16956 matches found
PT-2023-17633 · Vow · Vow
Name of the Vulnerable Software and Affected Versions: vow affected versions not specified Description: The issue is related to a missing permission check, which could lead to a local escalation of privilege without needing additional execution privileges. User interaction is not required for...
The vulnerability of Moxa TN-5900 series router microprogramming software, related to inconsistencies in responses to incoming requests, allows attackers to gain unauthorized access to protected information.
The vulnerability of Moxa TN-5900 series router microprogramming software is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...
CVE-2020-22151
Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function...
CVE-2023-26509
AnyDesk 7.0.8 allows remote Denial of Service...
PT-2023-4243 · Tenda · Tenda Ac1206 +7
Name of the Vulnerable Software and Affected Versions: Tenda AC10 version V15.03.06.23 Tenda AC1206 version V15.03.06.23 Tenda AC6 version V15.03.06.23 Tenda AC7 version V15.03.06.44 Tenda AC5 version V15.03.06.28 Tenda FH1203 version V2.0.1.6 Tenda AC9 version V15.03.06.42 multi Tenda FH1205...
PT-2023-4239 · Tenda · Tenda F1203 +7
Name of the Vulnerable Software and Affected Versions: Tenda AC10 version V1.0 V15.03.06.23 Tenda AC1206 version V15.03.06.23 Tenda AC8 v4 version V16.03.34.06 Tenda AC6 V2.0 version V15.03.06.23 Tenda AC7 V1.0 version V15.03.06.44 Tenda F1203 version V2.0.1.6 Tenda AC5 V1.0 version V15.03.06.28...
llhttp vulnerable to HTTP request smuggling
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS. The CR character without LF is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only th...
GHSA-CGGH-PQ45-6H9X llhttp vulnerable to HTTP request smuggling
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS. The CR character without LF is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only th...
ASB-A-261723753
In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop. This could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
github.com/cosmos/cosmos-sdk's x/crisis does not charge ConstantFee
x/crisis does not charge ConstantFee Impact If a transaction is sent to the x/crisis module to check an invariant, the ConstantFee parameter of the chain is NOT charged. All versions of the x/crisis module are affected on all versions of the Cosmos SDK. Details The x/crisis module is supposed to...
CVE-2023-3493 Improper Neutralization of Formula Elements in a CSV File in fossbilling/fossbilling
Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3...
CVE-2023-32607
Stored cross-site scripting vulnerability in Pleasanter Community Edition and Enterprise Edition 1.3.39.2 and earlier versions allows a remote authenticated attacker to inject an arbitrary script...
OSV-2023-525 Security exception in jaz.Zer.reportFinding
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60167 Crash type: Security exception Crash state: jaz.Zer.reportFinding jaz.Zer.reportFindingIfEnabled jaz.Zer...
OSV-2023-518 Security exception in com.code_intelligence.jazzer.sanitizers.XPathInjection.checkXpathExecute
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60148 Crash type: Security exception Crash state: com.codeintelligence.jazzer.sanitizers.XPathInjection.checkXpathExecute org.hamcrest.xml.HasXPath.compiledXPath org.hamcrest.xml.HasXPath...
Cross-site Scripting (XSS)
com.liferay.layout.seo.web is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the lack of validation of the URLs in the layout module's SEO configuration, which allows an attacker to inject and execute malicious javascript or HTML via the...
ARM NN Android-NN-Driver 缓冲区错误漏洞
ARM NN Android-NN-Driver is a driver from ARM UK. A security vulnerability exists in ARM NN Android-NN-Driver prior to version 23.02, which stems from an improper length check of shared memory, resulting in an out-of-bounds read/write issue...
PT-2023-4019 · Siemens · Tecnomatix Plant Simulation
Name of the Vulnerable Software and Affected Versions: Tecnomatix Plant Simulation versions prior to V2201.0008 Tecnomatix Plant Simulation versions prior to V2302.0002 Description: The issue is related to a heap-based buffer overflow that occurs when the application parses specially crafted PAR...
PT-2023-25395 · Tuleap · Tuleap
Name of the Vulnerable Software and Affected Versions: Tuleap versions prior to 14.9.99.63 Description: The issue occurs when switching from a project visibility that allows restricted users to Private without restricted, where restricted users that are project administrators retain their access...
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server, which is shipped with, or a required product for, IBM Tivoli Network Manager IP Edition (CVE-2017-1741).
Summary IBM WebSphere Application Server is shipped with IBM Tivoli Network Manager IP Edition versions 3.9 and 4.1.1; IBM WebSphere Application Server is a required product for IBM Tivoli Network Manager IP Edition version 4.2. Information about a security vulnerability affecting IBM WebSphere...