CVE-2023-37490

SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file created in a temporary directory during the installation process. On replacing this executable with a malicious file, an attacker can completely compromise the...

PT-2023-4406 · Intel · Intel(R) Support

Name of the Vulnerable Software and Affected Versions: IntelR Support android application versions prior to v23.02.07 Description: The issue is related to incorrect default permissions in the IntelR Support android application, which may allow a privileged user to potentially enable information...

PT-2023-4563 · Adobe · Acrobat Document Cloud +3

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader versions 23.003.20244 and earlier Adobe Acrobat Reader versions 20.005.30467 and earlier Adobe Acrobat 2020 Adobe Acrobat Reader 2020 Adobe Acrobat Document Cloud Adobe Acrobat Reader Document Cloud Description: The issue...

PT-2023-26585 · Unknown · Wger Workout Manager

Name of the Vulnerable Software and Affected Versions: wger Workout Manager version 2.2.0a3 Description: A Cross Site Scripting issue allows a remote attacker to gain privileges via the license author field in the add-ingredient function in the templates/ingredients/view.html,...

SAP Business Objects Code Issue Vulnerability

SAP Business Objects is a business intelligence suite from SAP, Germany. A code issue vulnerability exists in SAP BusinessObjects Installer that originates from allowing an authenticated attacker within a network to overwrite an executable file created in a temporary directory during installation...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists due to the incorrect header implementation in the project page, which allows an attacker to have temporary read access to the private repository...

odoh-rs's Invalid Slice Split Results in Server Panic

A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients. Impact An attacker with knowledge of this vulnerability could craft and...

CVE-2023-26449

The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker...

CVE-2023-26448

Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit...

Default credentials

Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and...

PT-2023-27166 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 9.3 through 16.0.7 GitLab CE/EE versions 16.1 through 16.1.2 GitLab CE/EE versions 16.2 through 16.2.1 Description: An issue has been discovered in GitLab CE/EE, where a Regular Expression Denial of Service was possible...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : guava (SUSE-SU-2023:3090-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3090-1 advisory. Upgrade to guava 32.0.1: - CVE-2020-8908: Fixed predictable temporary files and directories used...

SUSE-SU-2023:3090-1 Security update for guava

This update for guava fixes the following issues: Upgrade to guava 32.0.1: - CVE-2020-8908: Fixed predictable temporary files and directories used in FileBackedOutputStream bsc1179926. - CVE-2023-2976: Fixed a temp directory creation vulnerability bsc1212401...

PT-2023-14069 · Precisely · Precisely Spectrum Spatial Analyst

Name of the Vulnerable Software and Affected Versions: Precisely Spectrum Spatial Analyst version 20.01 Description: The issue is related to Server-Side Request Forgery SSRF, which is a type of attack where an attacker can trick a server into making requests to internal or external resources. Thi...

PT-2023-13037 · Yii2 · Yii2

Name of the Vulnerable Software and Affected Versions: Yii 2 version 2.0.45 Description: A cross-site scripting XSS issue was discovered via the endpoint "/books". This allows for potential malicious script execution. The estimated number of affected devices and real-world incidents are not...

PT-2023-27133 · Sourcecodester · Sourcecodester Online Jewelry Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Jewelry Store version 1.0 Description: A critical issue has been found in the login.php file, where the manipulation of the username and password arguments leads to sql injection. The attack can be initiated remotely...

PT-2023-7319 · Unknown +2 · Insights-Client +2

Name of the Vulnerable Software and Affected Versions: insights-client affected versions not specified Description: A security issue occurs due to insecure file operations or unsafe handling of temporary files and directories, leading to local privilege escalation. An unprivileged local user or...

PT-2023-26959 · Mcafee · Epo

Name of the Vulnerable Software and Affected Versions: ePO versions prior to 5.10 SP1 Update 1 Description: A reflected cross-site scripting XSS vulnerability allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated eP...

CVE-2022-46902

An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is a Path Traversal for an Unzip operation. The Vocera Report Console contains a websocket function that allows for the restoration of the database from a ZIP archive that expects a SQL import file. During the...

CVE-2023-21405

Knud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network Intercoms when communicating over OSDP, highlighting that the OSDP message parser crashes the pacsiod process, causing a temporary unavailability of the door-controlling functionalities meaning that doors...