16962 matches found
CVE-2023-52086
resumable.php aka PHP backend for resumable.js 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data content to upload.php. File overwrite hasn't been possible with the code available in GitHub in recent years, however...
CVE-2023-51106
A floating point exception divide-by-zero vulnerability was discovered in mupdf 1.23.4 in function pnmbinaryreadimage of load-pnm.c when fzcolorspacen returns zero...
MAL-2023-8763 Malicious code in enchantv (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 f578b605e73b68aae8c1d8a9bd3f55b810839b2bccd720bccc7f887c2e0046c8 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...
CVE-2023-27151
openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number in the Saved Search Activity via the Name, Description, or Activity Number field...
The vulnerability of the dropbearpwd component in the TP-Link TL-WR841N router’s microprogramming software allows a intruder to gain unauthorized access to protected information.
The vulnerability of the dropbearpwd component in the TP-Link TL-WR841N router’s microprogramming software is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
ActiveAdmin vulnerable to CSV injection
In ActiveAdmin versions prior to 3.2.0, maliciously crafted spreadsheet formulas could be uploaded as part of admin data that, when exported to a CSV file and the imported to a spreadsheet program like libreoffice, could lead to remote code execution and private data exfiltration. The attacker...
CVE-2023-49356
A stack buffer overflow vulnerability in MP3Gain v1.6.2 allows an attacker to cause a denial of service via the WriteMP3GainAPETag function at apetag.c:592...
BELL-CVE-2023-42465
Bulletin has no description...
OSV-2023-1343 Heap-buffer-overflow in _libssh2_kex_agree_instr
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65212 Crash type: Heap-buffer-overflow READ Crash state: libssh2kexagreeinstr libssh2packetadd fullpacket...
CVE-2023-7041
A vulnerability, which was classified as critical, has been found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this issue is some unknown functionality of the file /file-manager/rename.php. The manipulation of the argument newName leads to path traversal: '../filedir'. The attack may be...
PYSEC-2023-267
Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification. Users are...
PYSEC-2023-266
Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the executi...
CVE-2022-47597 WordPress Popup Maker Plugin <= 1.17.1 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Popup Maker Popup Maker – Popup for opt-ins, lead gen, & more.This issue affects Popup Maker – Popup for opt-ins, lead gen, & more: from n/a through 1.17.1...
CVE-2023-31092
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Foxskav Easy Bet.This issue affects Easy Bet: from n/a through 1.0.2...
BELL-CVE-2023-6932
Bulletin has no description...
BELL-CVE-2023-51384
Bulletin has no description...
CVE-2023-6974 Server-Side Request Forgery (SSRF)
A malicious user could use this issue to access internal HTTPs servers and in the worst case ie: aws instance it could be abuse to get a remote code execution on the victim machine...
SUSE CVE-2023-6857
When resolving a symlink, a race may occur where the buffer passed to readlink may actually be smaller than necessary. This bug only affects Firefox on Unix-based operating systems Android, Linux, MacOS. Windows is unaffected. This vulnerability affects Firefox ESR 115.6, Thunderbird 115.6, and...
MAL-2023-8723 Malicious code in nice-dag-kernel (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a9daba1d90e3e64cd044b78b1bbb9123a3c748dddbd37b2549c9dee2164eaa56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...