MobiSystems Office Suite Premium 跨站脚本漏洞

MobiSystems Office Suite Premium is an office software suite from MobiSystems, Inc. A security vulnerability exists in MobiSystems Office Suite Premium version 10.9.1.42602, which stems from a reflected cross-site scripting XSS vulnerability in the parameter filter...

PT-2023-35915 · Git +1 · Php

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free READ 4 crash type. The crash state involves zval call destructor, zend hash reverse apply, and shutdown...

CVE-2023-3300 Nomad Search API Leaks Information About CSI Plugins

HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1...

SUSE-SU-2023:2891-1 Security update for curl

This update for curl fixes the following issues: - CVE-2023-32001: Fixed TOCTOU race condition bsc1213237...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

It is an exploit module for Log4j. The vulnerability class/vecto...

SUSE-SU-2023:2881-1 Security update for perl

This update for perl fixes the following issues: - CVE-2023-31484: Enable TLS cert verification in CPAN bsc1210999...

SUSE-SU-2023:2878-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2023-34474: Fixed heap-based buffer overflow in ReadTIM2ImageData function in coders/tim2.c bsc1212237...

Arbitrary File Upload

admidio/admidio is vulnerable to Arbitrary File Upload. The vulnerability exists because the library does not properly validate the image file uploaded, allowing an attacker to bypass the file upload restrictions and upload a malicious file or embedded JavaScript file into the system, leading to...

PYSEC-2023-308

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0...

Elementor < 3.5.5 - Iframe Injection

Description The plugin does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs. PoC...

CVE-2023-22036

...

CVE-2018-25088

A vulnerability, which was classified as critical, was found in Blue Yonder postgraasserver up to 2.0.0b2. Affected is the function createpgconnection/createpostgresdb of the file postgraasserver/backends/postgrescluster/postgresclusterdriver.py of the component PostgreSQL Backend Handler. The...

Froxlor Command Execution Vulnerability

Froxlor is a set of lightweight server management software from the Froxlor team. A command execution vulnerability exists in versions prior to froxlor 2.0.21 that stems from an output encoding or escaping error. An attacker can exploit the vulnerability to cause command execution...

CVE-2023-38409

An issue was discovered in setcon2fbmap in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbconregisteredfb and fbcondisplay arrays can be desynchronized in fbconmodedeleted the con2fbmap points at the old fbinfo...

CasaOS contains weak JWT secrets

Impact Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. Patches The problem was addressed by improving the validation of JWTs in 705bf1f. This patch is part of CasaOS 0.4.4...

CVE-2023-31216 WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Ultimate Member plugin = 2.6.0 versions...

Denial Of Service (DoS)

libgpac.so is vulnerable to Denial Of Service DoS. The vulnerability exists due to a segmentation fault in the dumpisomscene function of mp4box/filedump.c, which allows an attacker to cause an application crash via a crafted input...

Remote Code Execution (RCE)

xalpha is vulnerable to Remote Code Execution RCE. The vulnerability exists in the basicinit function of info.py due to the use of the eval method without user input validation, which allows an attacker to execute malicious code in the system...

PT-2023-19157 · WordPress · Premmerce

Name of the Vulnerable Software and Affected Versions: Premmerce plugin versions = 1.3.17 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application tha...

PT-2023-13578 · WordPress · Metagauss Download Theme

Name of the Vulnerable Software and Affected Versions: Metagauss Download Theme plugin versions 1.0.9 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions ...