CVE-2020-22151

Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function...

CVE-2023-26509

AnyDesk 7.0.8 allows remote Denial of Service...

PT-2023-4243 · Tenda · Tenda Ac1206 +7

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version V15.03.06.23 Tenda AC1206 version V15.03.06.23 Tenda AC6 version V15.03.06.23 Tenda AC7 version V15.03.06.44 Tenda AC5 version V15.03.06.28 Tenda FH1203 version V2.0.1.6 Tenda AC9 version V15.03.06.42 multi Tenda FH1205...

PT-2023-4239 · Tenda · Tenda F1203 +7

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version V1.0 V15.03.06.23 Tenda AC1206 version V15.03.06.23 Tenda AC8 v4 version V16.03.34.06 Tenda AC6 V2.0 version V15.03.06.23 Tenda AC7 V1.0 version V15.03.06.44 Tenda F1203 version V2.0.1.6 Tenda AC5 V1.0 version V15.03.06.28...

llhttp vulnerable to HTTP request smuggling

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS. The CR character without LF is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only th...

GHSA-CGGH-PQ45-6H9X llhttp vulnerable to HTTP request smuggling

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS. The CR character without LF is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only th...

ASB-A-261723753

In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop. This could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

github.com/cosmos/cosmos-sdk's x/crisis does not charge ConstantFee

x/crisis does not charge ConstantFee Impact If a transaction is sent to the x/crisis module to check an invariant, the ConstantFee parameter of the chain is NOT charged. All versions of the x/crisis module are affected on all versions of the Cosmos SDK. Details The x/crisis module is supposed to...

CVE-2023-3493 Improper Neutralization of Formula Elements in a CSV File in fossbilling/fossbilling

Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3...

CVE-2023-32607

Stored cross-site scripting vulnerability in Pleasanter Community Edition and Enterprise Edition 1.3.39.2 and earlier versions allows a remote authenticated attacker to inject an arbitrary script...

OSV-2023-525 Security exception in jaz.Zer.reportFinding

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60167 Crash type: Security exception Crash state: jaz.Zer.reportFinding jaz.Zer.reportFindingIfEnabled jaz.Zer...

OSV-2023-518 Security exception in com.code_intelligence.jazzer.sanitizers.XPathInjection.checkXpathExecute

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60148 Crash type: Security exception Crash state: com.codeintelligence.jazzer.sanitizers.XPathInjection.checkXpathExecute org.hamcrest.xml.HasXPath.compiledXPath org.hamcrest.xml.HasXPath...

Cross-site Scripting (XSS)

com.liferay.layout.seo.web is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the lack of validation of the URLs in the layout module's SEO configuration, which allows an attacker to inject and execute malicious javascript or HTML via the...

ARM NN Android-NN-Driver 缓冲区错误漏洞

ARM NN Android-NN-Driver is a driver from ARM UK. A security vulnerability exists in ARM NN Android-NN-Driver prior to version 23.02, which stems from an improper length check of shared memory, resulting in an out-of-bounds read/write issue...

PT-2023-4019 · Siemens · Tecnomatix Plant Simulation

Name of the Vulnerable Software and Affected Versions: Tecnomatix Plant Simulation versions prior to V2201.0008 Tecnomatix Plant Simulation versions prior to V2302.0002 Description: The issue is related to a heap-based buffer overflow that occurs when the application parses specially crafted PAR...

PT-2023-25395 · Tuleap · Tuleap

Name of the Vulnerable Software and Affected Versions: Tuleap versions prior to 14.9.99.63 Description: The issue occurs when switching from a project visibility that allows restricted users to Private without restricted, where restricted users that are project administrators retain their access...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server, which is shipped with, or a required product for, IBM Tivoli Network Manager IP Edition (CVE-2017-1741).

Summary IBM WebSphere Application Server is shipped with IBM Tivoli Network Manager IP Edition versions 3.9 and 4.1.1; IBM WebSphere Application Server is a required product for IBM Tivoli Network Manager IP Edition version 4.2. Information about a security vulnerability affecting IBM WebSphere...

Spina Cross-site Scripting vulnerability

Cross-site Scripting XSS - Stored in GitHub repository spinacms/spina prior to 2.15.1...

Spina Cross-site Scripting vulnerability

Cross-site Scripting XSS - Stored in GitHub repository spinacms/spina prior to 2.15.1...

PT-2023-25062 · H3C · H3C Magic

Name of the Vulnerable Software and Affected Versions: H3C Magic version B1STV100R012 Description: A stack overflow in the UpdateWanParams function allows attackers to cause a Denial of Service DoS via a crafted POST request to an unspecified API endpoint. Recommendations: For version B1STV100R01...