Faveo Helpdesk SQL Injection Vulnerability

Faveo Helpdesk is an open source ticketing system built by Faveo based on Laravel framework. A security vulnerability exists in Faveo Helpdesk versions 1.0 through 1.11.1, which stems from a controlled parameter passed from the front-end of the login box to the back-end, resulting in an SQL...

Couchbase Server Access Control Vulnerability

Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in Couchbase Server versions 5.x through 7.x prior to 7.1.4, which stems from access...

PT-2023-10823

Name of the Vulnerable Software and Affected Versions zwczou WeChat SDK Python versions 0.3.0 through 0.5.4 Description A critical issue affects the validate/to xml function, leading to xml external entity reference. The attack may be initiated remotely. Recommendations To address this issue,...

CBL Mariner 2.0 Security Update: vim (CVE-2022-1420)

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-1420 advisory. - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774. CVE-2022-1420 Note that Nessu...

FasterXML jackson-databind security vulnerability

FasterXML jackson-databind is FasterXML company based on a JAVA can be XML and JSON and other data formats and JAVA objects for the conversion of the library . Jackson can be easily converted into Java objects and json objects and xml documents , the same can be json, xml conversion into Java...

cyber-range-scenarios

This repository is an offensive tool for cloud-based cyber ranges, specifically for training scenarios. It contains a collection of scripts and configurations for simulating various cyber attacks and vulnerabilities, including Shell Shock and libfutex privilege escalation. The repository uses...

CVE-2020-4927

A vulnerability in the Spectrum Scale 5.0.5.0 through 5.1.6.1 core component could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. IBM X-Force ID: 191695...

PT-2023-2201 · Eclipse · Eclipse Birt

Name of the Vulnerable Software and Affected Versions: Eclipse BIRT versions 2.6.2 through 4.12 Description: The issue is related to insufficient input validation when processing host headers with the report parameter. This could allow a remote attacker to gain unauthorized access to protected...

Microsoft Defender for Cloud Management Port Exposure Confusion

Prior to March 9, 2023, Microsoft Defender for Cloud incorrectly marked some Azure virtual machines as having secured management ports including SSH port 22/TCP, RDP port 3389/TCP and WINRM port 5985/TCP, when in fact one or more of these ports were exposed to the internet. This occured when the...

Mozilla Firefox security vulnerabilities

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 111, which stems from an issue in Firefox when accessing restricted streams requires checking that the number of available bytes is i...

7ghost (>=4.11.0, <=4.11.46), 90crew-sqlite-async (0.0.4) +265 more potentially affected by CVE-2022-43441 via sqlite3 (>=5.0.0, <=5.1.4)

sqlite3 NPM version =5.0.0, =4.11.0, =0.1.0, =0.0.15, =0.0.15, =1.1.0, =12.1.0-alpha.6, =2.0.11, =0.2.5, =6.1.4, =6.1.4, =7.0.1, =6.1.4, =0.1.3-alpha.0, =0.3.0 and more Source cves: CVE-2022-43441 Source advisory: OSV:GHSA-JQV5-7XPX-QJ74...

CVE-2022-31474

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1...

PT-2023-21225 · Maddy · Maddy

Name of the Vulnerable Software and Affected Versions: maddy versions 0.2.0 through 0.6.2 Description: The issue allows for a full authentication bypass if a SASL authorization username is specified when using the PLAIN authentication mechanisms. Instead of validating the specified username, it i...

CVE-2022-25709

Memory corruption in modem due to use of out of range pointer offset while processing qmi msg...

CVE-2022-25694

Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM...

Memory corruption

Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM...

Jenkins cross-site scripting vulnerability

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. A security vulnerability exists in Jenkins versions 2.270 through 2.393. An attacker exploited the vulnerability to execu...

Debian: Security Advisory (DLA-45-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-383-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-25709

CVE-2022-25709 describes a memory corruption in the data modem caused by using an out-of-range pointer offset while processing a QMI message. The vulnerability is tracked across multiple sources (NVD, Red Hat, CVE listings) and is categorized as High severity with local attack vector and local pr...