3193 matches found
kubernetes-client: Insecure deserialization in unmarshalYaml method
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML...
PT-2023-23401 · Zammad · Zammad
Name of the Vulnerable Software and Affected Versions: Zammad version 5.4.0 Description: An issue in the software allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user. Attackers are also able to gain unauthorized access to existin...
cnoa OA 安全漏洞
cona cnoa OA is a collaborative office software from Hipzl cona. A security vulnerability exists in cnoa OA prior to version 5.1.1.5, which originates from the presence of an unknown function in /index.php?app=main&func=passport&action=loginf in the Telnet service component, resulting in the use ...
CVE-2022-44610
Improper authentication in the IntelR DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via network access...
CVE-2022-41998
Uncontrolled search path in the IntelR DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via local access...
Western Digital My Cloud 操作系统命令注入漏洞
Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud OS 5 prior to version 5.26.119, which stems from an operating system command injection vulnerability that can be exploited by an attacker to remotely execu...
Intel Pathfinder 代码问题漏洞
Intel Pathfinder is an exploration program of Intel Corporation USA. A security vulnerability exists in Intel Pathfinder for RISC-V. An attacker can escalate privileges by exploiting the vulnerability...
Intel Data Center Manager 安全漏洞
Intel Data Center Manager is a software solution from Intel Corporation. It collects and analyzes real-time operating conditions, power and heat of various devices in the data center to help improve efficiency and uptime. A security vulnerability exists in Intel Data Center Manager versions prior...
Western Digital My Cloud OS 代码问题漏洞
Western Digital My Cloud is a personal cloud storage device from Western Digital. A code issue vulnerability exists in Western Digital My Cloud OS 5 prior to version 5.26.202, which stems from the presence of a server-side request forgery SSRF vulnerability...
Node.js: Regular Expression Denial of Service in Headers fetch API
Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set and Headers.append methods are vulnerable to Regular Expression Denial of Service ReDoS attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normali...
WordPress plugin Hide My WP Ghost 数据伪造问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
MingSoft MCMS 代码问题漏洞
MingSoft MCMS is a complete open-source J2ee system from China's MingSoft. A security vulnerability exists in MCMS version 5.0, which stems from a file upload vulnerability that allows an attacker to execute arbitrary code via a created thumbnail image...
PT-2023-22497 · S Cms · S-Cms
Name of the Vulnerable Software and Affected Versions: S-CMS version 5.0 Description: The issue is related to an authenticated remote code execution RCE vulnerability. It can be exploited via the /admin/ajax.php API endpoint. Recommendations: For S-CMS version 5.0, consider disabling access to th...
PT-2023-16812 · WordPress · Advanced Custom Fields Pro
Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields ACF Free and Pro WordPress plugins versions 5.x through 5.12.4 Advanced Custom Fields ACF Free and Pro WordPress plugins versions 6.x through 6.0.x Description: The issue allows users with a role of Contributor and abov...
PT-2023-22455 · Zammad · Zammad
Name of the Vulnerable Software and Affected Versions: Zammad versions 5.3.x through 5.3.x Description: The issue allows an authenticated attacker to gain information about linked accounts of users involved in their tickets using the Zammad API. This is due to Incorrect Access Control...
GHSA-H2PM-378C-PCXX Path traversal vulnerability in gatsby-plugin-sharp
Impact The gatsby-plugin-sharp plugin prior to versions 5.8.1 and 4.25.1 contains a path traversal vulnerability exposed when running the Gatsby develop server gatsby develop. The following steps can be used to reproduce the vulnerability: Create a new Gatsby project, and install...
CVE-2023-1282
The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations WordPress plugin before 5.0.6.4 do not sanitise and escape a parameter before outputting it back in the...
CVE-2023-27733
DedeCMS v5.7.106 was discovered to contain a SQL injection vulnerability via the component /dede/syssqlquery.php...
strongSwan 信任管理问题漏洞
strongSwan is a Swiss Andreas Steffen personal developer of a Linux platform to use the open source IPsec-based VPN solution. The solution includes authentication mechanisms such as X.509 public key certificates, securely stored private keys, and smart cards. A security vulnerability exists in...