PT-2023-25543 · Unknown · Pos Codekop

Name of the Vulnerable Software and Affected Versions: POS Codekop version 2.0 Description: A reflected cross-site scripting XSS issue was found in POS Codekop. The issue is related to the nm member parameter at the "print.php" endpoint. This allows for potential XSS attacks. Recommendations: For...

PT-2023-25512 · Webkul · Webkul Qloapps

Name of the Vulnerable Software and Affected Versions: Webkul QloApps version 1.6.0 Description: An unauthenticated Cross-Site Scripting XSS issue allows an attacker to obtain a user's session cookie, which can then be used to impersonate the user. This is achieved via the POST controller...

CVE-2023-32386

A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An app may be able to observe unprotected user data...

CVE-2023-32386

A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An app may be able to observe unprotected user data...

PT-2023-25508 · Libredwg · Libredwg

Name of the Vulnerable Software and Affected Versions: LibreDWG version 0.12.5 Description: A heap buffer overflow issue was discovered in LibreDWG via the bit write TF function at bits.c. Recommendations: For LibreDWG version 0.12.5, consider disabling the bit write TF function as a temporary...

CVE-2023-32386

CVE-2023-32386 describes a privacy issue in macOS where an app may observe unprotected user data due to improved handling of temporary files. The vulnerability is fixed by Apple in specific OS updates: macOS Big Sur 11.7.7, macOS Monterey 12.6.6, and macOS Ventura 13.4. The NVD entry lists the im...

Apple macOS Ventura 安全漏洞

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Ventura that stems from an access issue where an application may be able to access mail folder attachments through a temporary directory used during compression...

Information Disclosure

Hutool Core is vulnerable to Information Disclosure. The vulnerability exists in createTempFile function at FileUtil.java because the temporary file has insecure default permissions which allows an attacker to read the file on the system...

PT-2023-22364 · Wavlink · Wavlink Wavrouter

Name of the Vulnerable Software and Affected Versions: WavLink WavRouter version RPT70HA1.x Description: An issue was discovered in "/cgi-bin/adm.cgi" that allows attackers to force a factory reset via a crafted payload. Recommendations: For WavLink WavRouter version RPT70HA1.x, as a temporary...

Unspecified Vulnerability in Mattermost (CNVD-2023-55048)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from an inability to clean up temporary error messages, which can be exploited by an attacker to obtain the content of arbitrary messages via...

PT-2023-11544 · Ebcms · Ebcms

Name of the Vulnerable Software and Affected Versions: ebCMS version 1.1.0 Description: The issue allows a remote attacker to execute arbitrary code via the upload type parameter. This enables the attacker to potentially gain control over the system, leading to unauthorized access and malicious...

PT-2023-4509 · Node.Js +1 · Node.Js +1

Name of the Vulnerable Software and Affected Versions: Node.js version 20 Description: A privilege escalation issue exists due to insufficient access control in the crypto.setEngine method of Node.js. This can be exploited by a remote attacker to bypass existing security restrictions. The attack...

Jenkins: Temporary plugin file created with insecure permissions

A flaw was found in Jenkins. Jenkins creates a temporary file when a plugin is uploaded from an administrator’s computer. If these permissions are overly permissive, they may allow attackers with access to the Jenkins controller file system to read and write the file before it is installed in...

Jenkins: Temporary file parameter created with insecure permissions

A flaw was found in Jenkins. When triggering a build from the Jenkins CLI, Jenkins creates a temporary file on the controller if a file parameter is provided through the CLI’s standard input. Affected versions of Jenkins create this temporary file in the default temporary directory with the defau...

Temporary Phone Number: An Essential Tool for Privacy Protection

By Owais Sultan In an era where our lives are increasingly interconnected with the digital world, safeguarding our privacy has become… This is a post from HackRead.com Read the original post: Temporary Phone Number: An Essential Tool for Privacy Protection...

Design/Logic Flaw

In doInBackground of NotificationContentInflater.java, there is a possible temporary denial or service due to long running operations. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Information Disclosure

com.google.guava, guava is vulnerable to Information Disclosure. The vulnerability exits due to incorrect default file permissions in FileBackedOutputStream, which allow an attacker to access the temporary directory...

Important: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Jenkins: Temporary file parameter created with insecure permissions

A flaw was found in Jenkins. When triggering a build from the Jenkins CLI, Jenkins creates a temporary file on the controller if a file parameter is provided through the CLI’s standard input. Affected versions of Jenkins create this temporary file in the default temporary directory with the defau...

Guava vulnerable to insecure use of temporary directory

Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files...