CVE-2023-2715 Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submitticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's...

CVE-2023-2715

CVE-2023-2715 concerns the Groundhogg WordPress plugin. Public records show vulnerable versions up to 2.7.9.8 where a missing capability check in the submit_ticket function can allow an authenticated user to modify data or create an admin account via a ticket that includes site data and a login l...

CVE-2023-2715 Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submitticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's...

CVE-2023-28045

Dell CloudIQ Collector version 1.10.2 contains a missing encryption of sensitive data vulnerability. An attacker with low privileges could potentially exploit this vulnerability, leading to gain access to unauthorized data...

CVE-2023-28045

Dell CloudIQ Collector 1.10.2 is affected by CVE-2023-28045: a lack of encryption of sensitive data. The vulnerability could allow a low-privilege attacker with network access to gain unauthorized data exposure (CVE description and CVSS metrics indicate Confidentiality Impact HIGH, Privileges Req...

mysql: InnoDB unspecified vulnerability (CPU Jan 2023)

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of thi...

PT-2023-6787 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 114.0.5735.90 Description: The issue is related to a use after free in the PDF component, which could allow a remote attacker to potentially exploit heap corruption via a crafted PDF file. This could lead to...

CVE-2023-21971

A vulnerability was found in MySQL Connector. Successful attacks of this vulnerability can result in the unauthorized ability to cause a hang or frequently repeatable crash, resulting in complete denial of service of MySQL Connectors. This issue can also result in an unauthorized update, insert o...

mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

kernel: out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c

An out-of-bounds memory read flaw was found in the Linux kernel. The IPv4 Handler component may delete IPv4 routes containing a multipath spec while the fibinfo is using a nexthop object. This issue allows a local attacker access to unauthorized data...

kernel: out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c

An out-of-bounds memory read flaw was found in the Linux kernel. The IPv4 Handler component may delete IPv4 routes containing a multipath spec while the fibinfo is using a nexthop object. This issue allows a local attacker access to unauthorized data...

PT-2023-2690 · Microsoft · Teams

Name of the Vulnerable Software and Affected Versions: Microsoft Teams affected versions not specified Description: The issue is related to insufficient validation of incoming requests in Microsoft Teams, which could allow a remote attacker to gain unauthorized access to information...

Important: java-11-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficul...

CVE-2023-31435

Multiple components such as Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire previews in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allow authenticated attackers to read and write to unauthorized data by accessing functions directly...

CVE-2023-31435

Multiple components such as Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire previews in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allow authenticated attackers to read and write to unauthorized data by accessing functions directly...

Evasys 安全漏洞

Evasys is a platform for fully automated surveys and exam solutions for online, paper-based and mixed use from Evasys Germany. A security vulnerability exists in Evasys versions prior to v8.2 Build 2286 and v9.x prior to v9.0 Build 2401, which stems from a vulnerability in multiple components tha...

CVE-2023-31435

Multiple components such as Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire previews in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allow authenticated attackers to read and write to unauthorized data by accessing functions directly...

CVE-2023-31435

CVE-2023-31435 – Evasys vulnerability (normal mode) Affected product: evasys (versions prior to 8.2 Build 2286 and 9.x prior to 9.0 Build 2401). Root cause / description: Multiple components (e.g., Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, questionnaire previews) all...

Vulnerabilities of operating systems iOS and iPadOS, related to lack of access control, allow attackers to gain unauthorized access to protected information.

The vulnerabilities of operating systems iOS and iPadOS are related to lack of access control. Exploiting these vulnerabilities can allow attackers to gain unauthorized access to protected information through special features...

OpenJDK: missing check for slash characters in URI-to-path conversion (8298667)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploi...