2313 matches found
GeoVision GV-Edge Recording Manager 权限许可和访问控制问题漏洞
GeoVision GV-Edge Recording Manager is a video surveillance system from GeoVision Japan that realizes one-camera image management, remote monitoring, and more. A security vulnerability exists in GeoVision GV-Edge Recording Manager version 2.2.3.0, which originates from including incorrect...
GHSA-83FM-W79M-64R5 Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs
Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.3.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...
GHSA-X422-6QHV-P29G Relative path traversal in mlflow
Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1...
PT-2023-23002 · H2O · H2O
Name of the Vulnerable Software and Affected Versions: H2O versions 2.3.0-beta2 and prior Description: H2O is an HTTP server. When the reverse proxy handler tries to process a certain type of invalid HTTP request, it tries to build an upstream URL by reading from an uninitialized pointer. This...
PT-2023-12782 · Drupal · Drupal
Name of the Vulnerable Software and Affected Versions: Drupal version 9.3 Description: The issue arises from the incomplete integration of the generic entity access API for entity revisions with existing permissions in Drupal 9.3. This results in possible access bypass for users who have access t...
PT-2023-21584 · Avalanche · Avalanche
Name of the Vulnerable Software and Affected Versions: Avalanche versions 6.3.x and below Description: A path traversal vulnerability exists that could result in possible information disclosure when exploited. Recommendations: For Avalanche versions 6.3.x and below, at the moment, there is no...
PT-2023-21583 · Avalanche · Avalanche
Name of the Vulnerable Software and Affected Versions: Avalanche versions 6.3.x and below Description: An authentication bypass issue exists that could allow an attacker to gain access by exploiting the SetUser method or by exploiting a Race Condition in the authentication message. Recommendation...
pretalx 路径遍历漏洞
pretalx is a meeting planning tool from pretalx open source. Focused on providing the best experience for organizers, speakers, reviewers and attendees. A security vulnerability exists in pretalx version 2.3.1 up to versions prior to 2.3.2. An attacker can exploit the vulnerability to overwrite...
PT-2023-21732 · Pretalx · Pretalx
Name of the Vulnerable Software and Affected Versions: pretalx versions 2.3.1 through 2.3.1 Description: The issue allows path traversal in HTML export, a non-default feature. Users can upload crafted HTML documents that trigger the reading of arbitrary files. Recommendations: For pretalx version...
CVE-2023-27779
AM Presencia v3.7.3 was discovered to contain a SQL injection vulnerability via the user parameter in the login form...
WordPress plugin Metform Elementor Contact Form Builder 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...
CVE-2023-23987
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPEverest User Registration plugin = 2.3.0 versions...
PT-2023-20896 · Tenda · Tenda Ac10
Name of the Vulnerable Software and Affected Versions: Tenda AC10 US AC10V4.0si V16.03.10.13 cn Description: The issue is related to a stack overflow via the get parentControl list Info function, allowing attackers to cause a Denial of Service DoS or execute arbitrary code via a crafted payload...
PT-2023-15436 · Unknown · Quantumcloud Ai Chatbot Plugin
Name of the Vulnerable Software and Affected Versions: QuantumCloud AI ChatBot plugin versions prior to 4.3.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions prior to 4.3.0,...
PT-2023-19009 · Apple · Ipados +3
Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.3 iOS versions prior to 16.4 iPadOS versions prior to 16.4 Description: A logic issue was addressed with improved restrictions, allowing photos belonging to the Hidden Photos Album to be viewed without...
PT-2023-21626 · Apple · Apple Macos
Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.3 Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. An app may be able to disclose kernel memory. Recommendations: For...
PT-2023-21618 · Apple · Apple Macos
Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.3 Description: A denial-of-service issue was addressed with improved input validation. A remote user may be able to cause a denial-of-service. Recommendations: For versions prior to 13.3, update to macOS Ventura 13....
PT-2023-12946 · Totolink · Totolink Outdoor Cpe Cp900
Name of the Vulnerable Software and Affected Versions: TOTOLink outdoor CPE CP900 version 6.3c.566 B20171026 Description: A command injection issue exists in the setUpgradeFW function via the filename parameter, allowing attackers to execute arbitrary commands through a crafted request...
Ascensio System ONLYOFFICE 代码问题漏洞
Ascensio System ONLYOFFICE is an office software from Ascensio System, Latvia. A security vulnerability exists in ONLYOFFICE Docs versions prior to 7.3 that originates from a vulnerability that allows local users to gain privileges via the Trojan horse libgccs.so.1 in the current working director...