CVE-2023-45585

An insertion of sensitive information into log file vulnerability CWE-532 in FortiSIEM version 7.0.0, version 6.7.6 and below, version 6.6.3 and below, version 6.5.1 and below, version 6.4.2 and below, version 6.3.3 and below, version 6.2.1 and below, version 6.1.2 and below, version 5.4.0, versi...

CVE-2023-45585

An insertion of sensitive information into log file vulnerability CWE-532 in FortiSIEM version 7.0.0, version 6.7.6 and below, version 6.6.3 and below, version 6.5.1 and below, version 6.4.2 and below, version 6.3.3 and below, version 6.2.1 and below, version 6.1.2 and below, version 5.4.0, versi...

IBM Sterling Partner Engagement Manager 访问控制错误漏洞

IBM Sterling Partner Engagement Manager is an automated management tool from International Business Machines IBM. An authentication error vulnerability exists in IBM Sterling Partner Engagement Manager versions 6.1.2, 6.2.0, and 6.2.2, which stems from the program improperly authenticating a remo...

WordPress Highcompress Image Compressor Plugin <= 6.1.2 is vulnerable to Broken Access Control

Software Highcompress Image Compressor Type Plugin Vulnerable versions = 6.1.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-40209 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 99c36206c314 Credits Abdi Pranat...

PT-2023-26031 · Apache · Apache Roller

Name of the Vulnerable Software and Affected Versions: Apache Roller versions prior to 6.1.2 Description: Insufficient input validation and sanitation in Weblog Category name, Website About, and File Upload features allows an authenticated user to perform an XSS attack. Recommendations: If you do...

CVE-2023-37415 Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the proxyuser option can also inject semicolon. This issue affects Apache Airflow Apache Hive Provider: before 6.1.2. It is recommended updatin...

Apache Struts Security Update (S2-064)

Apache Struts is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:struts";...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to clickjacking (CVE-2023-23482)

Summary IBM Sterling Partner Engagement Manager has addressed a vulnerability of missing X-Frame-Options Header which leads to Clickjacking. Vulnerability Details CVEID:CVE-2023-23482 DESCRIPTION: IBM Sterling Partner Engagement Manager could allow a remote attacker to hijack the clicking action ...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to cross-site scripting (CVE-2023-23481)

Summary IBM Sterling Partner Engagement Manager has addressed a stored cross-site scripting vulnerability. Vulnerability Details CVEID:CVE-2023-23481 DESCRIPTION: IBM Sterling Partner Engagement Manager is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitra...

Linux kernel 代码问题漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in versions of Linux kernel prior to 6.1.2, which stems from an incorrect pointer...

CVE-2023-22997

In the Linux kernel before 6.1.2, kernel/module/decompress.c misinterprets the modulegetnextpage return value expects it to be NULL in the error case, whereas it is actually an error pointer...

SUSE CVE-2020-2678

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 5.2.36, prior to 6.0.16 and prior to 6.1.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle...

SUSE CVE-2020-2725

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 5.2.36, prior to 6.0.16 and prior to 6.1.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle V...

PT-2023-34950 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: openvswitch versions prior to v6.1.11 Description: A memory leak issue exists in the ovs flow cmd new function. The actual impact and attack plausibility have not yet been proven. This issue was introduced in Linux Kernel version v6.1.2 and i...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to remote code execution due to Apache Commons Text [CVE-2022-42889]

Summary IBM Sterling Partner Engagement Manager has addressed a Publicly disclosed vulnerability that are published by Apache Commons - Collections v3.2.1 CVE-2022-42889 Vulnerability Details CVEID:CVE-2022-42889 DESCRIPTION: Apache Commons Text could allow a remote attacker to execute arbitrary...

PT-2022-26123 · Arches · Arches

Name of the Vulnerable Software and Affected Versions: Arches versions prior to 6.1.2 Arches versions prior to 6.2.1 Arches versions prior to 7.1.2 Description: The issue allows an attacker to execute unwanted SQL statements against the database with a carefully crafted web request. Users are...

PT-2022-15390 · Ibm · Ibm Sterling Partner Engagement Manager

Name of the Vulnerable Software and Affected Versions: IBM Sterling Partner Engagement Manager versions 6.1.2, 6.2, and Cloud/SasS 22.2 Description: The issue allows a remote authenticated attacker to conduct an LDAP injection by using a specially crafted request. This could result in granting...

CVE-2022-22416

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force...

GRAND FlaGallery <= 6.1.2 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its gallery settings, which could allow high privilege users to perform Cross-Site scripting attacks even when the unfilteredhtml capability is disallowed. Create/edit a gallery and put the following payload in the "Back Button Text" setting, then...

Code Injection and Directory Traversal in plexus-utils

This vulnerability allows unauthenticated remote attackers to inject code and XML as well as perform directory traversal via CVE-2017-1000487 - command injection sonatype-2016-0398 - directory traversal sonatype-2015-0173 - XML Injection The affected versions are before version 7.2.2, and before...