Format String Bug in fortiguard-resources CLI command

A format string vulnerability CWE-134 in the command line interpreter of FortiOS and FortiProxy may allow an authenticated user to execute unauthorized code or commands via specially crafted command arguments...

Node.js security feature vulnerabilities

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in versions of Node.js prior to version 3.2.1 that stems from the crypto-js package generating random numbers by concatenating strings, but using integers, which makes the output predictable...

Huawei EulerOS: Security Advisory for pkgconf (EulerOS-SA-2023-2244)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Format String Bug in Fclicense daemon

A use of externally-controlled format string vulnerability CWE-134 in the Fclicense daemon of FortiOS may allow a remote authenticated attacker to execute arbitrary code or commands via specially crafted requests...

PT-2023-3353

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.2.0 through 7.2.4 FortiOS versions 7.0.0 through 7.0.11 FortiOS versions 6.4.0 through 6.4.12 FortiOS versions 6.2.0 through 6.2.14 FortiOS versions 6.0.0 through 6.0.16 FortiProxy versions 7.2.0 through 7.2.4 FortiProxy...

PT-2023-3765

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.2 and earlier FortiOS versions 6.4 and earlier FortiOS versions 7.0 and earlier FortiOS versions 7.2.0 through 7.2.4 FortiProxy versions 7.0.0 through 7.0.7 FortiProxy versions 7.2.0 through 7.2.1 Description The issue is...

Fortinet Fortigate Format String Bug in Fclicense daemon (FG-IR-23-119)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-119 advisory. - A use of externally-controlled format string in Fortinet FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through...

CVE-2023-34364

A buffer overflow was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. An overly large value for certain options of a connection string may overrun the buffer allocated to process the string value. This allows an attacker to execute code of their choice on an...

CVE-2023-34364

A buffer overflow was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. An overly large value for certain options of a connection string may overrun the buffer allocated to process the string value. This allows an attacker to execute code of their choice on an...

Buffer overflow

A buffer overflow was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. An overly large value for certain options of a connection string may overrun the buffer allocated to process the string value. This allows an attacker to execute code of their choice on an...

CVE-2023-1978

The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the query string in versions up to, and including, 4.9.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2023-34112

JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the bytedeco/javacpp-presets use the github.event.headcommit.message​ parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection...

FortiWeb web applications Format String Code Execution

The vulnerability of FortiWeb web applications’ network firewalls is related to the use of an uncontrolled format string. Exploiting this vulnerability could allow a hacker to execute arbitrary code...

Progress Software DataDirect Connect buffer error vulnerability

Progress Software DataDirect Connect is a data connectivity solution from Progress Software, Inc. that can run in the cloud or locally. A security vulnerability previously existed in Progress Software DataDirect Connect version 08.02.2770, which stemmed from the fact that an overly large value fo...

GTWWebMonitor.exe SCADA Code Execution

The vulnerability of the GTWWebMonitor.exe executable in the SCADA system SCADA Data Gateway is related to the use of uncontrolled format strings. Exploiting this vulnerability could allow a malicious actor to cause service interruptions or execute arbitrary code by sending specially crafted...

mp4v2 DoS

The vulnerability of the MP4BytesProperty and MP4StringProperty classes in the library for creating, modifying, and reading MP4 files, mp4v2, is related to the issue where operations are performed outside of the buffer during the processing of variable count values. Exploiting this vulnerability...

CVE-2023-34364

A buffer overflow was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. An overly large value for certain options of a connection string may overrun the buffer allocated to process the string value. This allows an attacker to execute code of their choice on an...

PT-2023-17386

Name of the Vulnerable Software and Affected Versions ShiftController Employee Shift Scheduling plugin for WordPress versions up to, and including, 4.9.25 Description The issue is related to Reflected Cross-Site Scripting via the query string due to insufficient input sanitization and output...

CVE-2023-1978: Improper Neutralization of Input During Web Page Generation

The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the query string in versions up to, and including, 4.9.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

VMware Aria Operations for Networks exportPDF Code Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of VMware Aria Operations for Networks. Authentication is required to exploit this vulnerability. The specific flaw exists within the exportPDF method. The issue results from the lack of proper...