CVE-2023-4317

An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an unprotected branch ...

PT-2023-28723 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 9.2 through 16.4.2 GitLab versions 16.5 through 16.5.2 GitLab versions 16.6 through 16.6.0 Description: An issue has been discovered in GitLab where a user with the Developer role could update a pipeline schedule from an...

GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab that stems from the ability of a use...

The vulnerability of Intradesk’s request tracking system arises from the lack of measures taken to protect its web page structure, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of Intradesk’s request tracking system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out a cross-site scripting attack remotely...

PT-2023-31280 · Jenkins · Jenkins Matlab Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins MATLAB Plugin versions 2.11.0 and earlier Description: The issue arises from missing permission checks in the Jenkins MATLAB Plugin, allowing attackers to have Jenkins parse an XML file from the Jenkins controller file system...

The vulnerability of the Apache Submarine machine learning platform, related to the lack of protection for SQL query structures, allows attackers to execute arbitrary SQL queries.

The vulnerability of the Apache Submarine machine learning platform relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

The vulnerability of the clearAlertByIds() function in the ProSAFE Network Management System (NMS300) allows a hacker to increase their privileges.

The vulnerability of the clearAlertByIds function in the ProSAFE Network Management System NMS300 for managing, diagnosing, and optimizing network devices is related to the lack of protection for the SQL query structure. Exploiting this vulnerability could allow a malicious actor to increase thei...

WPCafe < 2.2.23 - Missing Authorization

Description The plugin is vulnerable to unauthorized access, modification, or loss of data due to a missing capability check on an unknown function, allowing unauthenticated attackers to make use of the unprotected functionality...

The vulnerability of the “Show Syntax Highlighted” function on the Splunk Enterprise operating system for Windows allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the “Show Syntax Highlighted” function on the Splunk Enterprise operating system for Windows exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out cross-site scripting attacks remotely...

CoCart – Headless ecommerce <= 3.11.2 - Missing Authorization

Description The plugin is vulnerable to unauthorized access of data, modification of data, or loss of data due to a missing capability check on an unknown function, allowing unauthenticated attackers to make unauthorized use of the unprotected function...

The vulnerability of the administration console of the SIMATIC PCS neo web-based process control system lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary JavaScript code.

The vulnerability of the administration console of the SIMATIC PCS neo web-based process control system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a remote attacker to execute arbitrary JavaScript code...

Server side request forgery (ssrf)

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker can use an unprotected endpoint in the Mail app to perform a SSRF attack. Nextcloud Mail app versions 2.2.8 and 3.3.0 contain a patch for...

The vulnerability of the command-line interface (CLI) of the Microsoft Azure platform, which allows a hacker to gain access to user credentials

The vulnerability of the Command Line Interface CLI of the Microsoft Azure platform is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor to gain access to user credentials remotely...

Nextcloud Code Issues Vulnerabilities

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A code issue vulnerability exists in Nextcloud Mail versions prior to 2.2.8 and prior to 3.3.0, which can be exploited by an attacker to perform a...

The vulnerability of the General/vehicle/checkup/delete.php component of the Tongda OA automation tool allows a hacker to execute arbitrary SQL code.

The vulnerability of the General/vehicle/checkup/delete.php component of the Tongda OA automation tool for business processes is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

CVE-2023-6119

An Improper Privilege Management vulnerability in Trellix GetSusp prior to version 5.0.0.27 allows a local, low privilege attacker to gain access to files that usually require a higher privilege level. This is caused by GetSusp not correctly protecting a directory that it creates during execution...

The vulnerability of the Bulkmodifications component in NagiosXI software, related to the lack of measures taken to protect the SQL query structure, allows attackers to execute arbitrary SQL queries.

The vulnerability of the Bulkmodifications component in NagiosXI software is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

The vulnerability of the WP_Query class in the WordPress content management system allows attackers to expose stored user credentials.

The vulnerability of the WPQuery class in the WordPress content management system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to access and disclose stored user credentials...

TEM Opera Plus FM Family Transmitter 35.45 Remote Code Execution

TEM Opera Plus FM Family Transmitter 35.45 Remote Code Execution Vendor: Telecomunicazioni Elettro Milano TEM S.r.l. Product web page: https://www.tem-italy.it Affected version: Software version: 35.45 Webserver version: 1.7 Summary: This new line of Opera plus FM Transmitters combines very high...

Database Mess Up: 7TB of Healthcare Data Leak Affects 12 Million Patients

By Deeba Ahmed Yet another day, more unprotected data left in the Cloud without password or security measures. This is a post from HackRead.com Read the original post: Database Mess Up: 7TB of Healthcare Data Leak Affects 12 Million Patients...