8619 matches found
CVE-2023-30633: Undefined Security Weakness
An issue was discovered in TrEEConfigDriver in Insyde InsydeH2O with kernel 5.0 through 5.5. It can report false TPM PCR values, and thus mask malware activity. Devices use Platform Configuration Registers PCRs to record information about device and software configuration to ensure that the boot...
CVE-2023-30633
An issue was discovered in TrEEConfigDriver in Insyde InsydeH2O with kernel 5.0 through 5.5. It can report false TPM PCR values, and thus mask malware activity. Devices use Platform Configuration Registers PCRs to record information about device and software configuration to ensure that the boot...
CVE-2023-45604
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Scott Reilly Get Custom Field Values plugin = 4.0.1 versions...
CVE-2023-45604
CVE-2023-45604 affects WordPress users running the Scott Reilly Get Custom Field Values plugin, version
CVE-2023-45604 WordPress Get Custom Field Values Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Scott Reilly Get Custom Field Values plugin = 4.0.1 versions...
CVE-2023-45604: Improper Neutralization of Input During Web Page Generation
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Scott Reilly Get Custom Field Values plugin = 4.0.1 versions...
GHSA-94W9-97P3-P368 CSRF Token Reuse Vulnerability
A Cross-Site Request Forgery CSRF vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to inject arbitrary values without any authentication, or perform...
CSRF Token Reuse Vulnerability
A Cross-Site Request Forgery CSRF vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to inject arbitrary values without any authentication, or perform...
CVE-2023-45128 CSRF Token Reuse Vulnerability in fiber
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery CSRF vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to injec...
Webauthn-Framework Authorization Issues Vulnerability
Webauthn-Framework is an authentication mechanism. It is used by Web applications to create and use strong, proven, scoped, public-key based credentials for strong authentication of users. An authorization issue vulnerability exists in Webauthn-Framework that stems from improper handling of...
PT-2023-29427
Name of the Vulnerable Software and Affected Versions Fiber versions prior to 2.50.0 Description A Cross-Site Request Forgery CSRF vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This...
UBUNTU-CVE-2023-45142
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...
PT-2023-27874 · Plixer · Plixer Scrutinizer
Name of the Vulnerable Software and Affected Versions: Plixer Scrutinizer versions prior to 19.3.1 Description: An issue was discovered in the /fcgi/scrut fcgi.fcgi endpoint. The csvExportReport endpoint action generateCSV does not require authentication, allowing an unauthenticated user to expor...
WordPress Get Custom Field Values Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)
Software Get Custom Field Values Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-45604 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 8b0df9061359 Credits Satoo Nakano Required privilege...
CVE-2020-27631: Use of Insufficiently Random Values
In Oryx CycloneTCP 1.9.6, TCP ISNs are improperly random...
CVE-2020-27630: Use of Insufficiently Random Values
In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random...
PT-2023-6411
Name of the Vulnerable Software and Affected Versions InsydeH2O versions 5.0 through 5.5 Description The issue is related to errors in security settings of the TrEEConfigDriver in the InsydeH2O framework for creating UEFI firmware. Exploitation of this issue can allow an attacker to hide maliciou...
CVE-2020-27636: Use of Insufficiently Random Values
In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random...
CVE-2020-27213: Use of Insufficiently Random Values
An issue was discovered in Ethernut Nut/OS 5.1. The code that generates Initial Sequence Numbers ISNs for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existin...