PT-2023-19730 · Phpipam · Phpipam

Name of the Vulnerable Software and Affected Versions: phpipam version 1.6 Description: The issue is related to a reflected cross-site scripting XSS vulnerability. This vulnerability can be exploited via the closeClass parameter at the "/subnet-masks/popup.php" API endpoint. Recommendations: For...

PT-2023-16004 · Proofpoint · Proofpoint Enterprise Protection

Name of the Vulnerable Software and Affected Versions: Proofpoint Enterprise Protection PPS/POD versions 8.20.0 and below Description: The webutils in Proofpoint Enterprise Protection contain a vulnerability that allows an authenticated user to execute remote code through 'eval injection'...

PT-2023-1682 · Fortinet · Fortiweb

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 6.3.6 through 6.3.20 FortiWeb versions 7.0.0 through 7.0.2 FortiWeb 6.4 all versions Description: The issue is related to an improper neutralization of special elements used in an os command, also known as 'os command...

The vulnerability in applications for creating reports using TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS arises due to an incorrect path name limitation in the restricted directory. This allows attackers to disclose sensitive information.

The vulnerability of applications for generating reports with TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS exists due to ...

PT-2023-35425 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.95 Description: The issue concerns error handling in the mmc spi probe function. It was introduced in version v2.6.24 and fixed in version v5.15.95. The actual impact and attack plausibility have not yet...

The vulnerability of the AgentLogUploadServlet component of the software for managing workstations via the web interface ManageEngine Desktop Central, as well as the remote monitoring and management tools for desktop PCs, servers, laptops, and mobile devices provided by ManageEngine Endpoint Central MSP (previously ManageEngine Desktop Central MSP), allows a malicious individual to circumvent security restrictions and execute arbitrary code.

The vulnerability of the AgentLogUploadServlet component of the software for managing workstations through the web interface of ManageEngine Desktop Central, as well as for remote monitoring and management of desktop PCs, servers, laptops, and mobile devices via ManageEngine Endpoint Central MSP...

Goutil 路径遍历漏洞

Goutil is a library of some tool functions commonly used by Go. A path traversal vulnerability exists in versions of Goutil prior to 0.6.0, which stems from an improper restriction of pathnames to restricted directories in the software...

PT-2023-35409 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.12 Description: A potential memory leak issue was identified in the ice add adv recipe function. The actual impact and attack plausibility of this issue have not yet been proven. Recommendations: For Linux...

Experts Reveal Google Cloud Platform's Blind Spot for Data Exfiltration Attacks

Malicious actors can take advantage of "insufficient" forensic visibility into Google Cloud Platform GCP to exfiltrate sensitive data, a new research has found. "Unfortunately, GCP does not provide the level of visibility in its storage logs that is needed to allow any effective forensic...

Atlassian Confluence 4.3.x < 6.2.1 Access Restriction Bypass using watch notifications

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to version 6.2.1. It is, therefore, affected by access restriction bypass using watch notifications which may permit an attacker to receive workbox notifications containing the...

PT-2023-16661 · Unknown · Meddatapacs

Name of the Vulnerable Software and Affected Versions: MedDataPACS versions prior to 2023-03-03 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: Fo...

The vulnerability of the goiscsi and gobrick libraries of the Dell Container Storage Module allows a perpetrator to execute arbitrary commands.

The vulnerability of the goiscsi and gobrick libraries in the Dell Container Storage Module system exists due to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability in the setup.php script of the software installer for managing medical organizations like OpenEMR allows a malicious individual to gain unauthorized access to protected information.

The vulnerability in the setup.php script of the software for managing medical organizations like OpenEMR relates to an incorrect restriction on the path to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

PT-2023-2220 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.1 through 15.7.8 GitLab versions 15.8 through 15.8.4 GitLab versions 15.9 through 15.9.2 Description: An issue has been discovered in GitLab that allows a project maintainer to extract a Datadog integration API key by...

CVE-2023-25402

CleverStupidDog yf-exam 1.8.0 is vulnerable to File Upload. There is no restriction on the suffix of the uploaded file, resulting in any file upload...

coreDNS vulnerable to Improper Restriction of Communication Channel to Intended Endpoints

A flaw was found in coreDNS. This flaw allows a malicious user to reroute internal calls to some internal services that were accessed by the FQDN in a format of ..svc...

CVE-2022-28321

The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pamaccess.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a...

PT-2023-19720 · Unknown · Judging Management System

Name of the Vulnerable Software and Affected Versions: Judging Management System version 1.0 Description: A SQL injection issue was found in the Judging Management System. The vulnerability can be exploited via the sid parameter at the "/php-jms/updateBlankTxtview.php" API endpoint...

yf-exam 代码问题漏洞

yf-exam CloudFan Training Exam System is a training exam system for CleverStupidDog individual developers. A security vulnerability exists in CleverStupidDog yf-exam version 1.8.0, which stems from the lack of restriction on the suffix of uploaded files, resulting in an arbitrary file upload...

PT-2023-20048 · Unknown · Cleverstupiddog Yf-Exam

Name of the Vulnerable Software and Affected Versions: CleverStupidDog yf-exam version 1.8.0 Description: The issue concerns a lack of restriction on the suffix of uploaded files, allowing any file to be uploaded. Recommendations: For version 1.8.0, restrict access to the file upload feature unti...