4975 matches found
Deserialization of untrusted data
The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getposts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. ...
CVE-2023-34437
Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device...
CVE-2023-34437
Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device...
Design/Logic Flaw
Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device...
CVE-2023-34437 Baker Hughes Bently Nevada 3500 System Incorrect Permission Assignment for Critical Resource
Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device...
CVE-2023-34437 Baker Hughes Bently Nevada 3500 System Incorrect Permission Assignment for Critical Resource
Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device...
CVE-2023-34437
CVE-2023-34437 affects Baker Hughes Bently Nevada 3500 System TDI Firmware 5.05. The vulnerability is in the password retrieval functionality and could allow an attacker to access passwords stored on the device. The NVD and CISA-ICS advisories identify the affected appliance as the Bently Nevada ...
CVE-2023-20261
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve arbitrary files from an affected system. This vulnerability is due to improper validation of parameters that are sent to the web UI. An attacker could exploit this vulnerabilit...
Input validation
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve arbitrary files from an affected system. This vulnerability is due to improper validation of parameters that are sent to the web UI. An attacker could exploit this vulnerabilit...
CVE-2023-20261
Cisco Catalyst SD-WAN Manager web UI Local File Inclusion (CVE-2023-20261) allows an authenticated remote attacker to read arbitrary files from the underlying Linux filesystem by abusing improper validation of parameters in the web UI. Affected component is the web UI of Cisco Catalyst SD-WAN Man...
Cisco Catalyst SD-WAN Manager Local File Inclusion Vulnerability
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve arbitrary files from an affected system. This vulnerability is due to improper validation of parameters that are sent to the web UI. An attacker could exploit this vulnerabilit...
PT-2023-24876 · Baker Hughes · Bently Nevada 3500 System Tdi Firmware
Name of the Vulnerable Software and Affected Versions: Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 Description: The issue concerns a vulnerability in the password retrieval functionality, which could allow an attacker to access passwords stored on the device. Recommendation...
Exploit for CVE-2023-45828
CVE-2023-45828 RumbleTalk Live Group Chat = 6.1.9 - Missin...
SUSE CVE-2023-5422
The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSLgetverifyresult function is not used the certificated is trusted always and it can not be ensured that the certificate satisfies all necessary securit...
Eaton easySoft Security Breach
Eaton Easysoft is a programming application for industrial applications from Eaton Corporation. The software is used for use in programming Easy controllers and displays, where circuit diagrams can be edited and displayed in a format. A security vulnerability exists in Eaton easySoft that stems...
CVE-2023-38059
The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the IP of the user.This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; OTRS Community Edition: from 6.0.X through...
CVE-2023-38059
The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the IP of the user.This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; OTRS Community Edition: from 6.0.X through...
Code injection
The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the IP of the user.This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; OTRS Community Edition: from 6.0.X through...
ChurchCRM 4.5.4 SQL Injection Exploit
Exploit Title: ChurchCRM 4.5.4 - Authenticated Blind SQL Injection via the ENtyid Date: 03-05-2023 Exploit Author: Arvandy Blog Post: https://github.com/arvandy/CVE/blob/main/CVE-2023-29842/CVE-2023-29842.md Software Link: https://github.com/ChurchCRM/CRM/releases Vendor Homepage:...
CVE-2023-5240
Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation scripts to retrieve passwords stored in it via a GET request...