LinkedIn: Employee-only Area Bypass

An improper access control issue allowed unauthorized access to an employee-only area, leading to information disclosure...

CVE-2023-50569

DO NOT USE THIS CVE RECORD. Consult IDs: CVE-2023-50250. Reason: This record is a reservation duplicate of CVE-2023-50250. Notes: All CVE users should reference CVE-2023-50250 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.21-openssl (SUSE-SU-2023:4931-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4931-1 advisory. Update to version 1.21.5.1: - CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.20-openssl (SUSE-SU-2023:4930-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4930-1 advisory. Update to version 1.20.12.1: - CVE-2023-45285: cmd/go: git VCS qualifier in module path uses...

CVE-2023-50459

CVE-2023-50459 corresponds to a Broken Access Control issue in the TYPO3 extension femanager (in2code). The connected advisories identify the vulnerable components as the check_edit_user component (improper access checks) and a missing backend access check, enabling an authenticated frontend user...

CVE-2021-44910

CVE-2021-44910 is described in the NUCLEI template as an information-leak issue in the SpringBlade framework. The root cause is a default SIGN_KEY used for JWT signing, which can be exploited to forge tokens and access sensitive data (e.g., user credentials, password hashes, and logs) within Spri...

CVE-2023-50462

The connected sources confirm CVE-2023-50462 corresponds to an Insecure Direct Object Reference (IDOR) in the TYPO3 extension Content Consent (content_consent). Root cause: the extension fails to verify whether a requested content element identifier is permitted, allowing unauthenticated users to...

CVE-2023-50461

CVE-2023-50461 corresponds to a TYPO3 Direct Mail extension vulnerability. The Direct Mail backend’s Configuration module allows an authenticated backend user to write arbitrary TSConfig for folders configured as Direct Mail, which can lead to Configuration Injection and Arbitrary Code Execution....

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.20 (SUSE-SU-2023:4708-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4708-1 advisory. Update to go1.20.12: - CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// sche...

CVE-2023-43020

CVE-2023-43020 is evidenced in IBM bulletins as a denial-of-service vulnerability in IBM Db2 (including Db2 Connect Server) when processing a specially crafted query. Affected products span Db2 on Linux/UNIX/Windows (versions 10.5, 11.1, 11.5; Db2 Big SQL is also listed in related bulletins). The...

CVE-2021-26292

The CVE-2021-26292 entry maps to AfterLogic Aurora and WebMail Pro

MGASA-2023-0323 Fix u-boot reading file would overwrite reserved memory error

U-boot would not boot after upgrading to 2023.01 version on RPI 4/CM4 boards. Log would report: - Found EFI removable media binary efi/boot/bootaa64.efi - Reading file would overwrite reserved memory The updated package allows u-boot to load properly bootaa64.efi...

Fix u-boot reading file would overwrite reserved memory error

U-boot would not boot after upgrading to 2023.01 version on RPI 4/CM4 boards. Log would report: - Found EFI removable media binary efi/boot/bootaa64.efi - Reading file would overwrite reserved memory The updated package allows u-boot to load properly bootaa64.efi...

CVE-2023-39120

Nodogsplash is affected by a directory traversal vulnerability (CVE-2023-39120) that also impacts OpenWrt. The issue allows remote attackers to read arbitrary files from the target system and is mitigated by upgrading Nodogsplash to version 5.0.1. The Nuclei template notes the vulnerability and s...

CVE-2023-1434

Odoo prior to 16.0 is vulnerable to CVE-2023-1434 due to an incorrect Content-Type on an API endpoint, enabling Cross-Site Scripting. The NUCLEI template notes the issue affects versions before 16.0 and describes the root cause as a mis-set content type in an API handler. Impactally, successful e...

CVE-2021-27748

CVE-2021-27748 is associated with IBM WebSphere HCL Digital Experience and represents a Server-Side Request Forgery (SSRF) vulnerability that affects on‑premise deployments and containerized environments. The Nuclei template flags an SSRF issue in WebSphere DX, enabling an attacker to bypass secu...

CVE-2021-28854

VICIdial Web Client is reported vulnerable to information disclosure (CVE-2021-28854). The Nuclei template describes that sensitive files are accessible from the client side, including mysqli logs, auth logs, debug information, login attempts (successful and unsuccessful) with IPs, User-Agents, a...

CVE-2021-28073

CVE-2021-28073 corresponds to an authentication bypass in ntopng <= 4.2. The Nuclei template describes a vulnerability in ntopng that could allow unauthorized access to sensitive information due to bypassing authentication. Affected product: ntopng (network traffic monitor) with version

CVE-2018-10818

Connected document details confirm CVE-2018-10818 affects LG NAS devices, via a pre-auth remote command injection in the password parameter exposed through the /system/sharedir.php endpoint. The attack vector is unauthenticated and could enable arbitrary code execution on affected devices. Concre...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.20 (SUSE-SU-2023:4470-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4470-1 advisory. go1.20.11 released 2023-11-07 includes security fixes to the path/filepath package, as well as b...