5071 matches found
PT-2023-25652 · Grafana +1 · Loki +2
Name of the Vulnerable Software and Affected Versions: ProLion CryptoSpike version 3.0.15P2 Description: The issue allows remote attackers to impersonate other users in web management and the REST API by reading JWT tokens from logs as a Grafana authenticated user or from the Loki REST API withou...
PT-2023-32715 · Typecho · Typecho
Name of the Vulnerable Software and Affected Versions: Typecho version 1.2.1 Description: A vulnerability has been found in the Logo Handler component of Typecho, affecting an unknown function of the file /admin/options-theme.php. This issue leads to cross site scripting and can be exploited...
PT-2023-7498 · Microsoft · Edge
Name of the Vulnerable Software and Affected Versions: Microsoft Edge affected versions not specified Description: The issue is related to insufficient input validation in Microsoft Edge, allowing a remote attacker to gain unauthorized access to protected information. Recommendations: At the...
PT-2023-30983 · Unknown · Appointment Scheduler
Name of the Vulnerable Software and Affected Versions: Appointment Scheduler version 3.0 Description: A lack of rate limiting in pjActionAjaxSend allows attackers to cause resource exhaustion. There is no information provided about the estimated number of potentially affected devices worldwide or...
PT-2023-31451 · Tenda · Tenda W30E
Name of the Vulnerable Software and Affected Versions: Tenda W30E version 16.01.0.124843 Description: A stack overflow issue was discovered via the function formResetMeshNode. Recommendations: For Tenda W30E version 16.01.0.124843, as a temporary workaround, consider disabling the formResetMeshNo...
PT-2023-32283 · WordPress · System Dashboard
Name of the Vulnerable Software and Affected Versions: System Dashboard plugin for WordPress versions up to, and including, 2.8.7 Description: The issue allows unauthorized access to data due to a missing capability check on the sd constants function hooked via an AJAX action. This makes it...
PT-2023-11905 · Rl Institut · Nesp2
Name of the Vulnerable Software and Affected Versions: rl-institut NESP2 version 1.0 Description: A critical issue has been found, allowing for sql injection through an unknown function in the file app/database.py. This can be exploited remotely. The issue has been publicly disclosed and a patch ...
WordPress Nested Pages Plugin <= 3.2.6 is vulnerable to Cross Site Scripting (XSS)
Software Nested Pages Type Plugin Vulnerable versions = 3.2.6 Fixed in 3.2.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49195 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 12ebb2b0a5fd Credits emad Required privilege Administrator...
PT-2023-7349 · Foxit · Foxit Reader
Name of the Vulnerable Software and Affected Versions: Foxit Reader version 12.1.3.15356 Description: A code execution issue exists in the Javascript saveAs API of Foxit Reader. This is due to the improper handling of specially crafted malformed files, which can lead to the creation of arbitrary...
CVE-2023-48239 Nextcloud Server users can make external storage mount points inaccessible for other users
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in version 20.0.0 and prior to versions 20.0.14.16, 21.0.9.13, 22.2.10.15, 23.0.12.12, 24.0.12.8,...
PT-2023-8868 · Foxit · Foxit Pdf Editor +1
Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader affected versions not specified Foxit PDF Editor affected versions not specified Description: The issue is related to the use of memory after it has been freed when handling Doc objects, which can allow an attacker to execute...
Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodes
CVSS Rating: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - HIGH 7.2 A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they ar...
OESA-2023-1801 shim security update
Initial UEFI bootloader that handles chaining to a trusted full \ bootloader under secure boot environments. Security Fixes: A vulnerability classified as critical has been found in rhboot shim up to 15.7 on ARM. This affects the function mirroroneesl of the file mok.c of the component mok...
Any value can be changed in the configuration table by an employee having access to block reassurance module
Impact An ajax function in module blockreassurance allows modifying any value in the configuration table Patches v5.1.4 Workarounds no workaround available References...
CVE-2023-41419 affecting package python-gevent for versions less than 1.3.6-9
CVE-2023-41419 affecting package python-gevent for versions less than 1.3.6-9. A patched version of the package is available...
CVE-2023-3817 affecting package edk2 for versions less than 20230301gitf80f052277c8-37
CVE-2023-3817 affecting package edk2 for versions less than 20230301gitf80f052277c8-37. A patched version of the package is available...
PT-2023-7246 · Asus · Asus Rt-Ac87U
Name of the Vulnerable Software and Affected Versions: ASUS RT-AC87U all versions Description: An improper access control issue exists, related to the implementation of the TFTP protocol, allowing an attacker to read or write files not intended for access. This can be achieved by connecting to th...
Cross site scripting
Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability is fixed...
Medium: wireshark
Issue Overview: RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file CVE-2023-5371 Affected Packages: wireshark Issue Correction: Run dnf update wireshark --releasever 2023.2.20231030 or dnf update...