PT-2023-22601 · Unknown · Judging Management System

Name of the Vulnerable Software and Affected Versions: Judging Management System version 1.0 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via the crit id parameter of the "edit criteria.php" file. This enables the attacker to potentially access and...

PT-2023-20867 · Unknown · Sourcecodester Online Exam System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Exam System version 1.0 Description: A critical issue has been found in the SourceCodester Online Exam System, affecting the POST Parameter Handler component in the /kelas/data file. The manipulation of the columns1data...

Job Portal 1.0 - File Upload Restriction Bypass

/jobportal/applicant/ 2.- Select profile image and load a valid image. 3. Turn Burp/ZAP Intercept On 4. Select webshell - ex: shell.png 5. Alter request in the upload... Update 'filename' to desired extension. ex: shell.php Not neccesary change content type to 'image/png' Example exploitation...

SUSE CVE-2022-41808

Improper buffer restriction in software for the Intel QAT Driver for Linux before version 1.7.l.4.12 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2023-2675 Improper Restriction of Excessive Authentication Attempts in linagora/twake

Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 2023.Q1.1223...

PT-2023-2935 · Cybozu · Cybozu Garoon

Name of the Vulnerable Software and Affected Versions: Cybozu Garoon versions 4.6.0 through 5.9.2 Description: The issue is related to an operation restriction bypass vulnerability in the Message and Bulletin components of Cybozu Garoon. This vulnerability is associated with weaknesses in the...

CVE-2023-2675 Improper Restriction of Excessive Authentication Attempts in linagora/twake

Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 2023.Q1.1223...

PT-2023-20782 · H3C · H3C R160

Name of the Vulnerable Software and Affected Versions: H3C R160 version V1004004 Description: A critical issue has been found in the file /goForm/aspForm, where the manipulation of the go argument leads to a stack-based buffer overflow. The issue affects some unknown functionality of this file...

CVE-2023-2675

CVE-2023-2675 targets linagora/twake versions prior to 2023.Q1.1223, where there is an improper restriction of excessive authentication attempts. Public assessments indicate high-impact potential (confidentiality, integrity, and availability). The vulnerability is tied to brute-force-like behavio...

PostgreSQL 安全漏洞

PostgreSQL is a free object-relational database management system from the PostgreSQL organization. The system supports most of the SQL standards and provides many other features such as foreign keys, triggers, views, and more. A security vulnerability exists in PostgreSQL versions 11 through 15,...

PT-2023-22430

Name of the Vulnerable Software and Affected Versions Webroot SecureAnywhere Endpoint Protection CE versions 9.0.33.39 and before Description An issue in Webroot SecureAnywhere Endpoint Protection CE allows a local attacker to bypass protections via the default allowlist feature being stored as...

PT-2023-20364 · Ibm · Ibm Security Verify Access

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access versions 10.0.0 through 10.0.5 Description: The issue allows an attacker to crash the webseald process using specially crafted HTTP requests, resulting in loss of access to the system. Recommendations: For versions...

distribution catalog API endpoint can lead to OOM via malicious user input

Impact Systems that run distribution built after a specific commit running on memory-restricted environments can suffer from denial of service by a crafted malicious /v2/catalog API endpoint request. Patches Upgrade to at least 2.8.2-beta.1 if you are running v2.8.x release. If you use the code...

CVE-2023-31477

A path traversal issue was discovered on GL.iNet devices before 3.216. Through the file sharing feature, it is possible to share an arbitrary directory, such as /tmp or /etc, because there is no server-side restriction to limit sharing to the USB path...

PT-2023-20746 · Sourcecodester · Sourcecodester Online Computer/Laptop Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Computer and Laptop Store version 1.0 Description: A critical issue has been found in the software, affecting some unknown functionality of the file products.php. The manipulation of the argument c leads to sql injection...

PT-2023-20632 · Digitalpersona · Digitalpersona Fpsensor

Name of the Vulnerable Software and Affected Versions: DigitalPersona FPSensor version 1.0.0.1 Description: A problematic issue has been found in the processing of the file C:Program Files x86FPSensorbinDpHost.exe, leading to an unquoted search path. This issue requires local attacking to be...

PT-2023-23356 · Gl.Inet · Gl.Inet

Name of the Vulnerable Software and Affected Versions: GL.iNet devices versions prior to 3.216 Description: A path traversal issue was discovered, allowing the sharing of arbitrary directories, such as /tmp or /etc, through the file sharing feature due to the lack of server-side restrictions...

PT-2023-22454 · Medical Systems Co. · Medisys Weblab Products

Name of the Vulnerable Software and Affected Versions: Medical Systems Co. Medisys Weblab Products version 19.4.03 Description: The issue is a SQL injection vulnerability that can be exploited via the tem:statement parameter in the WSDL files. This allows for potential unauthorized access to...

PT-2023-23376 · Motorola · Motorola Cx2L Router

Name of the Vulnerable Software and Affected Versions: Motorola CX2L Router version 1.0.1 Description: A command injection issue was found in the Motorola CX2L Router, specifically via the smartqos priority devices parameter. This allows for potential command injection attacks. Recommendations: F...

PT-2023-23374 · Motorola · Motorola Cx2L Router

Name of the Vulnerable Software and Affected Versions: Motorola CX2L Router version 1.0.1 Description: A command injection issue was discovered, which can be exploited via the system time timezone parameter. Recommendations: For Motorola CX2L Router version 1.0.1, consider restricting access to t...