31439 matches found
CVE-2023-1194 affecting package kernel for versions less than 5.15.143.1-1
CVE-2023-1194 affecting package kernel for versions less than 5.15.143.1-1. A patched version of the package is available...
CVE-2023-51764 affecting package postfix for versions less than 3.7.0-3
CVE-2023-51764 affecting package postfix for versions less than 3.7.0-3. A patched version of the package is available...
CVE-2023-52284 affecting package fluent-bit for versions less than 2.1.10-3
CVE-2023-52284 affecting package fluent-bit for versions less than 2.1.10-3. A patched version of the package is available...
Oracle JDeveloper Multiple Vulnerabilities (January 2024 CPU)
The version of Oracle JDeveloper installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities as referenced in the January 2024 CPU advisory. - Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware component: Oracle JDevelop...
CVE-2024-22419
CVE-2024-22419 affects the Vyper compiler/runtime: the built-in concat can write past the allocated memory buffer, potentially corrupting memory and changing contract semantics. The root cause is the build_IR path not properly conforming to the copy_bytes API for versions >= 0.3.2, enabling a ...
Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab
CVE-2023-7028 ⚠️ This exploit is for defensive purposes and s...
PYSEC-2024-17
pyLoad is a free and open-source Download Manager written in pure Python. The pyload API allows any API call to be made using GET requests. Since the session cookie is not set to SameSite: strict, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery CSRF attac...
PT-2024-19531 · Flycms · Flycms
Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. It can be exploited via the "/system/admin/update group save" API endpoint. Recommendations: For FlyCms version 1.0, as a temporary workaround,...
Oracle WebLogic Server (January 2024 CPU)
The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the January 2024 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities, including: - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware...
Oracle Essbase Multiple Vulnerabilities (January 2024 CPU)
The version of Oracle Essbase installed on the remote host is missing a security patch from the January 2024 Critical Patch Update CPU. It is, therefore, affected by: - Vulnerability in Oracle Essbase component: Essbase Web Platform OpenSSL. Easily exploitable vulnerability allows unauthenticated...
Design/Logic Flaw
An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...
Security Bulletin: IBM Security Guardium is affected by a multiple vulnerabilities (CVE-2023-5072, CVE-2023-50164)
Summary IBM Security Guardium has addressed these vulnerabilities Vulnerability Details CVEID:CVE-2023-5072 DESCRIPTION: JSON-java is vulnerable to a denial of service, caused by a bug in the parser. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cau...
PT-2024-1253 · Totolink · Totolink Lr1200Gb
Name of the Vulnerable Software and Affected Versions: Totolink LR1200GB version 9.1.0u.6619 B20230130 Description: A critical issue has been identified, affecting the setDiagnosisCfg function of the /cgi-bin/cstecgi.cgi file. The manipulation of the ip argument leads to a stack-based buffer...
PT-2024-1336 · Oracle · Oracle Agile Product Lifecycle Management For Process
Name of the Vulnerable Software and Affected Versions: Oracle Agile Product Lifecycle Management for Process versions prior to 6.2.4.2 Description: The issue is related to insufficient input validation in the Installation component of the Oracle Agile Product Lifecycle Management for Process...
PT-2024-14843 · WordPress · The Royal Elementor Addons/Templates
Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons and Templates WordPress plugin versions prior to 1.3.81 Description: The issue allows unauthenticated users to access arbitrary draft, private, and password-protected posts/pages content. This is due to the plugin n...
WordPress Advanced Custom Fields PRO Plugin < 6.2.5 is vulnerable to Cross Site Scripting (XSS)
Software Advanced Custom Fields PRO Type Plugin Vulnerable versions 6.2.5 Fixed in 6.2.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-6701 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5c62a93a2661 Credits Francesco Carlucci Required...
Cisco WAP371 Wireless Access Point Command Injection (cisco-sa-sb-wap-inject-bHStWgXO)
According to its self-reported version, Cisco WAP371 Wireless Access Point Command Injection is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid188066;...
.NET 7.0 security update
7.0.115-1.0.1 - Update to .NET SDK 7.0.115 and Runtime 7.0.15 7.0.114-1.0.1 - Update to .NET SDK 7.0.114 and Runtime 7.0.14...
salestoday.gr Improper Access Control vulnerability OBB-3835630
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...