CVE-2023-2545

The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOfUsers' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2023-2549

The Feather Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions starting from 1.0.7 up to, and including, 1.1.1. This is due to missing nonce validation in the 'createTempAccountLink' function. This makes it possible for unauthenticated attackers to create a ne...

PT-2023-24358 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R versions V9.1.0u.6118 B20201102 through V9.1.0u.6369 B20230113 Description: The issue is a post-authentication buffer overflow that occurs via the sPort/ePort parameter in the addEffect function. Recommendations: For TOTOLINK...

CVE-2022-36244

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripting XSS vulnerabilities via Shop Beat Control Panel found at www.shopbeat.co.za controlpanel.shopbeat.co.za...

CVE-2022-36249

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API...

PT-2023-24198 · Xibo · Xibo

Name of the Vulnerable Software and Affected Versions: Xibo versions 3.0.0 through 3.3.4 Description: Xibo is a content management system CMS that has an issue where some API routes print a stack trace when called with missing or invalid parameters, revealing sensitive information about the...

PT-2023-21818 · Wireshark +2 · Wireshark +2

Name of the Vulnerable Software and Affected Versions: Wireshark versions 3.6.0 through 3.6.13 Wireshark versions 4.0.0 through 4.0.5 Description: The issue is related to a crash in the BLF file parser, which can be exploited to cause a denial of service via a crafted capture file. Recommendation...

PT-2023-17686 · Unknown · Cloud Foundry

Name of the Vulnerable Software and Affected Versions: Cloud Foundry routing release versions 0.262.0 through 0.266.0 Description: A bug in the gorouter process can cause a denial of service for applications hosted on Cloud Foundry. This occurs when client connections are closed prematurely,...

CVE-2023-33248

Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz often outside the range of human adult hearing. Commands at these frequencies are essentially...

PT-2023-14070 · Unknown · Jumpserver

Name of the Vulnerable Software and Affected Versions: Jumpserver versions 2.10.0 through 2.26.0 Description: The issue is related to multiple stored XSS vulnerabilities due to improper filtering of user input. This can lead to the execution of any javascript under admin's permission...

Liferay Portal和Liferay DXP 安全漏洞

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

PT-2023-24243 · Amazon · Amazon Alexa

Name of the Vulnerable Software and Affected Versions: Amazon Alexa software version 8960323972 Description: The issue allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz, which is often outside the range of human adult hearing. Commands at these...

CVE-2023-27507

MicroEngine Mailform version 1.1.0 to 1.1.8 contains a path traversal vulnerability. If the product's file upload function and server save option are enabled, a remote attacker may save an arbitrary file on the server and execute it...

Design/Logic Flaw

Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools. An attacker, who already has local access to the QCS nodes, could successfully obtain the password for a system user account. Using this information, the attacker could...

Apache InLong 安全漏洞

Apache InLong is the United States Apache Apache Foundation's one-stop massive data integration framework. An authorization issue vulnerability exists in Apache InLong versions 1.2.0 through 1.6.0. The vulnerability stems from improper privilege management. An attacker can exploit the vulnerabili...

Apache InLong 安全漏洞

Apache InLong is the United States Apache Apache Foundation's one-stop massive data integration framework. A security vulnerability exists in Apache InLong versions 1.1.0 through 1.6.0, which stems from an application that does not set a complexity requirement for user passwords, and can be...

Apache InLong 代码问题漏洞

Apache InLong is the United States Apache Apache Foundation's one-stop massive data integration framework. A security bypass vulnerability exists in Apache InLong versions 1.4.0 through 1.6.0, which stems from insufficient session expiration, and can be exploited by an attacker to reuse old...

UBUNTU-CVE-2023-33250

The Linux kernel 6.3 has a use-after-free in ioptunmapiovarange in drivers/iommu/iommufd/iopagetable.c...

Denial Of Services (DoS)

vyper is vulnerable to Denial Of Services DoS. The vulnerability exists due to an integer overflow in the parseForrange function of stmt.py for loops of the form for i in rangex, x+N, which results in an application crash by assigning the iterator of a loop to a variable...

apache-commons-text: variable interpolation RCE

A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code...