231585 matches found
CVE-2024-23824
CVE-2024-23824 affects mailcow (dockerized email package). A pixel flood vulnerability arises when a payload is uploaded in the logo, causing the admin page to slow down and become unresponsive. Affected versions are 2023-12a and prior; a patch was released in 2024-01. Mitigation/remediation: upg...
CVE-2023-6387
The CVE-2023-6387 issue is in Silicon Labs Gecko SDK, specifically the Bluetooth LE HCI CPC sample application. The core problem is a potential buffer overflow in the sample code, which could lead to denial of service or remote code execution. Impact is rated HIGH (CVSS 3.1: AV:A, AC:H, PR:N, UI:...
Code injection
IBM Cloud Pak System 2.3.1.1, 2.3.2.0, and 2.3.3.7 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 260733...
CVE-2023-38273
CVE-2023-38273 affects IBM Cloud Pak System components: Cloud Pak System version 2.3.1.1, 2.3.2.0 (Power), and 2.3.3.7 (Power) as well as related Intel lines 2.3.3.0–2.3.3.6. Root cause is an inadequate account lockout setting that could allow a remote attacker to brute-force credentials. Impact ...
Design/Logic Flaw
IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 could allow an attacker on the organization's local network to escalate their privileges due to unauthorized API access. IBM X-Force ID: 270267...
Cross site scripting
IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting,...
Input validation
IBM Storage Protect Plus Server 10.1.0 through 10.1.15.2 Admin Console could allow a remote attacker to obtain sensitive information due to improper validation of unsecured endpoints which could be used in further attacks against the system. IBM X-Force ID: 270599...
Sql injection
ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in home Graph-Data...
CVE-2023-6676
CVE-2023-6676 describes a Cross-Site Request Forgery (CSRF) vulnerability in CyberMath by National Keep Cyber Security Services. Affected versions are v1.4 prior to v1.5, where CSRF could allow unauthorized actions on behalf of an authenticated user. Root cause details in connected sources point ...
CVE-2024-0269
CVE-2024-0269 affects ManageEngine ADAudit Plus 7270 and earlier, with an authenticated SQL injection in the File-Summary DrillDown feature. The root cause is an SQL injection vulnerability within that drill-down path, allowing an attacker with valid credentials to potentially access or manipulat...
CVE-2023-6675
CVE-2023-6675 affects National Keep CyberMath. The issue is an Unrestricted Upload of a File with a Dangerous Type in CyberMath versions 1.4 and earlier (pre-1.5), enabling an attacker to upload a web shell to the web server. The root cause is an improper validation of uploaded file types, allowi...
CVE-2023-47148
Summary of CVE-2023-47148 : IBM Storage Protect Plus Server Admin Console (versions 10.1.0–10.1.15.2) could allow a remote attacker to obtain sensitive information due to improper validation of unsecured endpoints. The issue is rooted in insecure endpoint handling, enabling information disclosure...
CVE-2023-6673
The CVE-2023-6673 entry describes a Reflected XSS in CyberMath (National Keep Cyber Security Services) caused by improper input neutralization during web page generation. Affected version: CyberMath v1.4 prior to v1.5. Impact is cross-site scripting via reflected input; exploitation details are n...
Cross site scripting
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CPCALCULATEDFIELDS shortcode in all versions up to, and including, 1.2.52 due to insufficient input sanitization and output escaping on user supplied 'location' attribute. This makes it...
Privilege escalation
Search path or unquoted item vulnerability in HDD Health affecting versions 4.2.0.112 and earlier. This vulnerability could allow a local attacker to store a malicious executable file within the unquoted search path, resulting in privilege escalation...
CVE-2024-1201
The CVE is linked to PanteraSoft HDD Health 4.2.0.112 and earlier. Affected component: HDD Health executable handling with a search path/unquoted item scenario. Root cause: unquoted search path leading to privilege escalation when a local attacker can place a malicious executable in the unquoted ...
CVE-2024-0963
The CVE-2024-0963 entry relates to the WordPress plugin Calculated Fields Form. It describes a Stored Cross-Site Scripting (XSS) flaw in the CP_CALCULATED_FIELDS shortcode, exploitable via the location attribute by authenticated users with contributor-level or higher permissions. Affected version...
Code injection
An issue in Blurams Lumi Security Camera A31C v.2.3.38.12558 allows a physically proximate attackers to execute arbitrary code...