CVE-2023-45083

An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane. An authenticated admin-level user may be able to delete the "admin" or "serveradmin" users, which prevents authentication from subsequently...

Vulnerability fixed in Solarwinds Platform

Solarwinds has fixed a vulnerability in Solarwinds Platform. A malicious party could exploit the vulnerability to use SQL-Injection to gain access to sensitive data, or potentially execute arbitrary code with application privileges. For successful exploitation, the malicious party must be...

The vulnerability of the UDR-A authentication function in microprogrammed control devices like Red Lion SixTRAK and VersaTRAK allows attackers to execute arbitrary commands with administrative privileges.

The vulnerability of the UDR-A authentication function in microprogrammed control devices like Red Lion SixTRAK and VersaTRAK is related to the use of dangerous methods or functions. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary commands wit...

CVE-2023-48303

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, admins can change authentication details of user configured external storage...

CVE-2023-40151

When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message comes over TCP/IP t...

Authentication flaw

When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message comes over TCP/IP t...

CVE-2023-40151 Red Lion Controls Sixnet RTU Exposed Dangerous Method Or Function

When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled UDR-A any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message comes over TCP/IP t...

Red Lion Sixnet RTUs

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION : Exploitable remotely/low attack complexity Vendor : Red Lion Equipment : Sixnet RTU Vulnerabilities : Authentication Bypass using an Alternative Path or Channel, Exposed Dangerous Method or Function 2. RISK EVALUATION Successful exploitation...

PT-2023-22215 · WordPress · Whydonate

Name of the Vulnerable Software and Affected Versions: Whydonate Whydonate – FREE Donate button – Crowdfunding – Fundraising plugin versions = 3.12.15 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a use...

GATOR - GCP Attack Toolkit For Offensive Research, A Tool Designed To Aid In Research And Exploiting Google Cloud Environments

GATOR - GCP Attack Toolkit for Offensive Research , a tool designed to aid in research and exploiting Google Cloud Environments. It offers a comprehensive range of modules tailored to support users in various attack stages, spanning from Reconnaissance to Impact. Modules Resource Category |...

Improper Input Validation

vrite is vulnerable to Improper Input Validation. An Attacker may attempt to flood your authentication system with requests that include very long password hashes, leading to resource exhaustion and potentially causing a denial of service. Longer password hashes take more time to compute during t...

CVE-2023-45690 Information leak via default file permissions on Titan MFT and Titan SFTP servers

Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem...

Apache Superset 2.0.0 Remote Code Execution Exploit

Apache Superset versions 2.0.0 and below utilize Flask with a known default secret key which is used to sign HTTP cookies. These cookies can therefore be forged. If a user is able to login to the site, they can decode the cookie, set their userid to that of an administrator, and re-sign the cooki...

Authorization Bypass

Org.apache.zookeeper: zookeeper is vulnerable to authorization bypass. This vulnerability exists due to improper implementation of a User-Controlled Key for user authentication, allowing an attacker to gain access to the system and perform unauthorized actions. Note that this vulnerability is onl...

CVE-2023-32485

Dell SmartFabric Storage Software version 1.3 and lower contain an improper input validation vulnerability. A remote unauthenticated attacker may exploit this vulnerability and escalate privileges up to the highest administration level. This is a critical severity vulnerability affecting user...

Input validation

Dell SmartFabric Storage Software version 1.3 and lower contain an improper input validation vulnerability. A remote unauthenticated attacker may exploit this vulnerability and escalate privileges up to the highest administration level. This is a critical severity vulnerability affecting user...

CVE-2023-32485

Dell SmartFabric Storage Software version 1.3 and lower contain an improper input validation vulnerability. A remote unauthenticated attacker may exploit this vulnerability and escalate privileges up to the highest administration level. This is a critical severity vulnerability affecting user...

U.S. Dept Of Defense: User automatically logged in as Sys Admin user on https://███/Administration/Administration.aspx

A vulnerability was discovered where any user could be automatically logged in as a system administrator on a web application. This allowed unrestricted access and privileges could be abused to modify user privileges, add or delete users, and upload files, jeopardizing the integrity of the...

CVE-2023-43644

CVE-2023-43644 affects sing-box and enables an authentication bypass for all SOCKS5 inbounds with user authentication via specially crafted requests. The impact is an authentication bypass with potential high-severity consequences. Affected versions require updating to sing-box 1.4.4 or 1.5.0-rc....

CVE-2023-42456 sudo-rs Session File Relative Path Traversal vulnerability

Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout has passed will the user have to...