About the security content of iOS 16.4 and iPadOS 16.4

About the security content of iOS 16.4 and iPadOS 16.4 This document describes the security content of iOS 16.4 and iPadOS 16.4. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

About the security content of macOS Ventura 13.3

About the security content of macOS Ventura 13.3 This document describes the security content of macOS Ventura 13.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases...

MiniDVBLinux <=5.4 - Config Download Exploit

Exploit Title: MiniDVBLinux =5.4 Config Download Exploit Exploit Author: LiquidWorm Vendor: MiniDVBLinux Product web page: https://www.minidvblinux.de Affected version: =5.4 Summary: MiniDVBLinuxTM Distribution MLD. MLD offers a simple way to convert a standard PC into a Multi Media Centre based ...

PT-2023-17785 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to improper input validation, which can trigger a persistent reboot loop. This can lead to a local denial of service, requiring User execution privileges. No user interaction is...

Monitorr 1.7.6m / 1.7.7d Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Monitorr unauthenticated Remote Code Execution RCE', 'Description' = %q This module exploits an arbitrary file upload vulnerability and achieving...

CVE-2023-27903

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to the Jenkins controller file system to...

CVE-2023-1257

An attacker with physical access to the affected Moxa UC Series devices can initiate a restart of the device and gain access to its BIOS. Command line options can then be altered, allowing the attacker to access the terminal. From the terminal, the attacker can modify the device’s authentication...

CVE-2023-1257

CVE-2023-1257 affects Moxa UC Series devices. The vulnerability arises from improper physical access control, enabling an attacker with physical access to restart the device, access BIOS, alter bootloader/command-line options, and reach the terminal to modify authentication files and create a new...

Moxa UC 安全漏洞

The MOXA UC Series is a series of computers from the Chinese company Moxa MOXA. The Moxa UC suffers from a security vulnerability that originates from the fact that an attacker with physical access can boot the device to reboot and gain access to its BIOS, which can then be used to change command...

PT-2023-17496 · Unknown · Pqframework

Name of the Vulnerable Software and Affected Versions: pqframework affected versions not specified Description: The issue is related to a possible out of bounds write due to a missing bounds check in pqframework. This could lead to local escalation of privilege, with System execution privileges...

CVE-2022-44875

KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows attackers to obtain SYSTEM access via KioUtils.Execute in JavaScript code...

CVE-2022-44875

KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows attackers to obtain SYSTEM access via KioUtils.Execute in JavaScript code...

Code injection

KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows attackers to obtain SYSTEM access via KioUtils.Execute in JavaScript code...

CVE-2022-44875

KioWare (Windows) 8.33 and earlier versions are affected by CVE-2022-44875 due to KioScriptingUrlACL.AclActions.AllowHigh being set for the about:blank origin. This allows JavaScript code via KioUtils.Execute to obtain SYSTEM access. The vulnerability details across multiple sources confirm the r...

PT-2023-14564 · Kioware · Kioware

Name of the Vulnerable Software and Affected Versions: KioWare versions through 8.33 Description: The issue allows attackers to obtain SYSTEM access via KioUtils.Execute in JavaScript code because KioWare sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin. Recommendations: Fo...

CVE-2022-44875

KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows attackers to obtain SYSTEM access via KioUtils.Execute in JavaScript code...

CVE-2022-44875

KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows attackers to obtain SYSTEM access via KioUtils.Execute in JavaScript code...

ASB-A-258422561

In onAttach of SettingsPreferenceFragment.java, there is a possible bypass of Factory Reset Protections due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-26256

An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By modifying the fileName parameter to the snjFooterNavigationConfig endpoint, it is possible to traverse and read the file system...

CVE-2023-26255

An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By modifying the fileName parameter to the snjCustomDesignConfig endpoint, it is possible to traverse and read the file system...