CVE-2023-49131

A vulnerability has been identified in Solid Edge SE2023 All versions V223.0 Update 10. The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current...

IBM Storage Fusion Security Vulnerability

IBM Storage Fusion is a fully integrated platform from International Business Machines IBM for running and maintaining all native Red Hat OpenShift applications. A security vulnerability exists in IBM Storage Fusion HCI versions 2.1.0 through 2.6.1, which stems from the system containing hard-cod...

Apache InLong 代码注入漏洞

Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. Provides automated, secure and reliable data transfer capabilities. A code injection vulnerability exists in Apache InLong versions 1.5.0 through 1.9.0, which stems from the presence of a code...

CVE-2023-44088

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects Pandora FMS: from 700 through 774...

CVE-2023-7102

Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic...

PT-2023-32828 · WordPress +1 · Backup Migration +1

Name of the Vulnerable Software and Affected Versions: Backup Migration plugin for WordPress versions 1.0.8 through 1.3.9 Description: The issue allows unauthenticated attackers to include remote files on the server, resulting in code execution, via the content-dir HTTP header. Successful...

CVE-2023-47093

An issue was discovered in Stormshield Network Security SNS 4.0.0 through 4.3.21, 4.4.0 through 4.6.8, and 4.7.0. Sending a crafted ICMP packet may lead to a crash of the ASQ engine...

PT-2023-30705 · Smartertools · Smartermail

Name of the Vulnerable Software and Affected Versions: SmarterTools SmarterMail versions 8495 through 8664 Description: The issue allows stored XSS via a crafted description of a Calendar appointment. Recommendations: For versions 8495 through 8664, update to version 8747 or later to resolve the...

SmarterTools SmarterMail Security Breach

SmarterTools SmarterMail is a set of mail server software from SmarterTools. The software supports spam filtering, statistics, Simple Mail Transfer Protocol SMTP authentication, and other features. A security vulnerability exists in SmarterTools SmarterMail versions 8495 through 8664, which stems...

CVE-2023-49148

Cross-Site Request Forgery CSRF vulnerability in Kulwant Nagi Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates.This issue affects Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates: from n/a through 3.0.5...

CVE-2023-48050

SQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance aka odoo-biometric-attendance v. 13.0 through 16.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the db parameter in the controllers/controllers.py...

ZKTeco ZKBio Time Security Vulnerability

ZKTeco ZKBio Time is a powerful web-based time and attendance management software from China-based ZKTeco. Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance A security vulnerability exists in versions 13.0 through 16.0.1, which stems from an SQL injection...

CVE-2023-45184

IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority checks. IBM X-Force ID: 268270...

PT-2023-29889 · Ibm · Ibm Sterling Secure Proxy

Name of the Vulnerable Software and Affected Versions: IBM Sterling Secure Proxy versions 6.0.3 through 6.1.0 Description: This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trust...

PT-2023-8845 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions 10.0.0 through 10.0.10 Description: The issue is related to the saved search feature in GLPI, which can be used to perform a SQL injection. This allows a remote attacker to execute arbitrary code. The vulnerability is due to the...

Checkmk Security Vulnerabilities

Checkmk is an editor. A security vulnerability exists in Checkmk versions 2.2.0p10 through 2.2.0p16, which stems from the use of user-controlled LDLIBRARYPATH in an agent, allowing an attacker to escalate privileges by injecting a malicious library...

Dasan W-Web OS Command Injection Vulnerability

Dasan W-Web is a network appliance from Dasan. An operating system command injection vulnerability exists in Dasan W-Web versions 1.22-1.27, which stems from the presence of an operating system command injection vulnerability...

GNU Tar Security Vulnerability

GNU Tar is a set of tools for creating tar-formatted files from the US GNU community. A security vulnerability exists in GNU Tar versions 1.0 through 1.34, which stems from improper handling of extended attributes in the PAX archive, allowing remote attackers to execute arbitrary code on the targ...

Infinite decoding loop through specially crafted payload

The Candid library causes a Denial of Service while parsing a specially crafted payload with empty data type. For example, if the payload is record ; empty and the canister interface expects record then the rust candid decoder treats empty as an extra field required by the type. The problem with...

CloudPanel Security Vulnerabilities

CloudPanel is a free software from CloudPanel open source. It is used to configure and manage servers. A security vulnerability exists in MGT CloudPanel versions 2.0.0 through 2.3.2, which stems from a vulnerability that allows a low-privileged user to achieve operating system command injection b...