1284 matches found
Netgate pfSense CE Security Vulnerability
Netgate pfSense CE is a free and open source FreeBSD-based firewall and router software. A security vulnerability exists in Netgate pfSense CE version 2.6.0, which stems from the vulnerability to receive an unrate-limited attack that allows an attacker to create multiple malicious users in the...
Important: dotnet6.0
Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-44487 Affected Packages: dotnet6.0 Issue Correction: Run dnf update dotnet6.0...
CVE-2020-27630
In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random...
PT-2023-8580 · Squid +10 · Squid +11
Name of the Vulnerable Software and Affected Versions: Squid versions prior to 6.0.1 Description: The issue is related to a NULL pointer dereference bug in Squid's Gopher gateway, making it vulnerable to a Denial of Service attack. The gopher protocol is always available and enabled in Squid prio...
PT-2023-25969 · Slims · Slims
Name of the Vulnerable Software and Affected Versions: SLims version 9.6.0 Description: The issue allows an authenticated attacker to send requests to internal services or upload the contents of relevant files via the "scrape image.php" file in the imageURL parameter. This is a Server-Side Reques...
PT-2023-24653 · Spring · Spring Security
Name of the Vulnerable Software and Affected Versions: Spring Security versions prior to 5.8.7 Spring Security versions prior to 6.0.7 Spring Security versions prior to 6.1.4 Spring Security versions prior to 6.2.0-M1 Description: The spring-security.xsd file inside the spring-security-config jar...
CVE-2023-39777
A cross-site scripting XSS vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter...
vBulletin Cross-Site Scripting Vulnerability
vBulletin is an open source Web forum program based on PHP and MySQL from Internetbrands and vbulletinsolutions in the United States. A security vulnerability exists in vBulletin version 5.7.5, 6.0.0. An attacker can exploit this vulnerability to execute arbitrary Web script or HTML via the...
CVE-2023-32338
IBM Sterling Secure Proxy and IBM Sterling External Authentication Server 6.0.3 and 6.1.0 stores user credentials in plain clear text which can be read by a local user with container access. IBM X-Force ID: 255585...
IBM Sterling Secure Proxy Security Vulnerability
IBM Sterling Secure Proxy is an International Business Machines IBM application agent used to ensure the secure transfer of files in an organization's unprotected zone DMZ. A security vulnerability exists in IBM Sterling Secure Proxy versions 6.0.3 and 6.1.0, which stems from an inadequate memory...
IBM Sterling Secure Proxy Security Vulnerability
IBM Sterling Secure Proxy is an International Business Machines IBM application agent for securing file transfers in an organization's unprotected zone DMZ. A security vulnerability exists in IBM Sterling Secure Proxy versions 6.0.3 and 6.1.0, which stems from storing user credentials in plaintex...
Malicious code in mc-dxp (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5e1d1ce854f3d738b8c31b31ebec021661db3328cba71ffcbb8a8f9f2377b97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GHSA-62PR-54GV-VG5G SpringBlade vulnerable to SQL injection
In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection...
PT-2023-19045 · Geomatika · Geomatika Isigeo Web
Name of the Vulnerable Software and Affected Versions: Geomatika IsiGeo Web version 6.0 Description: The issue allows remote authenticated users to retrieve PHP files from the server via Local File Inclusion. Recommendations: For Geomatika IsiGeo Web version 6.0, consider restricting access to...
Microsoft .NET and Visual Studio Security Vulnerabilities
Microsoft Visual Studio is a family of development tool suites and a fundamentally complete development toolset that includes most of the tools needed throughout the software lifecycle. NET is a software framework dedicated to agile software development, rapid application development,...
Creativeitem Academy-LMS Cross-Site Scripting Vulnerability
Creativeitem Academy-LMS is an online learning platform from Creativeitem, Inc. A cross-site scripting vulnerability exists in Creativeitem Academy-LMS version 6.0. An attacker can exploit this vulnerability to conduct cross-site scripting attacks...
PYSEC-2023-280
OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0...
bboss 代码注入漏洞
bboss is a J2EE framework in the bboss open source. A security vulnerability exists in bboss bboss-persistent v6.0.9 and earlier versions, which stems from a code injection vulnerability in the component com.frameworkset.common.poolman.util.SQLManager.createPool...
PT-2023-12350 · Seeddms · Seeddms
Name of the Vulnerable Software and Affected Versions: SeedDMS version 6.0.15 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations: For SeedDMS version 6.0.15, update to a version that includes a fix for thi...