Amazon Linux 2 : containerd (ALASECS-2023-002)

The version of containerd installed on the remote host is prior to 1.6.19-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-002 advisory. containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can...

Buffer Overflow

libsox.so is vulnerable to Buffer Overflows. The vulnerability exists in the startread function at hcom.c due to not handling the buffer size which allows an attacker to cause an application crash or gain access to sensitive information...

Google Android Framework Information Disclosure Vulnerability (CNVD-2023-60904)

Google Android is a Linux-based open source operating system from Google. An information disclosure vulnerability exists in Google Android Framework, which can be exploited by attackers to obtain sensitive information...

PT-2023-23694 · Enphase · Enphase Installer Toolkit

Name of the Vulnerable Software and Affected Versions: Enphase Installer Toolkit version 3.27.0 Description: The issue concerns hard-coded credentials embedded in the binary code of the Android application. An attacker can exploit this to gain access to sensitive information. Recommendations: For...

ROS-20230616-08

The npm package manager vulnerability is related to the npm package ignoring the file exclusion directives .gitignore and .npmignore root-level file exclusions when run in a workspace or with the workspace flag e.g., --workspaces, --workspace=. Exploitation of the vulnerability could allow an...

Insecure Permissions

powerjob-server-starter is vulnerable to Insecure Permissions. The vulnerability exists because the library uses incorrect default permissions, which allows an attacker to gain sensitive information through the list job interface...

PT-2023-22449 · Teslamate · Teslamate

Name of the Vulnerable Software and Affected Versions: Teslamate version 1.27.1 Description: An issue in Teslamate allows attackers to obtain sensitive information via directly accessing the teslamate link. Recommendations: For Teslamate version 1.27.1, at the moment, there is no information abou...

Security Bulletin: Open Source Dependency Vulnerability

Summary IBM Edge Application Manager 4.5 has resolved the vulnerability. Vulnerability Details CVEID:CVE-2021-41190 DESCRIPTION: Open Container Initiative Distribution Specification could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw when a Content-Type...

USN-6073-5 nova regression

USN-6073-3 fixed a vulnerability in Nova. The update introduced a regression causing Nova to be unable to detach volumes from instances. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Jan Wasilewski and Gorka Eguileor discovered that Nova incorrectly...

Ubuntu: Security Advisory (USN-6073-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Hardcoded credentials

The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information...

PT-2023-14027 · Ibm · Ibm Spectrum Scale

Name of the Vulnerable Software and Affected Versions: IBM Spectrum Scale versions 5.1.2.1 through 5.1.6.0 Description: The issue allows programs running inside the container to overcome the isolation mechanism, potentially gaining additional capabilities or accessing sensitive information on the...

CVE-2023-25314

Cross Site Scripting XSS vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user...

Modoboa Information Disclosure Vulnerability

modoboa is an email hosting and management platform for individual developers. An information disclosure vulnerability exists in modoboa versions prior to 2.1.0, which originates when /api/v2/parameters/core/ returns sensitive information without any authentication or authorization. An attacker c...

Information disclosure

An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below may allow an unauthenticated attacker to access sensitive information via crafted HTTP requests...

Sales Tracker Management System 安全漏洞

Sales Tracker Management System is a sales tracking management system by Carlo Montero Personal Developer. A security vulnerability exists in Sales Tracker Management System version v.1.0. An attacker can exploit this vulnerability to access sensitive information via the sales.php component of th...

CVE-2023-20149

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an unauthenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. These vulnerabilities are due t...

Cross site scripting

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an unauthenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. These vulnerabilities are due t...

CVE-2023-20030

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to access sensitive information, conduct a server-side request forgery SSRF attack through an affected device, or negatively impact the responsiveness of the...

CVE-2023-27159

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...