4D SAS 4D Server 信任管理问题漏洞

4D SAS 4D Server is a rapid development platform for business applications from 4D. A security vulnerability exists in 4D SAS 4D Server Application that stems from the presence of an information disclosure vulnerability...

Eset Server Security 安全漏洞

ESET Eset Server Security is an It solution from ESET Slovakia. It is used to block peripheral malware as well as suspicious Web and Ftp traffic. A security vulnerability exists in some ESET products, which stems from improper privilege management. The vulnerability can be exploited by an attacke...

PT-2023-3448 · Microsoft · Odbc Driver For Sql Server

Name of the Vulnerable Software and Affected Versions: Microsoft ODBC Driver for SQL Server affected versions not specified Description: The issue is related to insufficient input validation in the Microsoft ODBC Driver for SQL Server library, which can allow an attacker to execute arbitrary code...

PT-2023-3648 · Eset · Eset Server Security +2

Name of the Vulnerable Software and Affected Versions: ESET Server Security affected versions not specified ESET Endpoint Antivirus affected versions not specified ESET Cyber Security affected versions not specified ESET Endpoint Antivirus affected versions not specified Description: A local...

Design/Logic Flaw

The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdkpublicaction' function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those...

Huawei EulerOS: Security Advisory for java-1.8.0-openjdk (EulerOS-SA-2023-2150)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Scrubs & Beyond Leaks 400GB of User PII and Card Data in Plain Text

By Waqas Scrubs & Beyond were alerted multiple times about the data leak, but the company did not respond or secure the server. This is a post from HackRead.com Read the original post: Scrubs & Beyond Leaks 400GB of User PII and Card Data in Plain Text...

Cybercriminals Targeting Apache NiFi Instances for Cryptocurrency Mining

A financially motivated threat actor is actively scouring the internet for unprotected Apache NiFi instances to covertly install a cryptocurrency miner and facilitate lateral movement. The findings come from the SANS Internet Storm Center ISC, which detected a spike in HTTP requests for "/nifi" o...

SUSE-SU-2023:2304-1 Security update for rmt-server

This update for rmt-server fixes the following issues: Updated to version 2.13: - CVE-2023-28120: Fixed a potential XSS issue in an embedded dependency bsc1209507. - CVE-2023-27530: Fixed a denial of service issue in multipart request parsing bsc1209096. Non-security fixes: - Fixed transactional...

SUSE-SU-2023:2294-1 Security update for rmt-server

This update for rmt-server fixes the following issues: Updated to version 2.13: - CVE-2023-28120: Fixed a potential XSS issue in an embedded dependency bsc1209507. - CVE-2023-27530: Fixed a denial of service issue in multipart request parsing bsc1209096. Non-security fixes: - Fixed transactional...

SUSE-SU-2023:2280-1 Security update for rmt-server

This update for rmt-server fixes the following issues: Updated to version 2.13: - CVE-2023-28120: Fixed a potential XSS issue in an embedded dependency bsc1209507. - CVE-2023-27530: Fixed a denial of service issue in multipart request parsing bsc1209096. Non-security fixes: - Fixed transactional...

Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization

The plugin does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP addFromString'test.png', 'text'; $phar-setStub"\xff\xd8\xff\n"; $phar-setMetadatanew Evil; $phar-stopBuffering; 2. As an Author user,...

CVE-2023-30859 Spigot Command Exploit in Triton

Triton is a Minecraft plugin for Spigot and BungeeCord that helps you translate your Minecraft server. The CustomPayload packet allows you to execute commands on the spigot/bukkit console. When you enable bungee mode in the config it will enable the bungee bridge and the server will begin to...

CVE-2022-38583

On versions of Sage 300 2017 - 2022 6.4.x - 6.9.x which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could abuse their access to the "SharedData" folder on the connected Sage 300 server to view and/or modify the...

CVE-2022-25277

Drupal core sanitizes filenames with dangerous extensions upon upload reference: SA-CORE-2020-012 and strips leading and trailing dots from filenames to prevent uploading server configuration files reference: SA-CORE-2019-010. However, the protections for these two vulnerabilities previously did...

CVE-2023-23838

CVE-2023-23838 affects SolarWinds Database Performance Analyzer (DPA) up to version 2022.3 and earlier, described as a directory traversal and file enumeration vulnerability that could allow access to different folders on the server. Various sources corroborate the vulnerability in DPA (2023.1/ea...

CVE-2023-21962

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Components Services. Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2023-29410

CVE-2023-29410 involves Schneider Electric Conext Gateway and an input validation error (CWE-20). The connected sources identify vulnerable versions as Conext Gateway v1.16 Build 004 and earlier, with an authenticated attacker able to escalate to the same privileges as the application on the serv...

Arbitrary File Upload

org.apache.linkis:linkis-storage-script-dev-server is vulnerable to Arbitrary File Upload. The vulnerability exists because the library does not properly validate the uploaded file paths, and file types, allowing an attacker to bypass restrictions and upload malicious files to the server...

Denial of Service Vulnerability in Multiple Siemens Products (CNVD-2023-35759)

Siemens SIMATIC IPC DiagMonitor is a suite of system monitoring and troubleshooting software from Siemens, Germany.The SIMATIC CP 1242-7 and CP 1243-7 LTE communication processors connect SIMATIC S7-1200 controllers to a wide area network WAN. They provide integrated security features such as...