CVE-2023-38632

async-sockets-cpp through 0.3.1 has a stack-based buffer overflow in tcpsocket.hpp when processing malformed TCP packets...

MAL-2023-1088 Malicious code in @metronetinc/react-component-library-next-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d29aaa8c56838993a54df9b7ee45362f439f4b704ca467383c14f4643e2151a9 The OpenSSF Package Analysis project identified '@metronetinc/react-component-library-next-plugin' @ 9.999.8 npm as malicious. It is considered...

MobiSystems Office Suite Premium 跨站脚本漏洞

MobiSystems Office Suite Premium is an office software suite from MobiSystems, Inc. A security vulnerability exists in MobiSystems Office Suite Premium version 10.9.1.42602, which stems from a reflected cross-site scripting XSS vulnerability in the parameter filter...

PT-2023-35915 · Git +1 · Php

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free READ 4 crash type. The crash state involves zval call destructor, zend hash reverse apply, and shutdown...

CVE-2023-3300 Nomad Search API Leaks Information About CSI Plugins

HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1...

SUSE-SU-2023:2891-1 Security update for curl

This update for curl fixes the following issues: - CVE-2023-32001: Fixed TOCTOU race condition bsc1213237...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

It is an exploit module for Log4j. The vulnerability class/vecto...

SUSE-SU-2023:2881-1 Security update for perl

This update for perl fixes the following issues: - CVE-2023-31484: Enable TLS cert verification in CPAN bsc1210999...

SUSE-SU-2023:2878-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2023-34474: Fixed heap-based buffer overflow in ReadTIM2ImageData function in coders/tim2.c bsc1212237...

Arbitrary File Upload

admidio/admidio is vulnerable to Arbitrary File Upload. The vulnerability exists because the library does not properly validate the image file uploaded, allowing an attacker to bypass the file upload restrictions and upload a malicious file or embedded JavaScript file into the system, leading to...

PYSEC-2023-308

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0...

Elementor < 3.5.5 - Iframe Injection

Description The plugin does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs. PoC...

CVE-2023-22036

...

CVE-2018-25088

A vulnerability, which was classified as critical, was found in Blue Yonder postgraasserver up to 2.0.0b2. Affected is the function createpgconnection/createpostgresdb of the file postgraasserver/backends/postgrescluster/postgresclusterdriver.py of the component PostgreSQL Backend Handler. The...

Froxlor Command Execution Vulnerability

Froxlor is a set of lightweight server management software from the Froxlor team. A command execution vulnerability exists in versions prior to froxlor 2.0.21 that stems from an output encoding or escaping error. An attacker can exploit the vulnerability to cause command execution...

CVE-2023-38409

An issue was discovered in setcon2fbmap in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbconregisteredfb and fbcondisplay arrays can be desynchronized in fbconmodedeleted the con2fbmap points at the old fbinfo...

CasaOS contains weak JWT secrets

Impact Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. Patches The problem was addressed by improving the validation of JWTs in 705bf1f. This patch is part of CasaOS 0.4.4...

CVE-2023-31216 WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Ultimate Member plugin = 2.6.0 versions...

Denial Of Service (DoS)

libgpac.so is vulnerable to Denial Of Service DoS. The vulnerability exists due to a segmentation fault in the dumpisomscene function of mp4box/filedump.c, which allows an attacker to cause an application crash via a crafted input...

Remote Code Execution (RCE)

xalpha is vulnerable to Remote Code Execution RCE. The vulnerability exists in the basicinit function of info.py due to the use of the eval method without user input validation, which allows an attacker to execute malicious code in the system...