CVE-2023-3330

Improper Limitation of a Pathname to a Restricted Directory vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N and WR8170N all versions allows a...

PT-2023-25066 · H3C · H3C Magic

Name of the Vulnerable Software and Affected Versions: H3C Magic B1STV100R012 version B1STV100R012 Description: A stack overflow issue exists in the UpdateSnat function, allowing attackers to cause a Denial of Service DoS by sending a crafted POST request to the affected system. Recommendations:...

PT-2023-24967 · Unknown · Phpgurukul Hospital Management System

Name of the Vulnerable Software and Affected Versions: PHPgurukl Hostel Management System version 1.0 Description: The issue concerns a Cross Site Scripting XSS problem. Cross Site Scripting is a type of security vulnerability that allows an attacker to inject malicious scripts into a website,...

CVE-2023-32224

D-Link DSL-224 router (firmware version 3.0.10) is affected by CWE-307: Improper Restriction of Excessive Authentication Attempts. The vulnerability enables authentication bypass due to inadequate restriction on repeated authentication attempts in the device’s login mechanism. Reported across mul...

Important: kernel

Issue Overview: A flaw was found in the Linux kernel Traffic Control TC subsystem. Using a specific networking configuration redirecting egress packets to ingress using TC action "mirred" a local unprivileged user could trigger a CPU soft lockup ABBA deadlock when the transport protocol in use TC...

PT-2023-17940 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a possible use-after-free UAF due to a logic error in the lwis i2c device disable function of lwis device i2c.c. This could lead to local escalation of privilege with no additional execution...

CVE-2023-32224 D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication Attempts

D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication Attempts...

PT-2023-8202 · Opnsense · Opnsense

Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: A directory traversal vulnerability exists in the Captive Portal templates of OPNsense, allowing attackers to execute arbitrary...

PT-2023-17980 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android version Android-13 Description: The issue is related to improper input validation in the setInputMethodWithSubtypeIdLocked function of InputMethodManagerService.java. This could lead to local escalation of privilege with no additional...

The vulnerability of the C-Bus Toolkit software exists due to an incorrect limitation on the path name to the restricted access directory, allowing a perpetrator to execute arbitrary code.

The vulnerability of the C-Bus Toolkit software exists due to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Improper Authorization

gitlab is vulnerable to Improper Authorization. The vulnerability exists due to the incorrect authorization in the Asana integration's branch restriction feature in the library, which allows an attacker to close Asana tasks from unrestricted branches...

CVE-2023-2068

The CVE-2023-2068 issue affects the WordPress File Manager Advanced Shortcode plugin (versions

PT-2023-25320 · Stormshield · Stormshield Endpoint Security Evolution

Name of the Vulnerable Software and Affected Versions: Stormshield Endpoint Security Evolution versions 2.0.0 through 2.3.2 Description: The issue allows an interactive user to create arbitrary files with local system privileges using the SES Evolution agent due to insecure permissions...

PT-2023-3408 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 6.1 through 6.4 Description: A vulnerability exists in the memory management subsystem of the Linux kernel, related to incorrect lock handling for accessing and updating virtual memory areas VMAs, leading to use-after-fr...

Google Chrome Security Updates (stable-channel-update-for-desktop_26-2023-06) - Linux

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

PT-2023-24453 · WordPress · User Registration

Name of the Vulnerable Software and Affected Versions: User Registration plugin for WordPress versions up to, and including, 3.7.3 Description: The issue is related to Sensitive Information Exposure due to a hardcoded encryption key in the lock content form handler and display password form...

PT-2023-22256 · Cththemes · Cththemes Theroof Theme +1

Name of the Vulnerable Software and Affected Versions: CTHthemes TheRoof theme versions 1.0.3 and earlier CTHthemes TheRoof plugin versions 1.0.3 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject...

PT-2023-24524 · WordPress · Lana Text To Image

Name of the Vulnerable Software and Affected Versions: Lana Text to Image plugin for WordPress versions up to, and including, 1.0.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the lana text to image and lana text to img...

Code injection

AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.FargateCluster...

Information disclosure

This issue was addressed by restricting options offered on a locked device. This issue is fixed in watchOS 9.5. An attacker with physical access to a locked Apple Watch may be able to view user photos or contacts via accessibility features...