CVE-2023-47700

CVE-2023-47700 affects IBM Storage Virtualize family (IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem, IBM Storage Virtualize) on version 8.6. The issue = a trust management/GUI certificate validation flaw that could allow a remote attacker to spoof a trusted system, causing a user to co...

CVE-2024-20290

CVE-2024-20290 : A DoS in ClamAV due to a heap-based overflow in the OLE2 file format parser caused by an incorrect end-of-string check during scanning. Attacker-submitted crafted OLE2 content could crash the ClamAV scanning process. Connected documents confirm this vulnerability and reference mu...

CVE-2024-20255

CVE-2024-20255 affects Cisco Expressway Series and Cisco TelePresence Video Communication Server via the SOAP API on the web-based management interface. Insufficient CSRF protections permit an unauthenticated, remote attacker to induce a user to follow a crafted link, causing the device to reload...

CVE-2024-20254

Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) are affected by CSRF vulnerabilities that allow an unauthenticated, remote attacker to perform arbitrary actions on the device. The issues arise from insufficient CSRF protections in the web-based management interface...

CVE-2024-20252

CVE-2024-20252 affects Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS). An unauthenticated, network-based attacker can exploit cross-site request forgery (CSRF) in the web-based management interface to perform arbitrary actions on an affected device. The issue requ...

CVE-2023-38369

CVE-2023-38369 affects IBM Security Verify Access (ISVA) Docker 10.0.0.0–10.0.6.1 and ISVA Appliance 10.0.0.0–10.0.6.1. The root issue is that docker images are not required to enforce strong passwords by default, enabling potential account compromise. IBM and Red Hat advisories reference vulnera...

Out-of-bounds

there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-31002

CVE-2023-31002 affects IBM Security Verify Access (Docker container 10.0.0.0–10.0.6.1 and Appliance 10.0.0.0–10.0.6.1). The Red Hat and IBM bulletins confirm that the vulnerability stems from temporarily stored sensitive information in files that could be accessed by a local user, enabling inform...

CVE-2023-43017

CVE-2023-43017 affects IBM Security Verify Access 10.0.0.0–10.0.6.1. Description: a privileged user could install a configuration file that could allow remote access (high impact). Affected products include IBM Security Verify Access Docker (10.0.0.0–10.0.6.1) and Appliance (10.0.0.0–10.0.6.1). R...

CVE-2024-22012

CVE-2024-22012 : A Google Pixel-related out-of-bounds write due to a missing bounds check can lead to local privilege escalation without user interaction. Affected component: Pixel bootloader (per Pixel Update Bulletin).CVSS shows LOCAL access, LOW exploit complexity, and HIGH confidentiality/int...

Code injection

The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote...

CVE-2024-25145

CVE-2024-25145 describes a stored cross-site scripting (XSS) vulnerability in the Portal Search module’s Search Result app of Liferay Portal 7.2.0–7.4.3.11, and older unsupported versions, plus certain Liferay DXP builds. The issue allows remote authenticated users to inject arbitrary script/HTML...

CVE-2024-25143

CVE-2024-25143 affects Liferay Portal 7.2.0–7.3.6 and Liferay DXP 7.3 before SP3, and 7.2 before FP13; the issue arises when generating previews for Document and Media widgets, where resource consumption is not limited, leading to possible DoS via crafted PNG images. Exploitation status is not de...

Design/Logic Flaw

Jsish v3.5.0 commit 42c694c was discovered to contain a use-after-free via the SplitChar at ./src/jsiUtils.c...

Stack overflow

Jsish v3.5.0 commit 42c694c was discovered to contain a stack-overflow via the component IterGetKeysCallback at /jsish/src/jsiValue.c...

Cross site scripting

Mail2World v12 Business Control Center was discovered to contain a reflected cross-site scripting XSS vulnerability via the Usr parameter at resellercenter/login.asp...

Stack overflow

Espruino 2v20 commit fcc9ba4 was discovered to contain a Stack Overflow via the jspeFactorFunctionCall at src/jsparse.c...

Heap overflow

Jsish v3.5.0 was discovered to contain a heap-buffer-overflow in ./src/jsiUtils.c...

Out-of-bounds

Espruino 2v20 commit fcc9ba4 was discovered to contain an Out-of-bounds Read via jsvStringIteratorPrintfCallback at src/jsvar.c...

Design/Logic Flaw

The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to import the plugin's settings...