Moxa EDR-810/G902/G903 Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2020-28144)

Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5 or lower, EDR-G902 Series Firmware Version 5.5 or lower, and EDR-810 Series Firmware Version 5.6 or lower. Crafted requests sent to the device may allow remote arbitrary code...

CVE-2023-1210

An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to leak a user's email via an error message for groups that restrict membership by email...

PT-2023-9264

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager Mobile EPMM versions 11.10 and older Description The issue is related to an authentication bypass vulnerability in Ivanti EPMM, which allows unauthorized users to access restricted functionality or resources of the...

PT-2023-24516 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 8.10 through 16.0.7 GitLab versions 16.1 through 16.1.2 GitLab versions 16.2 through 16.2.1 Description: An issue has been discovered in GitLab where a user importing a project 'from export' could access and read unrelated fil...

PT-2023-23313 · Brocade · Brocade Fabric Os

Name of the Vulnerable Software and Affected Versions: Brocade Fabric OS versions 9.1.0 through 9.1.1 Description: A vulnerability in the fosexec command could allow a local authenticated user to perform privilege escalation to root by breaking the rbash shell. Starting with Fabric OS v9.1.0,...

PT-2023-26563 · Mindsdb +1 · Mindsdb +1

Name of the Vulnerable Software and Affected Versions: MindsDB versions prior to 23.7.4.0 Description: The issue concerns the MindsDB's AI Virtual Database, which allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with verify=False disabl...

PT-2023-25051 · Fuge Cms · Fuge Cms

Name of the Vulnerable Software and Affected Versions: Fuge CMS version 1.0 Description: The issue is related to an Open Redirect vulnerability found in the member/RegisterAct.java file. This vulnerability can potentially be exploited, although specific details about the estimated number of...

PT-2023-25028 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS versions through 5.7.109 Description: The issue allows remote attackers to run arbitrary code via a crafted POST request to the "/dede/tpl.php" API endpoint. This enables attackers to execute arbitrary code on the affected system...

PT-2023-24960 · Unknown · Wifi Soft Unibox Administration

Name of the Vulnerable Software and Affected Versions: Wifi Soft Unibox Administration versions 3.0 through 3.1 Description: The issue arises from the lack of validation or sanitization of user input in the username field of the login page, leading to SQL Injection. This allows attackers to injec...

CVE-2023-37218 Tadiran Telecom Aeonix - CWE-22: Improper Limitation of a Pathname to a Restricted Directory

Tadiran Telecom Aeonix - CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

Inability of Followers and Followees to Commenting

Lines of code Vulnerability details Impact The lack of functionality restricts interaction and engagement between the profile owner and their followers or the users they follow. This limitation diminishes the platform's value, as users who are interested in a post or have a genuine reason to...

Multiple vulnerabilities in Command Center RX (CCRX) of Kyocera Document Solutions MFPs and printers

Overview Command Center RX CCRX, a web interface for MFPs and printers provided by KYOCERA Document Solutions Inc., contains multiple vulnerabilities listed below. Path traversal CWE-22 - CVE-2023-34259 Path traversal CWE-22 - CVE-2023-34260 Observable response discrepancy CWE-204 - CVE-2023-3426...

PT-2023-27133 · Sourcecodester · Sourcecodester Online Jewelry Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Jewelry Store version 1.0 Description: A critical issue has been found in the login.php file, where the manipulation of the username and password arguments leads to sql injection. The attack can be initiated remotely...

A grant cannot be removed if the user has already claimed/withdrawn all his tokens beforehand

Lines of code Vulnerability details The revokeGrant is used to removes a grant. Any available vested tokens will be sent to the grant recipient. Any remaining unvested tokens will be sent to the vesting manager. But in the case when the user has already claimed all his tokens, the revokeGrant wil...

PT-2023-26739 · Unknown · Quartz-Jobs

Name of the Vulnerable Software and Affected Versions: quartz-jobs versions 2.3.2 and below Description: The issue is related to a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This vulnerability is exploited via passing an unchecked argument to...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to security restriction bypass due to [CVE-2023-24329]

Summary Python is used by IBM App Connect Enterprise Certified Container for mapping assistance, and is present in the images as part of the base operating system. IBM App Connect Enterprise Certified Container operands are vulnerable to security restriction bypass. This bulletin provides patch...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service and security restriction bypass due to [CVE-2023-2283], [CVE-2023-1667]

Summary libssh is found in the IBM App Connect Enterprise Certified Container images as part of the base operating system. IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service and security restriction bypass. This bulletin provides patch information to addre...

Design/Logic Flaw

The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apgprofileupdate' function in versions up to, and including, 1.9. This makes it possible for authenticated attackers, with subscriber-level permissions or...

CVE-2023-38602

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. An app may be able to modify protected parts of the file system...

PT-2023-25747 · Unknown · Phpgurukul Online Fire Reporting System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Fire Reporting System Using PHP and MySQL version 1.2 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the team name, leader, and...