CVE-2023-47392

An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the carts of other users via sending a crafted add order request...

CVE-2023-43961

An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass...

Piwigo Cross-Site Scripting Vulnerability

Piwigo is a Web-based open source photo gallery software. The software includes features such as image management, image categorization and permission management. A cross-site scripting vulnerability exists in Piwigo versions prior to 4.0.0beta4, which stems from a security issue in the...

PYSEC-2023-179

This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke and pydash.collections.invokemap accept dotted paths Deep Path Strings to target a nested Python object, relative to the original source object. These paths can be used to target...

phonenumber Security Vulnerabilities

phonenumber is a Whisperfish open source library for parsing, formatting and validating international phone numbers. A security vulnerability exists in phonenumber versions prior to 0.3.3, which stems from an out-of-bounds access to the emergency protection on the phone numbers string, which may...

AZL-28656 CVE-2023-41910 affecting package lldpd for versions less than 1.0.14-3

An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDPTLVADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdpdecode in daemon/protocols/cdp.c...

Stormshield SSL VPN Client 加密问题漏洞

Stormshield SSL VPN Client is a VPN client from Stormshield. A security vulnerability exists in Stormshield SSL VPN Client versions prior to 3.2.0 that stems from allowing an attacker enough access to other encrypted address books...

AZL-27764 CVE-2023-3812 affecting package kernel for versions less than 5.15.126.1-1

An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious too big networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system...

SUSE CVE-2023-38633

A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files on the local filesystem outside of the expected area, as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element...

Responsive Filemanager 代码问题漏洞

Responsive FileManager is a free open source file manager from the individual developer Alberto Peripolli. A security vulnerability exists in Responsive Filemanager versions prior to 9.12.0 that originated from a vulnerability that allows an attacker to bypass upload restrictions, which could lea...

PT-2023-3436 · Sealos · Sealos

Name of the Vulnerable Software and Affected Versions: Sealos versions prior to 4.2.1-rc4 Description: The issue is related to an improper configuration of role-based access control RBAC permissions in Sealos, an open-source cloud operating system distribution based on the Kubernetes kernel. This...

CVE-2023-2703

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Finex Media Competition Management System allows Retrieve Embedded Sensitive Data, Collect Data as Provided by Users. This issue affects Competition Management System: before 23.07...

PT-2023-23351 · Gl.Inet · Gl.Inet

Name of the Vulnerable Software and Affected Versions: GL.iNet devices versions prior to 3.216 Description: An issue was discovered that allows for arbitrary file write, enabling the creation of an empty file anywhere on the filesystem. This is caused by a command injection vulnerability with a...

WordPress plugin AI ChatBot 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-17125 · WordPress · Custom Post Type Ui

Name of the Vulnerable Software and Affected Versions: Custom Post Type UI WordPress plugin versions prior to 1.13.5 Description: The issue arises from the plugin's failure to properly check for CSRF when sending debug information to a user-supplied email. This could allow attackers to make a...

CVE-2023-22309

Reflective Cross-Site-Scripting in Webconf in Tribe29 Checkmk Appliance before 1.6.4...

Gogs 操作系统命令注入漏洞

Gogs Go Git Service is a Go-based self-service Git hosting service from the GOGS team that supports creating and migrating public/private repositories, adding and removing repository collaborators, and more. An operating system command injection vulnerability exists in Gogs versions prior to...

PT-2023-20167 · Apollo · Apollo

Name of the Vulnerable Software and Affected Versions: Apollo versions prior to 2.1.0 Description: A low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmatio...

SUSE CVE-2014-3597

Multiple buffer overflows in the phpparserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service application crash or possibly execute arbitrary code via a crafted DNS record, related to the dnsgetrecord function and the...

SUSE CVE-2017-8313

Heap out-of-bound read in ParseJSS in VideoLAN VLC before 2.2.5 due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process via a crafted subtitles file...