Deserialization Of Untrusted Data

Apache IoTDB is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to directly deserializing the key/values from the deviceOwnerFile within the deSerializeDeviceOwnerMap method. Each key/value from the owner file is parsed directly using the ObjectOutputStream class, withou...

Difference between normalvalue and thresholdvalue under SNMP configuration

This article explains the difference between thresholdValue and normalValue under SNMP configuration...

DRUPAL-CONTRIB-2023-055

This module allows you to turn various data sources Eg CSV or JSON file into interactive visualisation. The DVF module provides a field storage, widget & formatter that can be added to any entity. This module uses two third-party JS libraries having from low to medium vulnerabilities. One of the...

UBUNTU-CVE-2023-6918

A flaw was found in the libssh implements abstract layer for message digest MD operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the...

CVE-2023-6918 Libssh: missing checks for return values for digests

A flaw was found in the libssh implements abstract layer for message digest MD operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the...

CVE-2023-6355

CVE-2023-6355 affects Gallagher Controller 7000. The issue is an incorrect selection of fuse values in the Controller 7000 platform, which allows bypassing protection mechanisms to enable local debug. Affected versions are: 8.70 before 231204a, 8.80 before 231204a, 8.90 before 231204a, and 9.00 b...

PT-2023-32624 · Gallagher · Gallagher Controller 7000

Name of the Vulnerable Software and Affected Versions: Gallagher Controller 7000 versions 8.70 prior to vCR8.70.231204a Gallagher Controller 7000 versions 8.80 prior to vCR8.80.231204a Gallagher Controller 7000 versions 8.90 prior to vCR8.90.231204a Gallagher Controller 7000 versions 9.00 prior t...

PT-2023-31554 · Unknown · Activeadmin

Name of the Vulnerable Software and Affected Versions: ActiveAdmin versions prior to 2.12.0 Description: A concurrency issue in ActiveAdmin allows a malicious actor to access potentially private data belonging to another user by making CSV export requests at specific times. The issue is caused by...

USN-6488-2 strongswan vulnerability

USN-6488-1 fixed a vulnerability in strongSwan. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: Florian Picca discovered that strongSwan incorrectly handled certain DH public values. A remote attacker could use this issue to cau...

actionpack: Possible XSS via User Supplied Values to redirect_to

A Cross-site Scripting XSS vulnerability was found in Actionpack due to improper sanitization of user-supplied values. This allows provided values to contain characters that are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance o...

latestAnswer() may return stale values

Lines of code 121, 122, 123, 124, 51 Vulnerability details latestAnswer only returns the latest answer or zero, and thus there is no way to tell whether the value is stale or not. Use latestRoundData instead, and check whether the latest timestamp is within your protocol's limits. File:...

CVE-2023-50453

An issue was discovered in Zammad before 6.2.0. It uses the public endpoint /api/v1/signshow for its login screen. This endpoint returns internal configuration data of user object attributes, such as selectable values, which should not be visible to the public...

System Dashboard < 2.8.8 - Missing Authorization to Information Disclosure (sd_option_value)

Description The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sdoptionvalue function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with...

CVE-2023-48841

Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language Labels Export action...

CVE-2023-48841

Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language Labels Export action...

CVE-2023-48830

Shuttle Booking Software 2.0 is vulnerable to CSV Injection in the Languages section via an export...

CVE-2023-48830

Shuttle Booking Software 2.0 is vulnerable to CSV Injection in the Languages section via an export...

CVE-2023-48835

Car Rental Script v3.0 is vulnerable to CSV Injection via a Language Labels Export action...

CVE-2023-48207

Availability Booking Calendar 5.0 allows CSV injection via the unique ID field in the Reservations list component...

PT-2023-9049 · Oracle · Oracle Trade Management +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.13 Description: The issue is related to insufficient input validation in the Claim LOV component of Oracle Trade Management, allowing an unauthenticated attacker with network access via HTT...