PT-2023-26098 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: GPAC version 2.3-DEV-rev381-g817a848f6-master Description: A segmentation violation was discovered in the gf isom remove user data function at /lib/libgpac.so. This issue affects the specified version of GPAC. Recommendations: For GPAC versio...

PT-2023-23269 · Unknown · Istar Ultra G2 +3

Name of the Vulnerable Software and Affected Versions: iSTAR Ultra affected versions not specified iSTAR Ultra LT affected versions not specified iSTAR Ultra G2 affected versions not specified iSTAR Edge G2 affected versions not specified Description: An unauthenticated user could log into the...

PT-2023-4095 · Sap · Abap Platform +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP and ABAP Platform versions 7.22 through 7.93 Description: The issue is related to improper authentication checks for functionalities that require user identity. This can allow an attacker to perform...

OESA-2023-1412 guava security update

Guava is a set of core Java libraries from Google that includes new collection types such as multimap and multiset, immutable collections, a graph library, and utilities for concurrency, I/O, hashing, caching, primitives, strings, and more! It is widely used on most Java projects within Google, a...

OESA-2023-1411 guava20 security update

Guava is a set of core libraries that includes new collection types ,immutable collections, a graph library, and utilities for concurrency, I/O, hashing, primitives, strings, and more. Security Fixes: Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google...

PT-2023-3896 · Totolink · Totolink Lr350

Name of the Vulnerable Software and Affected Versions: TOTOLINK LR350 version 9.3.5u.6369 B20220309 Description: The issue is related to a command injection vulnerability via the hostname parameter in the setOpModeCfg function. This vulnerability is associated with a lack of input data...

PT-2023-25767 · Travianz · Travianz

Name of the Vulnerable Software and Affected Versions: TravianZ versions 8.3.4 and earlier Description: The issue allows for XSS attacks through various means, including the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie. Recommendations: For...

PT-2023-11605 · Duxcms · Duxcms

Name of the Vulnerable Software and Affected Versions: DuxCMS version 2.1 Description: A directory traversal issue allows attackers to delete arbitrary files via the /admin/AdminBackup/del API endpoint. This enables attackers to potentially disrupt system functionality or destroy sensitive data...

Security Bulletin: Multiple vulnerabilities of Apache Ant (ant-1.7.0.jar, ant-1.8.4.jar) have affected APM JBoss, APM WebLogic and APM SAP NetWeaver Java™ Stack Agents.

Summary APM JBoss, APM WebLogic and APM SAP NetWeaver Java™ Stack Agents are vulnerable to Apache Antant-1.7.0.jar, ant-1.8.4.jar CVE-2021-36373, CVE-2020-1945, CVE-2012-2098, CVE-2020-11979, CVE-2021-36374. The fix includes ant jar upgraded to ant-1.10.13.jar. Vulnerability Details...

PT-2023-4241 · Tenda · Tenda F1203 +5

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 2.0 V15.03.06.23 Tenda AC7 version 1.0 V15.03.06.44 Tenda F1203 version 2.0.1.6 Tenda AC5 version 1.0 V15.03.06.28 Tenda FH1203 version 2.0.1.6 Tenda AC9 version 3.0 V15.03.06.42 multi Tenda FH1205 version 2.0.0.7775...

PT-2023-24851 · Move · Move

Name of the Vulnerable Software and Affected Versions: MOVE versions 4.10.x and earlier Description: An unquoted Windows search path vulnerability existed in the Windows install service, allowing an unauthorized local user to insert arbitrary code into the unquoted service path to obtain privileg...

CVE-2023-2976

A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory. Mitigation Temp files should be...

postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions

A flaw was found in org.postgresql. This issue allows the creation of a temporary file when using PreparedStatement.setTextint, InputStream and PreparedStatemet.setByteaint, InputStream. This could allow a user to create an unexpected file available to all users, which could end in unexpected...

Moderate: Red Hat Security Advisory: Red Hat build of Quarkus 2.13.8 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more information...

postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions

A flaw was found in org.postgresql. This issue allows the creation of a temporary file when using PreparedStatement.setTextint, InputStream and PreparedStatemet.setByteaint, InputStream. This could allow a user to create an unexpected file available to all users, which could end in unexpected...

Updated sqlite packages fix security vulnerability

osunix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service application crash, or have unspecified other impact by leveraging use of the current working directory for...

PT-2023-24972 · Unknown · Phpgurukul Hospital Management System

Name of the Vulnerable Software and Affected Versions: PHPgurukl Hostel Management System version 1.0 Description: The issue is related to Cross Site Scripting XSS via the Add New Course feature. This means an attacker could potentially inject malicious scripts into the system, affecting users wh...

The vulnerability of the J-Web interface of Juniper Networks Junos OS allows a attacker to load arbitrary files into temporary directories on the device.

The vulnerability of the J-Web interface in Juniper Networks Junos OS systems is related to improper authentication. Exploiting this vulnerability allows a malicious actor, who lacks valid authentication, to upload arbitrary files to temporary directories on the device...

apache-james-mime4j: Temporary File Information Disclosure in MIME4J TempFileStorageProvider

A flaw was found in Apache James's Mime4j TempFileStorageProvider class, where it may set improper permissions when utilizing temporary files. This flaw allows a locally authorized attacker to access information outside their intended permissions...

PT-2023-21128 · WordPress · Erp

Name of the Vulnerable Software and Affected Versions: ERP WordPress plugin versions prior to 1.12.4 Description: The issue concerns a SQL injection problem. It occurs because the type parameter in the "erp/v1/accounting/v1/people" REST API endpoint is not properly sanitized and escaped before...