Security Bulletin: Vulnerabilities in Apache Commons, Tomcat, Go, libcurl, OpenSSL, Python, Node.js, and Linux can affect IBM Spectrum Protect Plus.

Summary IBM Spectrum Protect Plus can be affected by vulnerabilities in Apache Commons, Tomcat, Go, libcurl, OpenSSL, Python, Node.js, and Linux. Vulnerabilities include causing a denial of service, obtaining sensitive information, bypassing protections and restrictions, causing system crashes,...

Security Bulletin: Vulnerabilities in cURL libcurl, PostgreSQL, PyPI cryptography, Node.js can affect IBM Spectrum Protect Plus

Summary IBM Spectrum Protect Plus can be affected by vulnerabilities in cURL libcurl, PostgreSQL, PyPI cryptography, and Node.js. Vulnerabilities include obtaining sensitive information, causing a denial of service condition, and bypassing security restrictions, as described by the CVEs in the...

CVE-2023-35854

Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found...

Authentication flaw

DISPUTED Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they ha...

CVE-2023-35854: Missing Authentication for Critical Function

Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found...

Vulnerabilities fixed in IBM Spectrum Protect

IBM fixed vulnerabilities in Spectrum Protect Plus Microsoft Filesystem Backup and Restore. A malicious party could exploit the vulnerabilities to cause a denial-of-service, bypass a security measure, or gain access to sensitive data. IBM has released updates to fix the vulnerabilities in Spectru...

ZOHO ManageEngine ADSelfService Plus has an access control vulnerability

ZOHO ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. An access control error vulnerability exists in ZOHO ManageEngine ADSelfService Plus version 6113 and prior versions, which stems fro...

CVE-2023-35854

Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found...

CVE-2023-35854

The CVE-2023-35854 vulnerability affects Zoho ManageEngine ADSelfService Plus up to and including version 6113, via an authentication bypass in a critical function that can enable an attacker to steal a domain controller session token and impersonate a domain administrator. Affected component: au...

Marksoft Mobile+ has a SQL injection vulnerability

Marksoft is an application from Marksoft Corporation. A SQL injection vulnerability exists in Marksoft Mobile+ version v.7.1.7, Login version 1.4, and API version 20230605, which stems from an improper neutralization of a special element used to cause SQL injection...

CVE-2023-33438

A stored Cross-site scripting XSS vulnerability in Wolters Kluwer TeamMate+ 35.0.11.0 allows remote attackers to inject arbitrary web script or HTML...

CVE-2023-33438

A stored Cross-site scripting XSS vulnerability in Wolters Kluwer TeamMate+ 35.0.11.0 allows remote attackers to inject arbitrary web script or HTML...

PT-2023-24341 · Wolters Kluwer · Wolters Kluwer Teammate+

Name of the Vulnerable Software and Affected Versions: Wolters Kluwer TeamMate+ version 35.0.11.0 Description: A stored Cross-site scripting XSS vulnerability allows remote attackers to inject arbitrary web script or HTML. This issue enables attackers to potentially execute malicious scripts on t...

Wolters Kluwer TeamMate+ Cross-site Scripting Vulnerability

Wolters Kluwer TeamMate+ is a financial audit management software from Wolters Kluwer, a Dutch company. A security vulnerability exists in Wolters Kluwer TeamMate+ version 35.0.11.0. An attacker can exploit this vulnerability to execute arbitrary web script or HTML...

Microsoft Windows GDI+ security vulnerabilities

Microsoft Windows GDI+ is a graphical device interface for the Windows operating system from Microsoft USA. The software is part of the .NET Framework and is responsible for drawing graphical images and displaying information on screens and printers. A security vulnerability exists in Microsoft...

PT-2023-22709

Name of the Vulnerable Software and Affected Versions TMT Lockcell versions prior to 15 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations For versions...

Microsoft Office Excel FreePhisxdb arbitrary free vulnerability

Talos Vulnerability Report TALOS-2023-1730 Microsoft Office Excel FreePhisxdb arbitrary free vulnerability June 13, 2023 CVE Number CVE-2023-32029 SUMMARY An arbitrary free vulnerability exists in the FreePhisxdb functionality of Microsoft Office Excel 2019 Plus 16.0.16130.20218. A...

WhosHere Plus. Trilateration vulnerability

WhosHere Plus is a dating app that uses GPS data to recommend users near to each other, based on similar interests. PTP constantly researches the state of privacy and security in apps that use GPS data, because the consequences of poor security and privacy are alarming: Tracking and snooping on a...

Metasploit Weekly Wrap-Up

MOVEit It has been a busy few weeks in the security space; the MOVEit vulnerability filling our news feeds with dancing lemurs and a Barracuda vulnerability that has us all wondering how many shredders out there can handle a 1U appliance. Despite those very worthwhile distractions, Metasploit has...

PT-2025-38210

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to NFSv4.2 scratch handling for READ PLUS operations. The read code may send multiple requests using the same nfs pgio header, while nfs4 proc re...