CVE-2023-22640

A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.11, FortiOS version 6.2.0 through 6.2.13, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7,...

Exploit for Incorrect Authorization in Linux Linux_Kernel

Linux Bluetooth: Unauthorized management command execution CV...

CVE-2022-43948

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0.0 through 7.0.3, FortiADC version 7.1.0 through 7.1.1, FortiADC version 7.0.0 through 7.0.3, FortiADC 6.2 all versions, FortiADC 6.1 all versions, FortiADC 6.0 all versions,...

CVE-2023-27893 Arbitrary Code Execution in SAP Solution Manager and ABAP managed systems (ST-PI)

An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems ST-PI - versions 20881700, 20081710, 740, can use a vulnerable interface to execute an application function to perform actions which they...

Debian: Security Advisory (DLA-3357-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Make proposals fail, no-revert on error, loss of funds

Lines of code Vulnerability details Impact The issue exists because anyone can call executein the multisig contract with will execute the proposal in the DAO contract. The problem here is that certain proposal will not revert when they fail because they have the uint256 allowFailureMap param set ...

CVE-2023-26472

XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having ed...

K31301245: TMUI CSRF vulnerability CVE-2020-5904

Security Advisory Description A cross-site request forgery CSRF vulnerability in the Traffic Management User Interface TMUI, also referred to as the Configuration utility, exists in an undisclosed page. CVE-2020-5904 Impact An attacker may be able to use the session of an administrator user to...

CVE-2022-40683

A double free in Fortinet FortiWeb version 7.0.0 through 7.0.3 may allows attacker to execute unauthorized code or commands via specially crafted commands...

CVE-2022-45789

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure Control Expert All Versions, EcoStruxure Process Expert All Versions...

CVE-2022-2251

Improper sanitization of branch names in GitLab Runner affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user who creates a branch with a specially crafted name and gets another user to trigger a pipeline to execute commands in the runner as that othe...

CVE-2022-4223

The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pgdump and pgrestore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to...

CVE-2022-43722

A vulnerability has been identified in SICAM PAS/PQS All versions V7.0. Affected software does not properly secure a folder containing library files. This could allow an attacker to place a custom malicious DLL in this folder which is then run with SYSTEM rights when a service is started that...

CVE-2022-39102

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

Design/Logic Flaw

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

PT-2022-24726 · Unknown · Power Management Service

Name of the Vulnerable Software and Affected Versions: Power management service affected versions not specified Description: The issue is related to a missing permission check in the power management service. This could allow setting up the power management service without needing additional...

CVE-2022-35259

XML Injection with Endpoint Manager 2022. 3 and below causing a download of a malicious file to run and possibly execute to gain unauthorized privileges...

Potential security issues in CrossChainExecutorOptimism contract

Lines of code Vulnerability details Title: Potential security issues in CrossChainExecutorOptimism contract Product: CrossChainExecutorOptimism contract Version: 0.8.16 Summary: The CrossChainExecutorOptimism contract contains several potential security issues that could allow unauthorized or...

CVE-2022-29829

Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 GOT2000 versions from 1.122C to 1.290C, Motion Control SettingGX Works3 related software versions from 1.035M to 1.042U, and MT Works2 versions from 1.100E to...

Pool funds can be used by anyone due to lack of allowance in the custom implementation of transferFrom

Lines of code Vulnerability details Impact Users' Pool assets can be used by anyone to execute a transaction, essentially stealing from them. Proof of Concept Pool contract uses a custom implementation of transferFrom which allows transfer of Pool assets from any address to any address as long as...