CVE-2023-40545

Authentication bypass when an OAuth2 Client is using clientsecretjwt as its authentication method on affected 11.3 versions via specially crafted requests...

Ping Identity PingFederate Access Control Error Vulnerability

Ping Identity PingFederate is a flagship software-based federation server in the United States. used for identity management. Ping Identity A security vulnerability exists in PingFederate version 11.3, which stems from the fact that authentication can be bypassed...

PT-2024-20226 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP version 3.3 Description: The issue concerns an Arbitrary File Upload vulnerability. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulti...

CVE-2023-6846

The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mkcheckfilemanagerphpsyntax AJAX function. This makes it possible for authenticated attackers, with subscriber access and above, to execute code on the server...

CVE-2023-47564

An incorrect permission assignment for critical resource vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow authenticated users to read or modify the resource via a network. We have already fixed the vulnerability in the following versions: Qsync...

PT-2024-19245 · Peepso · Peepso Community

Name of the Vulnerable Software and Affected Versions: PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles versions prior to 6.3.1.0 Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site...

PT-2024-13839 · Logpoint · Logpoint Siem

Name of the Vulnerable Software and Affected Versions: Logpoint SIEM versions 6.10.0 through 7.x before 7.3.0 Description: The Jinja templating in Logpoint SIEM does not correctly sanitize log data being displayed when using a custom Jinja template in the Alert view. A remote attacker can craft a...

Apple iOS and iPadOS Security Vulnerabilities

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS version 17.3 and iPadOS version 17.3, which stems from a shortcut that may be...

PT-2024-1264 · Apple · Ipados +4

Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.3 watchOS versions prior to 10.3 tvOS versions prior to 17.3 iOS versions prior to 17.3 iPadOS versions prior to 17.3 Description: The issue is related to the handling of temporary files, which may allow an a...

Apple tvOS Security Breach

Apple tvOS is a smart TV operating system from Apple. A security vulnerability exists in Apple tvOS version 17.3, which stems from an application that may be able to access sensitive user data...

Apple tvOS Security Breach

Apple tvOS is a smart TV operating system from Apple. A security vulnerability exists in Apple tvOS version 17.3, which stems from an application that may be able to access sensitive user data...

Apple tvOS Security Breach

Apple tvOS is an operating system for smart TVs from Apple. A security vulnerability exists in Apple tvOS version 17.3, which originates from an application that may be able to execute arbitrary code using kernel privileges...

SUSE-SU-2024:0128-1 Security update for cloud-init

This update for cloud-init contains the following fixes: - Move fdupes call back to %install.bsc1214169 - Update to version 23.3. bsc1216011 bsc1215794 bsc1215740 bsc1216007 + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support 4390 + Fix cckeyboard in mantic LP: 2030788 + ec2: initiali...

GTKWave buffer overflow vulnerability (CNVD-2024-04846)

GTKWave is a full-featured, GTK+-based waveform viewer from GTKWave. A buffer overflow vulnerability exists in GTKWave version 3.3.115, which can be exploited by an attacker to cause arbitrary code execution via specially crafted .fst files...

Schneider Electric Easergy Studio Code Issue Vulnerability

Schneider Electric Easergy Studio is an IED support software for setup and configuration from Schneider Electric France. A code issue vulnerability exists in versions prior to Schneider Electric Easergy Studio v9.3.5 that stems from the presence of untrusted data deserialization, which could allo...

IBM CICS Transaction Gateway 安全漏洞

IBM CICS Transaction Gateway is a connector for modernizing enterprise CICS assets from International Business Machines IBM. An access control error vulnerability exists in IBM CICS Transaction Gateway version 9.3, which can be exploited by an attacker to transfer or view files...

PT-2024-13411 · Ibm · Ibm Cics Transaction Gateway

Name of the Vulnerable Software and Affected Versions: IBM CICS Transaction Gateway version 9.3 Description: The issue is related to improper access controls in IBM CICS Transaction Gateway, which could allow a user to transfer or view files. Recommendations: For IBM CICS Transaction Gateway...

CVE-2023-6093

A clickjacking vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. This vulnerability is caused by incorrectly restricts frame objects, which can lead to user confusion about which interface the user is interacting with. This vulnerability may lead the...

OnCell G3150A-LTE Security Vulnerability

Moxa OnCell G3150A-LTE is a reliable and secure LTE gateway from Moxa China. A security vulnerability exists in OnCell G3150A-LTE v1.3 and earlier versions, which stems from the lack of protection of sensitive information during transmission, and an attacker may be able to obtain sensitive...

PYSEC-2023-248

An open redirect vulnerability in the python package Flask-Security-Too =5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes...