PT-2023-27687

Name of the Vulnerable Software and Affected Versions Tenda AC8 version US AC8V4.0si V16.03.34.06 cn Description A stack overflow issue was discovered via the time parameter at the "/goform/PowerSaveSet" API endpoint. This issue can be exploited, potentially leading to unintended consequences...

PT-2023-27692 · Tenda · Tenda Ac8

Name of the Vulnerable Software and Affected Versions: Tenda AC8 version US AC8V4.0si V16.03.34.06 cn Description: A stack overflow issue was discovered, which can be triggered via the macFilterType and deviceList parameters at the "/goform/setMacFilterCfg" API endpoint. Recommendations: For Tend...

(0Day) LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the copyContent command. Due to the improper restriction ...

PT-2023-27690 · Tenda · Tenda Ac8

Name of the Vulnerable Software and Affected Versions: Tenda AC8 version US AC8V4.0si V16.03.34.06 cn Description: A stack overflow issue was discovered via the mac parameter at the "/goform/GetParentControlInfo" API endpoint. This issue affects the Tenda AC8 router. Recommendations: For Tenda AC...

PT-2023-27694 · Tenda · Tenda Ac8

Name of the Vulnerable Software and Affected Versions: Tenda AC8 version US AC8V4.0si V16.03.34.06 cn Description: A stack overflow issue was discovered via the parameter list at the "/goform/SetNetControlList" API endpoint. This issue affects the Tenda AC8 router. Recommendations: For Tenda AC8...

PT-2023-27688 · Tenda · Tenda Ac8

Name of the Vulnerable Software and Affected Versions: Tenda AC8 version US AC8V4.0si V16.03.34.06 cn Description: A stack overflow issue was discovered via the parameter list at the "/goform/SetStaticRouteCfg" API endpoint. This issue affects the Tenda AC8 router. Recommendations: For Tenda AC8...

PT-2023-4809 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.9 XWiki Platform versions prior to 15.4RC1 Description: The create action in XWiki Platform is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with...

PT-2023-11506 · Zziplib +6 · Zziplib +6

Name of the Vulnerable Software and Affected Versions: zziplib version 0.13.69 Description: An issue was discovered in the function zzip disk entry to file header in mmapped.c, which will lead to a denial-of-service. Recommendations: For zziplib version 0.13.69, consider applying a patch or fix t...

PT-2023-11587 · Freeimage +2 · Freeimage +2

Name of the Vulnerable Software and Affected Versions: FreeImage version 3.18.0 Description: The issue allows remote attackers to run arbitrary code and cause other impacts via a crafted image file, exploiting a Buffer Overflow vulnerability in the LoadRGB function in PluginDDS.cpp...

PT-2023-7054 · Apache +2 · Apache Xml Graphics Batik +2

Name of the Vulnerable Software and Affected Versions: Apache XML Graphics Batik version 1.16 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability in the Apache XML Graphics Batik library, which is used for working with SVG images. This vulnerability is caused by...

PT-2023-6726 · Unknown · Webui-Aria2

Name of the Vulnerable Software and Affected Versions: webui-aria2 version 4fe2e Description: The issue is related to a path traversal vulnerability in the WebUI-Aria2 interface. This vulnerability is due to incorrect restriction of the directory path name with limited access. Exploitation of thi...

PT-2023-4504 · Google +2 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 116.0.5845.110 Description: The issue is related to an out of bounds memory access in V8, allowing a remote attacker to perform an out of bounds memory read via a crafted HTML page. This can potentially impact...

CVE-2023-25914

Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interface. The information that can be read can lead to a full system compromise...

CVE-2023-25914 Authneticated Path Traversal in Danfoss AK-SM800A

Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interface. The information that can be read can lead to a full system compromise...

CVE-2023-25914 Authneticated Path Traversal in Danfoss AK-SM800A

Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interface. The information that can be read can lead to a full system compromise...

CVE-2023-25914

CVE-2023-25914 describes a path-traversal flaw in the Danfoss AK-SM800A system manager. Authenticated attackers could read arbitrary server files via the product’s XML interface, potentially enabling full system compromise. Affected versions cited include 3.3 and earlier in multiple feeds; root c...

PT-2023-4447

Name of the Vulnerable Software and Affected Versions Ivanti MobileIron Sentry versions 9.18.0 and below Description A security vulnerability in the MICS Admin Portal of Ivanti MobileIron Sentry may allow an attacker to bypass authentication controls on the administrative interface due to an...

Medium: nerdctl

Issue Overview: 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192...

PT-2023-29269 · Wallabag · Wallabag

Name of the Vulnerable Software and Affected Versions: wallabag versions prior to 2.6.3 Description: The issue is related to Cross-Site Request Forgery CSRF in the wallabag GitHub repository. This allows attackers to arbitrarily reset annotations, entries, and tags by sending a GET request to...

PT-2023-27036 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R version B20210419 Description: A remote code execution issue was found in the setTracerouteCfg interface, allowing for potential code execution. Recommendations: For TOTOLINK X5000R version B20210419, consider restricting acce...