PT-2023-18253 · Unknown · Mpos Tui Trustlet

Name of the Vulnerable Software and Affected Versions: mPOS TUI trustlet versions prior to SMR May-2023 Release 1 Description: The issue is an out-of-bounds write vulnerability in the TA Communication mpos encrypt pin function of the mPOS TUI trustlet. This allows local attackers to execute...

PT-2023-23308

Name of the Vulnerable Software and Affected Versions Kibana version 8.7.0 Description The issue is an arbitrary code execution flaw. An attacker with all privileges to the Uptime/Synthetics feature could send a request to execute JavaScript code, potentially leading to the execution of arbitrary...

PT-2023-20505 · Gin Gonic +1 · Gin +1

Name of the Vulnerable Software and Affected Versions: github.com/gin-gonic/gin versions prior to 1.9.0 Description: The issue is related to Improper Input Validation, allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning...

Input validation

An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are only locally accessible. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with Fire...

CVE-2023-2459

Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to bypass permission restrictions via a crafted HTML page. Chromium security severity: Medium...

PT-2023-7377 · Fortinet · Fortinac-F +1

Name of the Vulnerable Software and Affected Versions: FortiNAC-F version 7.2.0 FortiNAC versions 9.4.2 and below FortiNAC versions 9.2 and earlier FortiNAC versions 9.1 and earlier FortiNAC versions 8.8 and earlier FortiNAC versions 8.7 and earlier Description: The issue is related to an imprope...

PT-2023-18636 · Tips Tricks Hq · Category Specific Rss Feed Subscription

Name of the Vulnerable Software and Affected Versions: Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin versions = 2.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user...

PT-2023-2754 · Fortinet · Fortinac-F +1

Name of the Vulnerable Software and Affected Versions: FortiNAC versions 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0, 8.7.0 FortiNAC-F version 7.2.0 Description: The issue is related to insufficient protection of registration data when handling the /etc/shadow password file, which ma...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Pallets Werkzeug

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Pallets Werkzeug. Vulnerability Details CVEID:CVE-2023-25577 DESCRIPTION: Pallets Werkzeug is vulnerable to a denial of service, caused by a flaw when parsing multipart form data with many fields. B...

CVE-2023-0924

The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged user such as an Administrator to upload arbitrary files, even when modifying the file system is disallowed, such as in a multisite install...

CVE-2022-25713

Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key...

Design/Logic Flaw

Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key...

CVE-2022-25713

CVE-2022-25713 describes a memory corruption issue in Automotive modules caused by improper restriction of operations within the bounds of a memory buffer while exporting a shared key. The vulnerability affects Qualcomm/Automotive components and is characterized by a local attack surface with low...

CVE-2022-25713 Improper Restriction of Operations within the Bounds of a Memory Buffer in Automotive

Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key...

Siemens SIMATIC CP Use After Free (CVE-2020-9273)

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in allocpool in pool.c, and possible remote code execution. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for mo...

PT-2023-22414 · Gl.Inet · Gl-Inet Mt3000

Name of the Vulnerable Software and Affected Versions: GL.iNET MT3000 version 4.1.0 Release 2 Description: The issue is related to OS Command Injection, which can be exploited via the /usr/lib/oui-httpd/rpc/logread endpoint. This allows for potential execution of system commands, posing a securit...

PT-2023-16620 · WordPress · Zyrex Popup

Name of the Vulnerable Software and Affected Versions: ZYREX POPUP WordPress plugin versions 1.0 and earlier Description: The issue allows a high privileged user, such as an Administrator, to upload arbitrary files when creating a popup, even when modifying the file system is disallowed, such as ...

PT-2023-22674 · Aigital · Aigital Wireless-N Repeater Mini Router

Name of the Vulnerable Software and Affected Versions: Aigital Wireless-N Repeater Mini Router version 0.131229 Description: An issue in the time-based authentication mechanism allows attackers to bypass login by connecting to the web app after a successful attempt by a legitimate user...

Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.3.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...

PT-2023-23017 · Avideo · Avideo

Name of the Vulnerable Software and Affected Versions: AVideo versions prior to 12.4 Description: The issue arises from the failure to properly sanitize malicious characters when creating a Meeting Room in AVideo, allowing an attacker to insert malicious scripts. This can lead to cookie hijacking...