PT-2023-24878 · Unknown · Pleasanter

Name of the Vulnerable Software and Affected Versions: Pleasanter versions 1.3.47.0 and earlier Description: The issue is a stored cross-site scripting vulnerability. If exploited, it allows an arbitrary script to be executed on the user's web browser. Recommendations: For Pleasanter versions...

PT-2023-32672 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue concerns the /metrics endpoint, which is grouping calls by id and reporting this id in the response. Since this id corresponds to the channelID, the public /metrics endpoint is...

The vulnerability of the Trend Micro Mobile Security software for mobile devices lies in its improper path name limitation for the restricted access directory, which allows a hacker to delete any files they want.

The vulnerability of the Trend Micro Mobile Security software relates to an incorrect restriction on the path to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files...

Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass

Summary When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates the RFC because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another fronte...

GHSA-FVHJ-4QFH-Q2HM Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass

Summary When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates the RFC because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another fronte...

CVE-2023-28587 Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level...

CVE-2023-28551 Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments...

CVE-2023-21634 Improper Restriction of Operations within the Bounds of a Memory Buffer in Radio Interface Layer

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM...

PT-2023-31186 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: A Cross-Site Request Forgery CSRF issue was discovered in JFinalCMS. The vulnerability can be exploited via the /admin/slide/save API endpoint. Recommendations: For JFinalCMS version 5.0.0, update to a...

PT-2023-31230 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: A Cross-Site Request Forgery CSRF issue was discovered in JFinalCMS. The vulnerability can be exploited via the "/admin/nav/save" API endpoint. Recommendations: For JFinalCMS version 5.0.0, as a temporary...

PT-2023-7545 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Cisco Firepower Threat Defense FTD Software affected versions not specified Description: A vulnerability in the AnyConnect SSL VPN feature could allow an...

PT-2023-7502 · Apache · Apache Struts

Name of the Vulnerable Software and Affected Versions: Apache Struts versions 2.0.0 through 2.5.32 Apache Struts versions 6.0.0 through 6.3.0.1 Description: A critical vulnerability has been identified in Apache Struts, allowing attackers to manipulate file upload parameters and enable path...

PT-2023-26852 · Dell · Dell Rugged Control Center

Name of the Vulnerable Software and Affected Versions: Dell Rugged Control Center versions prior to 4.7 Description: The issue is related to improper access control. A local malicious standard user could potentially exploit this to modify content in an unsecured folder when product installation...

Security Bulletin: VMware Tanzu Spring Security is vulnerable to CVE-2023-34042 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses VMware Tanzu Spring Security, which is vulnerable to CVE-2023-34042. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2023-34042 DESCRIPTION: VMware Tanzu Spring Security could...

PT-2023-8682 · Unknown · Scalefusion

Name of the Vulnerable Software and Affected Versions: ScaleFusion versions 10.5.2 through 10.5.6 Description: The issue is related to insufficient access control in the isolated environment of Scalefusion MDM Agent, which can be exploited to impact the confidentiality, integrity, and availabilit...

Xxe

Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue...

PT-2023-32666 · Icecms · Icecms

Name of the Vulnerable Software and Affected Versions: IceCMS version 2.0.1 Description: A vulnerability has been found in IceCMS, affecting an unknown function of the file /WebArticle/articles/ of the component Like Handler. This issue leads to improper enforcement of a single, unique action and...

PT-2023-32623 · Tyler Technologies · Magistrate Court Case Management Plus

Name of the Vulnerable Software and Affected Versions: Tyler Technologies Magistrate Court Case Management Plus affected versions not specified Description: The issue allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the filename parameter in the...

PT-2023-27156 · Molongui · Molongui Author Box

Name of the Vulnerable Software and Affected Versions: Molongui Author Box, Guest Author and Co-Authors for Your Posts – Molongui versions through 4.6.19 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting...

PT-2023-27812 · Iqonic Design · Iqonic Design Wp Roadmap – Product Feedback Board

Name of the Vulnerable Software and Affected Versions: Iqonic Design WP Roadmap – Product Feedback Board versions 1.0.8 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This allows for stored XSS...