JVN#37857022: Improper restriction of XML external entity references (XXE) in Applicant Programme

Applicant Programme provided by The Ministry of Justice improperly restricts XML external entity references XXE CWE-611. Impact By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker. Solution Update the Software Update the software to the latest...

Command injection

OS command injection vulnerability in the mail setting page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions prior to Ver.8.10 allows remote authenticated attackers to execute an arbitrary OS command...

CVE-2023-27518

CVE-2023-27518 — Summary for SolarView Compact Affected product: SolarView Compact SV-CPT-MC310 and SV-CPT-MC310F.Vulnerable components: multiple setting pages (buffer overflow) within the firmware.Root cause: buffer overflow in the affected pages.Impact: remote authenticated attacker could execu...

CVE-2023-1764

Canon IJ Network Tool v4.7.5 and earlier (OS X 10.9.5–macOS 13) and v4.7.3 and earlier (OS X 10.7.5–OS X 10.8) can disclose the printer’s Wi‑Fi connection settings through its communications. The Root Cause involves a cryptographic/communication issue in the tool, enabling an attacker to obtain s...

CVE-2023-1763

CVE-2023-1763 concerns Canon IJ Network Tool, affected versions 4.7.5 and earlier (OS X 10.9.5–macOS 13) and 4.7.3 and earlier (OS X 10.7.5–OS X 10.8), where the software can disclose sensitive information about the printer’s Wi‑Fi connection setup. The CVE’s sources consistently describe an info...

Default credentials

Use of weak credentials exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product...

Telindus Apsal 安全漏洞

Telindus Apsal is a software for simplified payroll calculation from Telindus Belgium. A security vulnerability exists in Telindus Apsal version 3.14.2022.235 b that stems from improper privilege management...

Google Chrome Security Update (stable-channel-update-for-desktop_14-2023-04) - Windows

Google Chrome is prone to type confusion vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome";...

CVE-2023-1985

A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. This issue affects the function savebrand of the file /classes/Master.php?f=savebrand. The manipulation of the argument name leads to sql injection. The attack may be initiate...

Path traversal

Path traversal vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to upload a specially crafted file to an arbitrary directory. As a result of exploiting this vulnerability with CVE-2023-22335 and CVE-2023-22344 vulnerabilitie...

CVE-2023-22336

Path traversal vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to upload a specially crafted file to an arbitrary directory. As a result of exploiting this vulnerability with CVE-2023-22335 and CVE-2023-22344 vulnerabilitie...

JTEKT ELECTRONICS Screen Creator Advance 资源管理错误漏洞

JTEKT ELECTRONICS Screen Creator Advance is a screen development tool from JTEKT ELECTRONICS. A security vulnerability exists in JTEKT ELECTRONICS Screen Creator Advance 2 Ver.0.1.1.4 Build01 and prior versions, which stems from a lack of error handling process even if an error is detected...

CVE-2023-22349

CVE-2023-22349 affects JTEKT ELECTRONICS Screen Creator Advance 2 (Ver.0.1.1.4 Build01 and earlier). The root cause is an out-of-bounds read when processing screen management information, allowing information disclosure and potentially arbitrary code execution if a crafted project file is opened....

CVE-2023-22373

Cross-site scripting vulnerability in CONPROSYS HMI System CHS Ver.3.4.5 and earlier allows a remote authenticated attacker to inject an arbitrary script and obtain the sensitive information...

CVE-2023-22279

MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allow a remote unauthenticated attacker to execute an arbitrary OS command...

CVE-2023-22278

Summary: CVE-2023-22278 reflects an improper authentication flaw in Digital Arts m-FILTER. The vulnerability allows a remote, unauthenticated attacker to bypass authentication and trigger sending of unintended emails when emails are being sent under certain conditions. Affected versions (per prov...

JVN#55675303: Digital Arts m-FILTER vulnerable to improper authentication

m-FILTER provided by Digital Arts Inc. is an emaill security product. m-FILTER contains an improper authentication vulnerability CWE-287 when emails are being sent under certain conditions, and unintended emails may be sent by a remote attacker. Digital Arts Inc. states that attacks exploiting th...

Google Chrome Security Update (stable-channel-update-for-desktop_27-2022-09) - Windows

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

JVN#44721267: Installer of Ricoh Device Software Manager may insecurely load Dynamic Link Libraries

Installer of Device Software Manager provided by RICOH COMPANY, LTD. contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the installer. Solution Use the lates...

Command injection

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via confmail.php...