PT-2023-17327 · Sap · Sap Hcm Fiori App My Forms

Name of the Vulnerable Software and Affected Versions: SAP HCM Fiori App My Forms Fiori 2.0 version 605 Description: The issue concerns the lack of necessary authorization checks for authenticated users, resulting in exposure of restricted header data. Recommendations: For SAP HCM Fiori App My...

PT-2023-2430 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows versions 2008 R2 SP1 through 2019 Description: The issue is related to insufficient input validation in the Windows DHCP server service, allowing remote attackers to execute arbitrary code. This can be achieved through remote procedur...

PT-2023-2949 · Schneider Electric · Easergy Builder Installer

Name of the Vulnerable Software and Affected Versions: Easergy Builder Installer versions 1.7.23 and prior Description: The issue is related to an uncontrolled search path element in the installer, which could allow an attacker with a local privileged account to execute arbitrary code during the...

PT-2023-22190 · Sap · Sapsetup

Name of the Vulnerable Software and Affected Versions: SapSetup version 9.0 Description: A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup, resulting in a privilege escalation running code as administrator of the same Windows PC. A successful attack depen...

PT-2023-5118 · Luci +1 · Luci +1

Name of the Vulnerable Software and Affected Versions: OpenWrt versions prior to the version with the fixed LuCI openwrt-22.03 branch LuCI openwrt-22.03 branch git-22.361.69894-438c598 Description: The issue is related to a stored cross-site scripting XSS vulnerability in the sshkeys.js component...

Protect

An improper restriction of excessive authentication attempts vulnerability CWE-307 in FortiOS & FortiProxy administrative interface may allow an attacker with a valid user account to perform brute-force attacks on other user accounts via injecting valid login sessions...

Siemens SCALANCE W1750D Improper Limitation of a Pathname to a Restricted Directory (CVE-2021-37734)

A remote unauthorized read access to files vulnerability was discovered in Aruba Instant versions: 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.19 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 a...

Security Bulletin: Vulnerabilities in cURL affect QLogic Virtual Fabric Extension Module for IBM BladeCenter

Summary The following vulnerabilities in cURL have been addressed by QLogic Virtual Fabric Extension Module for IBM BladeCenter. Vulnerability Details CVEID: CVE-2018-1000007 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive information, caused by a flaw when passing on...

Information disclosure

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16. A person with physical access to a device may be able to use Siri to access private calendar information...

Flask-AppBuilder Has No Rate Limiting on Login AUTH DB

Lack of rate limiting will allow an attacker to brute-force user credentials...

PT-2023-17369 · Unknown · Sourcecodester Online Computer/Laptop Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Computer and Laptop Store version 1.0 Description: A critical vulnerability was found in the Image Handler component of the affected software, specifically in the /classes/Master.php file, where the path argument is...

The vulnerability in the web interface for managing Roxy-WI servers (previously HAProxy-WI) allows a attacker to gain unauthorized access to protected information.

The vulnerability in the web interface for managing Roxy-WI servers previously HAProxy-WI is related to an incorrect limitation on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

PT-2023-21358 · H3C · H3C Magic R100

Name of the Vulnerable Software and Affected Versions: H3C Magic R100 version R100V100R005.bin Description: A stack overflow issue was discovered via the DeltriggerList interface at the "/goform/aspForm" API endpoint. This issue allows attackers to cause a Denial of Service DoS by sending a craft...

PT-2023-2447

Name of the Vulnerable Software and Affected Versions Novi Survey versions prior to 8.9.43676 Description The issue is related to insecure deserialization, allowing remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stor...

PT-2023-20993 · Unknown · Gdidees Cms

Name of the Vulnerable Software and Affected Versions: GDidees CMS version 3.9.1 Description: A source code disclosure issue was found in the backup feature of GDidees CMS, accessible via the "/ admin/backup.php" endpoint. This allows for potential access to sensitive information. Recommendations...

Google Chrome Security Updates (stable-channel-update-for-desktop-2023-04) - Windows

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

PT-2023-19285 · Oceanwp · Oceanwp Ocean Extra +1

Name of the Vulnerable Software and Affected Versions: OceanWP Ocean Extra plugin versions = 2.1.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with contributor or higher privileges. It affects the OceanWP Ocean Extra plugin whe...

SUSE-SU-2023:1776-1 Security update for systemd

This update for systemd fixes the following issues: - CVE-2023-26604: Fixed a privilege escalation via the less pager. bsc1208958 - CVE-2022-4415: Fixed systemd-coredump that did not respect the fs.suiddumpable kernel setting bsc1205000. - CVE-2022-3821: Fixed buffer overrun in formattimespan...

CVE-2023-0319

CVE-2023-0319 affects GitLab: an information disclosure allows reading environment names that are supposed to be restricted to project members. Affected ranges are: 13.6 up to 15.8.4 (since 15.8.5 is patched), 15.9.0 up to 15.9.3 (since 15.9.4 is patched), and 15.10.0 (before 15.10.1). The connec...

PT-2023-3259 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 9.5.13 GLPI versions prior to 10.0.7 Description: The issue is related to a lack of authorization, allowing a user with the Technician profile to view and generate a personal token for a Super-Admin. This can be exploit...