Dell DM5500 操作系统命令注入漏洞

The Dell DM5500 is an integrated solution from Dell, Inc. It provides industry-leading deduplication, data protection solutions and multi-cloud capabilities. The Dell DM5500 suffers from an elevation of privilege vulnerability that can be exploited by an attacker to escape a restricted shell and...

IBM Db2 Security Vulnerabilities

IBM Db2 is a relational database management system from International Business Machines IBM. The system executes on UNIX, Linux, IBMi, z/OS, and Windows server versions. A security vulnerability exists in IBM Db2 that originates from allowing users with DATAACCESS privileges to execute routines...

PT-2023-30965 · Unknown · Senayan Library Management Systems (Slims) 9 Bulian

Name of the Vulnerable Software and Affected Versions: Senayan Library Management Systems Slims 9 Bulian version 9.6.1 Description: The issue concerns a SQL Injection vulnerability. It can be exploited via the admin/modules/reporting/customs/fines report.php endpoint. Recommendations: For version...

PT-2023-7700 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server versions 10.5, 11.1, and 11.5 Description: The issue is related to insufficient access control in the IBM DB2 database management system. Exploitation of this issue could allow a...

Restricted Site Access <= 7.4.1 - IP Spoofing to Protection Mechanism Bypass

Description The Restricted Site Access plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 6.3.0. This is due to insufficient restrictions on where the IP Address information is being retrieved for user IP Addresses. This makes it possible for attackers to...

CVE-2023-6376

Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attacker to access restricted documents...

Design/Logic Flaw

Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attacker to access restricted documents...

CVE-2023-6352 Aquaforest TIFF Server default configuration allows access to arbitrary files

The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services IIS or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate...

CVE-2023-6376 Henschen & Associates court document management software cache uses predictable file names

Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attacker to access restricted documents...

PT-2023-32621 · Microsoft +1 · Windows +2

Name of the Vulnerable Software and Affected Versions: Aquaforest TIFF Server affected versions not specified Description: The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services IIS or Microso...

Henschen & Associates court document management software Security Feature Issue Vulnerability

Henschen & Associates court document management software is a court document management software from Henschen & Associates. A security vulnerability exists in Henschen & Associates court document management software, which arises from insufficient randomization of the filenames of cached...

The vulnerability of server-based corporate software for monitoring and managing project knowledge bases in Adobe RoboHelp Server arises from incorrect restrictions on path names to restricted access catalogs. This allows attackers to execute arbitrary code.

The vulnerability of server-based corporate software for project monitoring and management in Adobe RoboHelp Server relates to incorrect path name restrictions for restricted access directories. Exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely...

WordPress Restricted Site Access Plugin <= 7.4.1 is vulnerable to Bypass Vulnerability

Software Restricted Site Access Type Plugin Vulnerable versions = 7.4.1 Fixed in 7.5.0 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-48753 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 4346ee127b88 Credits Mika Required...

PT-2023-32210 · Tacc · Tacc Epo Extension

Name of the Vulnerable Software and Affected Versions: TACC ePO extension versions prior to 8.4.0 Description: The issue is related to an improper limitation of a path name to a restricted directory, which could allow an authorized administrator attacker to execute arbitrary code by uploading a...

Dell Command | Monitor 安全漏洞

The Dell Command Monitor software application enables IT administrators to easily manage fleet inventory, monitor system operating conditions, modify BIOS settings, and remotely collect information from deployed Dell client systems. Proactive system health monitoring can help reduce total system...

PT-2023-28107 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 700 through 773 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows Javascript code to be executed in some Widgets' text bo...

CVE-2023-5314

The WP EXtra plugin for WordPress is vulnerable to unauthorized access to restricted functionality due to a missing capability check on the 'test-email' section of the register function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with minimal...

Design/Logic Flaw

The WP EXtra plugin for WordPress is vulnerable to unauthorized access to restricted functionality due to a missing capability check on the 'test-email' section of the register function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with minimal...

CVE-2023-5314 WP EXtra <= 6.2 - Missing Authorization to Arbitrary Email Sending

The WP EXtra plugin for WordPress is vulnerable to unauthorized access to restricted functionality due to a missing capability check on the 'test-email' section of the register function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with minimal...

The vulnerability of the microprogramming-based power supply systems of Galaxy VL and Galaxy VS lies in the improper limitation of the path name to the restricted access catalog. This allows attackers to load arbitrary files into the system.

The vulnerability of the microprogramming-based power supply systems of Galaxy VL and Galaxy VS is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to load arbitrary files into the system...