CVE-2023-4217 Session cookies attribute not set properly

A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation...

CVE-2023-4217 Session cookies attribute not set properly

A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected application. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation...

MOXA PT-G503 Security Vulnerability

MOXA PT-G503 is a series of Layer 2 managed switches from China's MOXA. A security vulnerability exists in MOXA PT-G503 v5.2 and earlier versions, which stems from not setting the security attribute of a sensitive cookie in an HTTPS session, which could result in the cookie being transmitted in...

MOXA PT-G503 安全漏洞

MOXA PT-G503 is a series of Layer 2 managed switches from MOXA China. The MOXA PT-G503 unauthorized access vulnerability can be exploited by a remote attacker to submit a special request that can be used to gain unauthorized access to and manipulate user session data...

PT-2023-27457 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 17.1 iPadOS versions prior to 17.1 Description: The issue was addressed with improved UI handling. A device may persistently fail to lock. Recommendations: For iOS versions prior to 17.1, update to iOS 17.1 to resolve th...

PT-2023-31182

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description The issue allows for the sideloading of a compromised DLL during installation at elevated privilege. Recommendations At the moment, there is no information about a newer version that...

PT-2023-6338 · Microsoft · Sql Server

Name of the Vulnerable Software and Affected Versions: Microsoft SQL Server affected versions not specified Description: The issue is related to insufficient input validation in Microsoft SQL Server, which can be exploited to cause a denial of service. This allows an attacker to affect the system...

CVE-2023-42449

Hydra is the two-layer scalability solution for Cardano. Prior to version 0.13.0, it is possible for a malicious head initializer to extract one or more PTs for the head they are initializing due to incorrect data validation logic in the head token minting policy which then results in an flawed...

Design/Logic Flaw

Hydra is the two-layer scalability solution for Cardano. Prior to version 0.13.0, it is possible for a malicious head initializer to extract one or more PTs for the head they are initializing due to incorrect data validation logic in the head token minting policy which then results in an flawed...

CVE-2023-42449 Malicious head initialiser can extract PTs from control of Hydra scripts, leading to locked participant commits or spoofed commits

Hydra is the two-layer scalability solution for Cardano. Prior to version 0.13.0, it is possible for a malicious head initializer to extract one or more PTs for the head they are initializing due to incorrect data validation logic in the head token minting policy which then results in an flawed...

CVE-2023-42449 Malicious head initialiser can extract PTs from control of Hydra scripts, leading to locked participant commits or spoofed commits

Hydra is the two-layer scalability solution for Cardano. Prior to version 0.13.0, it is possible for a malicious head initializer to extract one or more PTs for the head they are initializing due to incorrect data validation logic in the head token minting policy which then results in an flawed...

PT-2023-27909 · Cilium · Cilium

Name of the Vulnerable Software and Affected Versions: Cilium versions prior to 1.14.2 Cilium versions prior to 1.13.7 Cilium versions prior to 1.12.14 Description: In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with policy.cilium.io/proxy-visibility...

PT-2023-6853 · Moxa · Moxa Pt-G503 Series

Name of the Vulnerable Software and Affected Versions: Moxa PT-G503 Series firmware versions prior to v5.2 Description: The issue is related to the absence of the secure flag in session cookies, which could allow a remote attacker to gain unauthorized access to protected information. This may lea...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: Im speaking at swampUP 2023 in San Jose, California, on September 13, 2023 at 11:35 AM PT. The list is maintained on this page...

PT-2023-5130 · Microsoft · Windows Miracast Wireless Display +1

Name of the Vulnerable Software and Affected Versions: Windows Miracast Wireless Display affected versions not specified Description: The vulnerability is related to insufficient input validation in the Windows Miracast Wireless Display adapter. It allows remote attackers to execute arbitrary cod...

PT-2023-5890 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: Open5GS affected versions not specified Description: The issue is related to the lack of authentication in the Open5GS implementation of the GTP protocol for mobile networks. This allows a remote attacker to send an HTTP request to an Open5GS...

PT-2023-25255 · Google · Android

Name of the Vulnerable Software and Affected Versions: NotificationAccessSettings.java affected versions not specified Description: The issue is caused by a logic error in the code of NotificationAccessSettings.java, specifically in the updateList method. This error can lead to the hiding of...

CVE-2023-2813 Multiple Themes - Reflected XSS

All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2,...

PT-2023-4591 · D Link · D-Link Dar-8000-10

Name of the Vulnerable Software and Affected Versions: D-Link DAR-8000-10 up to 20230809 Description: A critical issue affects the file /app/sys1.php, where the manipulation of the cmd argument with the input id leads to os command injection. This can be initiated remotely. The exploit has been...

PT-2023-4490 · Igor Pavlov +1 · 7-Zip +1

Name of the Vulnerable Software and Affected Versions: 7-Zip affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this issue, where the target must visit a malicious pa...