SUSE CVE-2022-1379

URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery SSRF. This allows accessing restricted internal resources/servers or...

SUSE CVE-2022-24806

net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can exploit an Improper Input Validation vulnerability when SETing malformed OIDs in master agent and subagent simultaneously. Version 5.9.2 contains a...

SUSE CVE-2023-22496

Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent. When an alert is triggered, the function healthalarmexecute is called. This...

PT-2023-18972 · Sunell · Sunell Dvr

Name of the Vulnerable Software and Affected Versions: Sunell DVR version latest Description: The issue is related to Insufficiently Protected Credentials, which may be exposed through an unspecified request. This could potentially lead to unauthorized access. Recommendations: For Sunell DVR...

PT-2023-2039 · Solarwinds · Solarwinds Orion

Name of the Vulnerable Software and Affected Versions: SolarWinds Orion affected versions not specified Description: The issue is related to the deserialization of untrusted data, which can allow a remote adversary with admin-level account access to the SolarWinds Web Console to execute arbitrary...

PT-2023-13661 · Ehoney · Ehoney

Name of the Vulnerable Software and Affected Versions: Ehoney version 2.0.0 Description: The issue allows attackers to execute arbitrary code due to a SQL Injection vulnerability in models/protocol.go and models/images.go. Recommendations: For Ehoney version 2.0.0, consider restricting access to...

PT-2023-18707 · Ls Electric · Ls Electric Xbc-Dn32U

Name of the Vulnerable Software and Affected Versions: LS ELECTRIC XBC-DN32U version 01.80 Description: The issue is related to the transmission of sensitive information in cleartext when the device communicates over its XGT protocol. This could allow an attacker to gain sensitive information, su...

SA40166 - Remote desktop protocol (RDP) client restriction bypass issue

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. A security issue was discovered in the PCS Terminal Services Remote Desktop Protocol RDP client session restrictions feature. By exploiting this issue a malicious authenticated user...

CVE-2023-0024

SAP Solution Manager BSP Application - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources, resulting in...

PT-2023-16543 · WordPress · The Profile Builder – User Profile & User Registration Forms

Name of the Vulnerable Software and Affected Versions: The Profile Builder – User Profile & User Registration Forms plugin for WordPress versions up to, and including 3.9.0 Description: The issue is related to sensitive information disclosure via the user meta shortcode. This is due to insufficie...

PT-2023-1418 · Schneider Electric · Struxureware Data Center Expert

Name of the Vulnerable Software and Affected Versions: StruxureWare Data Center Expert versions prior to 7.9.2 Description: A vulnerability exists that could allow remote code execution on upload and install packages when a hacker is using a low privileged user account. The issue is related to...

PT-2023-6668 · Siemens · Siemens Solid Edge Se2022 +1

Name of the Vulnerable Software and Affected Versions: Siemens Solid Edge SE2022 versions prior to V222.0MP12 Siemens Solid Edge SE2023 versions prior to V223.0Update2 Description: The issue is related to an out of bounds read past the end of an allocated structure while parsing specially crafted...

JVN#00712821: Improper restriction of XML external entity reference (XXE) vulnerability in tsClinical Define.xml Generator and tsClinical Metadata Desktop Tools

tsClinical Define.xml Generator and tsClinical Metadata Desktop Tools provided by FUJITSU LIMITED contain an improper restriction of XML external entity reference XXE vulnerability CWE-611. Impact By reading a specially crafted XML file, arbitrary files which meet a certain condition may be...

Siemens Brownfield Connectivity Gateway

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...

PT-2023-20161 · Unknown +6 · Gss-Ntlmssp +6

Name of the Vulnerable Software and Affected Versions: GSS-NTLMSSP versions prior to 1.2.0 Description: GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit...

PT-2023-20165 · Unknown +6 · Gss-Ntlmssp +6

Name of the Vulnerable Software and Affected Versions: GSS-NTLMSSP versions prior to 1.2.0 Description: The issue is an out-of-bounds read that occurs when decoding target information. This happens because the length of the av pair is not properly checked for two elements, which can trigger an...

PT-2023-6674 · Siemens · Solid Edge

Name of the Vulnerable Software and Affected Versions: Solid Edge SE2022 versions prior to V222.0MP12 Solid Edge SE2023 versions prior to V223.0Update2 Description: A use-after-free issue has been identified in the affected application, which can be triggered while parsing specially crafted STP...

PT-2023-3272 · Schneider Electric · Struxureware Data Center Expert

Name of the Vulnerable Software and Affected Versions: StruxureWare Data Center Expert versions prior to 7.9.2 Description: The issue is related to improper control of code generation, allowing remote code execution via the hostname parameter when maliciously crafted hostname syntax is entered...

PT-2023-1392 · Schneider Electric · Struxureware Data Center Expert

Name of the Vulnerable Software and Affected Versions: StruxureWare Data Center Expert versions 7.9.2 and prior Description: A Cross-site Scripting vulnerability exists due to improper neutralization of input during web page generation. This issue affects the logging capabilities of the webserver...

GSD-2023-1001857 mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups

mm/MADVCOLLAPSE: catch !none !huge !bad pmd lookups This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.11 by commit...