876 matches found
CVE-2023-6912
Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords...
AZL-32204 CVE-2023-48795 affecting package openssh for versions less than 8.9p1-4
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...
Design/Logic Flaw
Adobe InDesign versions 19.0 and earlier and 17.4.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user...
AZL-35019 CVE-2023-46218 affecting package mysql for versions less than 8.0.40-1
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a...
PT-2023-15046 · Unknown · Webtoffee Product Reviews Import Export For Woocommerce
Name of the Vulnerable Software and Affected Versions: WebToffee Product Reviews Import Export for WooCommerce versions 1.4.8 and earlier Description: The issue is related to the improper neutralization of formula elements in a CSV file, which can lead to potential security risks. Recommendations...
VideoLAN VLC media player security vulnerability
VideoLAN VLC media player is a free, open source cross-platform multimedia player also a multimedia framework organized by VideoLAN France. It supports the playback of a wide range of media files, CD-ROMs, etc., audio and video formats WMV, MP3, etc., and more. A security vulnerability exists in...
CVE-2023-5082
The History Log by click5 WordPress plugin before 1.0.13 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when using the Smash Balloon Social Photo Feed plugin alongside it...
PT-2023-30367 · Unknown · Transmute-Core
Name of the Vulnerable Software and Affected Versions: transmute-core versions prior to 1.13.5 Description: The issue concerns unsafe YAML deserialization in the yaml.Loader component of transmute-core, allowing attackers to execute arbitrary Python code. Recommendations: For versions prior to...
CVE-2023-5727
The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which can run commands on a user's computer. Note: This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox 119,...
Exploit for Improper Access Control in Pnpm
pnpm vs npm exploit This repo showcases how a difference...
Home Assistant Code Injection Vulnerability
Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home Assistant versions prior to 2023.9.2 that stems from an arbitrary URL loading issue in WebView. An attacker can exploit the...
AZL-34818 CVE-2023-39325 affecting package jx for versions less than 3.10.182-1
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...
[SECURITY] Fedora 39 Update: python3.8-3.8.18-1.fc39
Python 3.8 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.8, see other distributions that support it, such as an older Fedora release...
Proofpoint Insider Threat Management Trust Management Issues Vulnerabilities
Proofpoint Insider Threat Management Proofpoint ITM is an insider threat management system from Proofpoint USA. A trust management issue vulnerability exists in Proofpoint Insider Threat Management versions prior to 7.14.3.69, which stems from an incorrect authentication verification vulnerabilit...
PT-2023-7548 · Honeywell · Honeywell Pm43
Name of the Vulnerable Software and Affected Versions: Honeywell PM43 versions prior to P10.19.050004 Description: The issue affects the Honeywell PM43 printer, specifically the 32-bit, ARM-based printer web page modules, allowing privilege escalation due to files or directories being accessible ...
Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2
The Mozilla Foundation Security Advisory describes this flaw as: Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run...
Fedora: Security Advisory for python3.8 (FEDORA-2023-e49d18c283)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2023-25143 · WordPress · Mpembed Wp Matterport Shortcode
Name of the Vulnerable Software and Affected Versions: MPEmbed WP Matterport Shortcode plugin versions 2.1.4 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher privileges. There...
PT-2023-18015 · WordPress · Wp Inventory Manager
Name of the Vulnerable Software and Affected Versions: WP Inventory Manager versions prior to 2.1.0.13 Description: The issue is related to a Reflected Cross-Site Scripting problem. The WP Inventory Manager WordPress plugin does not properly sanitise and escape a parameter before outputting it ba...