CVE-2023-0656

A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service DoS, which could cause an impacted firewall to crash...

CVE-2023-0656

A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service DoS, which could cause an impacted firewall to crash...

Path traversal

A Path Traversal in setup.php in OpenEMR 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server...

CVE-2023-22974

CVE-2023-22974 describes a path traversal in OpenEMR’s setup.php affecting versions earlier than 7.0.0. An unauthenticated remote attacker can read arbitrary files by manipulating a connection to an attacker-controlled MySQL server, due to the underlying directory-path handling in setup.php. Repo...

K23312037: Intel CPU vulnerability CVE-2018-3679

Security Advisory Description Escalation of privilege in Reference UI in Intel Data Center Manager SDK 5.0 and before may allow an unauthorized remote unauthenticated user to potentially execute code via administrator privileges. CVE-2018-3679 Impact There is no impact; F5 products are not affect...

K17514331: BIG-IP TMM vulnerability CVE-2022-23020

Security Advisory Description When the 'Respond on Error' setting is enabled on the Request Logging profile and configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. CVE-2022-23020 Impact Traffic is disrupted while the TMM process...

K04524282: XSS vulnerability in undisclosed TMUI page CVE-2018-15314

Security Advisory Description A reflected Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. CVE-2018-15314 Impact BIG-IP A remote unauthenticated...

K47204506: BIG-IP Advanced WAF and ASM bd vulnerability CVE-2022-41836

Security Advisory Description When an "Attack Signature False Positive Mode" enabled security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. CVE-2022-41836 Impact Traffic is disrupted while the bd process restarts. This vulnerability allows a...

CVE-2023-23695

Dell Secure Connect Gateway SCG version 5.14.00.12 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by performing MitM attacks and let attackers obtain sensitive information...

CVE-2022-41334

An improper neutralization of input during web page generation CWE-79 vulnerability in FortiOS versions 7.0.0 to 7.0.7 and 7.2.0 to 7.2.3 may allow a remote, unauthenticated attacker to launch a cross site scripting XSS attack via the "redir" parameter of the URL seen when the "Sign in with...

CVE-2022-30304

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting XSS attack via the URL parameter observed in the FortiWeb attack event...

CVE-2021-42761

A condition for session fixation vulnerability CWE-384 in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session...

CVE-2022-30304

FortiAnalyzer contains a cross-site scripting (XSS) vulnerability (CWE-79) that can be exploited remotely by an unauthenticated attacker via a URL parameter observed in the FortiWeb attack log view. Affects FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8; successful exploitation leads to s...

Fortinet FortiWeb 授权问题漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A security vulnerability exists in all...

XSS vulnerability due to AngularJS Client-Side Template injection

...

PYSEC-2023-49

Starlite is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 1.5.2, the request body parsing in starlite allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. The multipart body parser processes an unlimited number of file parts and ...

SUSE CVE-2006-0677

telnetd in Heimdal 0.6.x before 0.6.6 and 0.7.x before 0.7.2 allows remote unauthenticated attackers to cause a denial of service server crash via unknown vectors that trigger a null dereference...

SUSE CVE-2016-7072

An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and...

SUSE CVE-2016-9579

A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request. Ceph branches...

SUSE CVE-2018-0202

clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format .pdf...