685 matches found
PT-2023-30586 · Ibm · Ibm I +1
Name of the Vulnerable Software and Affected Versions: IBM i versions 7.3 through 7.5 IBM i Db2 Mirror for i versions 7.4 through 7.5 Description: The issue allows clear-text passwords to be left in browser memory, which can be viewed using common browser tools before the memory is garbage...
AZL-32073 CVE-2023-49288 affecting package squid 5.7-5
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with...
Sentrifugo security breach
Sentrifugo is a human resource management system. The system includes features for human resource management, performance appraisal, recruitment management, and asset management. A security vulnerability exists in Sentrifugo version 3.5 that stems from allowing an authenticated attacker to upload...
GitLab Enterprise Edition Security Vulnerability
GitLab Enterprise Edition EE is a content management system from the US-based GitLab, Inc. A security vulnerability exists in GitLab Enterprise Edition that stems from a security hole when updating a target branch. Affected products and versions: GitLab EE versions 15.3 through 16.2.8 prior, 16.3...
Nanoleaf Light strip security vulnerability
Nanoleaf Light strip is a smart LED strip from Nanoleaf. A security vulnerability exists in Nanoleaf Light strip version v3.5.10 that could allow an attacker to send a malicious message and cause a denial of service...
VMware Tools Security Vulnerability
VMware Tools is an enhancement tool that comes with VMware's VMWare virtual machines. It is a driver provided by VMware to enhance the performance of virtual graphics cards and hard disks, as well as to synchronize the clocks of the virtual machine with the host computer. A security vulnerability...
October 26, 2023-KB5031904 Cumulative Update Preview for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 22H2
None None...
PT-2023-29203 · Liferay · Liferay Dxp +1
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.2 through 7.4.3.53 Liferay DXP 7.4 before update 54 Description: The issue concerns multiple stored cross-site scripting XSS vulnerabilities in the fragment components. These vulnerabilities allow remote attackers ...
CVE-2023-35194
An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 in QEMU. A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerabilit...
CVE-2023-27380
An OS command injection vulnerability exists in the admin.cgi USSDsend functionality of peplink Surf SOHO HW1 v6.3.5 in QEMU. A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...
October 10, 2023-KB5031223 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 21H2
None None...
October 10, 2023-KB5031225 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 11, version 21H2
None None...
ThingsBoard Injection Vulnerability
Thingsboard is a Java-based platform for monitoring, management, and data collection of IOT devices from the Thingsboard team. A security vulnerability exists in ThingsBoard versions prior to 3.5, which stems from the presence of a server-side template injection vulnerability...
WideStand CMS Cross-Site Scripting Vulnerability
WideStand CMS is a content management system from WideStand, Inc. A cross-site scripting vulnerability exists in WideStand CMS versions prior to 5.3.5 that stems from the direct use of the query's URL content to generate one of the meta tags, which would allow an attacker to inject HTML/Javascrip...
USN-6400-1 python2.7, python3.5 vulnerability
It was discovered that Python did not properly provide constant-time processing for a crypto operation. An attacker could possibly use this issue to perform a timing attack and recover sensitive information...
USN-6394-1 python3.5 vulnerability
It was discovered that Python incorrectly handled certain scripts. An attacker could possibly use this issue to execute arbitrary code or cause a crash...
PT-2023-27983 · Jeecg · Jeecg
Name of the Vulnerable Software and Affected Versions: Jeecg versions up to 3.5.3 Description: The issue is an arbitrary file read vulnerability. It can be exploited via the interface "/testConnection". Recommendations: For versions up to 3.5.3, as a temporary workaround, consider restricting...
USN-6354-1 python2.7, python3.5 vulnerability
It was discovered that Python did not properly handle XML entity declarations in plist files. An attacker could possibly use this vulnerability to perform an XML External Entity XXE injection, resulting in a denial of service or information disclosure...
