PT-2024-1009 · Cisco · Cisco Unity Connection

Name of the Vulnerable Software and Affected Versions: Cisco Unity Connection affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected syste...

pyLoad Access Control Error Vulnerability

pyload is a free and open source download manager written in Python, designed to be extremely lightweight, easily extensible and fully manageable over the Web. An access control error vulnerability exists in versions prior to pyLoad 0.5.0b3.dev76, which stems from allowing an unauthenticated...

CVE-2023-50921

An issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the adduser interface in the system module to gain root privileges. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750...

GitLab 13.4 < 13.12.9 / 14.0 < 14.0.7 / 14.1 < 14.1.2 (CVE-2021-22253)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions...

CubeFS Security Feature Issue Vulnerability

CubeFS is a cloud-native file storage for CubeFS individual developers. A security signature issue vulnerability exists in versions prior to CubeFS 3.3.1 that stems from the use of an insecure random string generator to generate user-specific sensitive keys. An attacker can escalate privileges by...

ReVanced API Security Vulnerability

The ReVanced API is a simple API for proxying requests needed to provide data to ReVanced Manager and websites. A security vulnerability exists in ReVanced API 71f81f7f20cd26fd707335bca9838fa3e7df20d2 and prior versions, which stems from a lack of error caching, leading to the triggering of rate...

GLSA-202312-15 : Git: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202312-15 Git: Multiple Vulnerabilities - Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a .gitattributes file to the...

Estatik Real Estate Plugin < 4.1.1 - Reflected XSS

Description The plugin does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open one of the URLs below some...

CVE-2023-4256

Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the tcpeditdltcleanup function within plugins/dltplugins.c. This vulnerability can be exploited by supplying a specifically crafted file to the tcprewrite binary. This flaw enables a local attacker to initiate a...

CVE-2023-2487

creationtimestamp| type| source ---|---|--- 2023-12-21 15:21:42+00:00| seen| https://t.me/ctinow/157745...

GHSA-4H72-34J6-J8X7 Maloja error page XSS vulnerability

Impact The error page for a missing path echoes the path back to the user. If this contains HTML, an attacker could execute a script on the user's machine inside the Maloja context and perform authorized actions like scrobbling or deleting scrobbles. This does not affect the security of your...

Zabbix Security Vulnerabilities

Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring, and application monitoring. A security vulnerability exists in Zabbix Server that stems from a received session cookie that can be used to access the front-end as a...

CVE-2023-39340: Undefined Security Weakness

A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to Denial of Service DoS of the appliance...

CVE-2023-6051

An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when source code or installation packages are pulled from a specific tag...

CVE-2023-48582 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

troconiz.com Improper Access Control vulnerability OBB-3814122

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GitLab 0 < 16.4.4 / 16.5 < 16.5.4 / 16.6 < 16.6.2 (CVE-2023-6051)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be...

CVE-2023-49713

Denial-of-service DoS vulnerability exists in NetBIOS service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service DoS condition may occur...

CVE-2023-49140

Denial-of-service DoS vulnerability exists in commplex-link service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service DoS condition may occur...

Race condition

Denial-of-service DoS vulnerability exists in commplex-link service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service DoS condition may occur...