gst-plugins-bad security vulnerability

gst-plugins-bad is an open source GStreamer plugin for GStreamer. A security vulnerability exists in versions prior to gst-plugins-bad 1.22.6, which stems from the presence of an integer overflow vulnerability...

Synology Camera Firmware Formatting String Error Vulnerability

Synology Camera Firmware is a webcam firmware from China-based Synology Inc. A formatting string error vulnerability exists in Synology Camera Firmware versions prior to 1.0.5-0185, which stems from a formatting string error vulnerability in the cgi component that allows attackers to execute...

Pip Command Injection Vulnerability

Pip is a set of tools for installing and managing Python packages. A security vulnerability exists in pip versions prior to v23.3, which stems from the presence of an injected arbitrary configuration option call...

Zscaler Client Connector Path Traversal Vulnerability

Zscaler Client Connector is an application for zscaler. An application installed on a device that ensures that Internet traffic and access to an organization's internal applications is secure and complies with the organization's policies, even when not on the corporate network. ecto is a toolkit...

Knot Resolver Security Vulnerability

Knot Resolver is a cached DNS resolver implementation that includes a resolver library and daemon. A security vulnerability exists in Knot Resolver prior to version 5.7.0, which stems from performing many TCP reconnections upon receiving certain meaningless responses from the server...

PT-2023-29956 · Unknown · Sd-Webui-Infinite-Image-Browsing

Name of the Vulnerable Software and Affected Versions: sd-webui-infinite-image-browsing extension versions before 977815a Description: The issue allows remote attackers to read any local file via the "/file?path=" endpoint in the URL, as demonstrated by reading /proc/self/environ to discover...

CVE-2023-31046

A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an authenticated attacker to achieve read-only access to the server's filesystem, because requests beginning with "GET /ui/static/..//.." reach...

CVE-2023-31046

A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an authenticated attacker to achieve read-only access to the server's filesystem, because requests beginning with "GET /ui/static/..//.." reach...

CVE-2023-5087

The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code...

CVE-2023-4800

The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users...

CVE-2023-36954

TOTOLINK CP300+ V5.2cu.7594B20200910 and before is vulnerable to command injection...

WordPress plugin Pagelayer cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

GHSA-GWVM-45GX-3CF8 Authorization Header forwarded on redirect

urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this...

Adobe Commerce Input Validation Error Vulnerability

Adobe Commerce is a leading global digital commerce solution for merchants and brands from Adobe. An input validation error vulnerability exists in Adobe Commerce prior to version 2.4.7, which stems from being affected by an incorrect input validation vulnerability that could allow an attacker...

SUSE CVE-2023-5478

Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

AZL-31300 CVE-2023-44487 affecting package containerized-data-importer for versions less than 1.55.0-15

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

CVE-2023-45354

Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated remote attacker to execute arbitrary code on the operating system by using the Common Management Portal web interface. This is also known as OCMP-6589...

PT-2023-29233 · Unknown · Uptime Kuma

Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.23.3 Description: The issue allows attackers with access to a user's device to gain persistent account access due to missing verification of Session Tokens after password changes and/or elapsed inactivity...

Nexkey Authorization Issues Vulnerability

Nexkey is an open source, decentralized social media platform for nexryai individual developers. An authorization issue vulnerability exists in Nexkey versions prior to 12.121.9 that stems from allowing an attacker to bypass authentication to access the job queue dashboard...

mosparo Input Validation Error Vulnerability

mosparo is modern spam protection. An input validation error vulnerability exists in mosparo versions prior to 1.0.2, which stems from an open redirection issue...