PT-2023-23727 · Zhong Bang · Crmeb

Name of the Vulnerable Software and Affected Versions: Zhong Bang CRMEB versions up to 4.6.0 Description: A critical issue affects the Image Upload component, specifically the file /api/wechat/app auth, leading to deserialization due to some unknown processing. Recommendations: For versions up to...

PT-2023-23774 · Otcms · Otcms

Name of the Vulnerable Software and Affected Versions: OTCMS versions up to 6.62 Description: A vulnerability has been found in an unknown functionality of the file usersNews deal.php. The manipulation of the file argument leads to path traversal, specifically '../filedir'. Recommendations: For...

PT-2023-4568

Name of the Vulnerable Software and Affected Versions Google Guava versions 1.0 through 31.1 Description The issue is related to the use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava. This allows other users and apps on the machine with access t...

GHSA-7MCW-XMX3-7P8M Insecure Temporary File in HuTool

Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile function at /core/io/FileUtil.java...

PT-2023-3086 · Ipswitch · Moveit Transfer

Name of the Vulnerable Software and Affected Versions: MOVEit Transfer versions prior to 2021.0.7 13.0.7 MOVEit Transfer versions prior to 2021.1.5 13.1.5 MOVEit Transfer versions prior to 2022.0.5 14.0.5 MOVEit Transfer versions prior to 2022.1.6 14.1.6 MOVEit Transfer versions prior to 2023.0.2...

Cisco AnyConnect Secure Mobility Client for Windows Privilege Escalation (cisco-sa-ac-csc-privesc-wx4U4Kw)

The version of Cisco AnyConnect Secure Mobility Client installed on the remote host is prior to 4.10.07061. It is, therefore, affected by a privilege escalation vulnerability that exists because improper permissions are assigned to a temporary directory that is created during the upgrade process...

SUSE CVE-2023-33865

RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership...

PT-2023-24000 · Pydio · Pydio Cells

Name of the Vulnerable Software and Affected Versions: Pydio Cells versions 4.1.2 and earlier Description: The issue allows for cross-site scripting XSS due to the exposure of secrets used to sign presigned URLs for file downloads. These secrets are hardcoded and accessible through the web...

DEBIAN-CVE-2023-33865

RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership...

UBUNTU-CVE-2023-33865

RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership...

PT-2023-24365 · Xxl-Rpc · Xxl-Rpc

Name of the Vulnerable Software and Affected Versions: xxl-rpc version 1.7.0 Description: A deserialization vulnerability was discovered in xxl-rpc via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.NettyDecodedecode. This issue allows for potential exploitation. No information is...

PT-2023-24381 · Planet Technologies · Wdrt-1800Ax

Name of the Vulnerable Software and Affected Versions: Planet Technologies WDRT-1800AX version v1.01-CP21 Description: The issue allows attackers to bypass authentication and escalate privileges to root via manipulation of the LoginStatus cookie. Recommendations: For Planet Technologies WDRT-1800...

PT-2023-24683 · Unknown · Taosdata/Grafanaplugin

Name of the Vulnerable Software and Affected Versions: taosdata/grafanaplugin affected versions not specified Description: The issue concerns a command injection vulnerability in the Release PR Merged workflow. This vulnerability allows for arbitrary code execution within the GitHub action contex...

PT-2023-24334 · Minical · Minical

Name of the Vulnerable Software and Affected Versions: Minical version 1.0.0 Description: The issue is related to Cross Site Scripting XSS and is caused by insufficient input validation in the application's user input handling in the security helper.php file. Recommendations: For Minical version...

CVE-2023-28161

If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, suc...

CVE-2023-28161

If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, suc...

CVE-2023-28161

If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, suc...

CVE-2023-2547

The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions...

Medium: mariadb

Issue Overview: getsortbytable in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY. CVE-2021-46657 MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECTLEX::nestlevel is local to each VIEW. CVE-2021-46659 MariaDB through...

WordPress Plugin Feather Login Page 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...