Session Token Enumeration in RWS WorldServer Session tokens in RWS WorldServer have a low entropy and can be enumerated, leading to unauthorised access to user sessions. Details ======= Product: WorldServer Affected Versions: 11.7.3 and earlier versions Fixed Version: 11.8.0 Vulnerabili...

PT-2023-26064 · Xalpha · Xalpha

Name of the Vulnerable Software and Affected Versions: xalpha version 0.11.4 Description: The issue concerns Remote Command Execution RCE due to improper validation of user input, which is not checked to ensure it contains numerical values before being evaluated. Recommendations: For xalpha versi...

CVE-2023-25955

National land numerical information data conversion tool all versions improperly restricts XML external entity references XXE. By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker...

CVE-2023-25955

The CVE-2023-25955 issue affects the National land numerical information data conversion tool (all versions) and is caused by improper restriction of XML external entity references (XXE). Multiple connected sources corroborate that processing a specially crafted XML file can allow an attacker to ...

CVE-2023-25955

National land numerical information data conversion tool all versions improperly restricts XML external entity references XXE. By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker...

JVN#75742861: Improper restriction of XML external entity references (XXE) in National land numerical information data conversion tool

National land numerical information data conversion tool provided by MLIT improperly restricts XML external entity references XXE CWE-611. Impact By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker. Solution Stop using the product The developer...

WP FEvents Book <= 0.46 - Subscriber+ Arbitrary Booking Manipulation via IDOR

The plugin does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users. PoC 1. Book or cancel booking an event using an authenticated user. 2. Intercept the request using an HTTP...

The vulnerability of Adobe Dimension’s 3D design software, related to integer overflow, allows a hacker to execute arbitrary code.

The vulnerability of Adobe Dimension’s 3D design software relates to a numerical overflow condition. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created malicious file...

The vulnerability of the PDF Viewer function in Microsoft Edge and Google Chrome browsers allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the PDF Viewer function in Microsoft Edge and Google Chrome is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

K15807: cURL and libcurl vulnerability CVE-2014-1263

Security Advisory Description curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.50...

K15873: cURL/libcURL vulnerability CVE-2014-2522

Security Advisory Description curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a...

K04572666: systemd vulnerability CVE-2020-13776

Security Advisory Description systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete...

The vulnerability of the Core web browser component in Google Chrome, which allows a hacker to increase their privileges

The vulnerability of the Core web browser component in Google Chrome is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to trigger memory corruption and elevate their privileges to the root level...