PT-2023-27355 · Zola · Zola

Name of the Vulnerable Software and Affected Versions: zola versions 0.13.0 through 0.17.2 Description: An issue was discovered in the custom implementation of a web server, available via the "zola serve" command, which allows directory traversal. The handle request function, used by the server t...

Nextcloud user_oidc security vulnerability

Nextcloud useroidc is an application from Nextcloud, Germany. A security vulnerability exists in Nextcloud useroidc version 1.0.0 through versions prior to 1.3.3, which stems from a lack of validation of the issuer...

CVE-2023-38208 Validate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Adobe Commerce versions 2.4.6-p1 and earlier, 2.4.5-p3 and earlier and 2.4.4-p4 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated...

PT-2023-5266 · Libreswan +5 · Libreswan +5

Name of the Vulnerable Software and Affected Versions: Libreswan versions 3.20 through 4.12 Description: An issue was discovered in Libreswan when an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1. This causes an error notify INVALID SPI to be sent back, but th...

CVE-2023-39075

Renault Zoe EV 2021 automotive infotainment system versions 283C35202R to 283C35519R builds 11.10.2021 to 16.01.2023 allows attackers to crash the infotainment system by sending arbitrary USB data via a USB device...

CVE-2023-0632

An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted payloads to search Harbor Registry...

CVE-2023-33742

TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Cleartext Storage of Sensitive Information: RSA private key in Update.exe...

Tolgee 安全漏洞

Tolgee is an open source multilingual translation and localization platform designed to help development teams easily manage and maintain multilingual software applications and websites. A security vulnerability exists in Tolgee versions 3.14.0 through 3.23.1 that stems from the fact that when a...

PT-2023-14301 · Gx · Xperiencentral

Name of the Vulnerable Software and Affected Versions: GX Software XperienCentral versions 10.33.1 through 10.35.0 Description: The issue concerns invalid data input due to bypassed form validation in Interactive Forms IAF. Recommendations: For GX Software XperienCentral versions 10.33.1 through...

GX Software XperienCentral 输入验证错误漏洞

GX Software XperienCentral is a CMS from GX Software. A security vulnerability exists in GX Software XperienCentral versions 10.33.1 through 10.35.0, which stems from an easy bypass of the validation of Interactive Forms IAF...

PT-2023-16958 · Gitlab · Gitlab Dast Api Scanner +1

Name of the Vulnerable Software and Affected Versions: GitLab DAST scanner versions 3.0.29 through 4.0.5 Description: An issue has been discovered in the GitLab DAST scanner where it leaks cross-site cookies on redirect during authorization. Recommendations: For versions 3.0.29 through 4.0.5,...

PT-2023-25931 · Redcap · Redcap

Name of the Vulnerable Software and Affected Versions: REDCap versions 12.0.26 through 12.3.2 Description: The issue allows SQL Injection via parameters such as scheduling, repeatforms, purpose, app title, or randomization. Recommendations: For versions 12.0.26 and 12.3.2, consider restricting...

Apache InLong SQL注入漏洞

Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. It provides automated, secure and reliable data transfer capabilities. A SQL injection vulnerability exists in Apache InLong versions 1.4.0 through 1.7.0, which stems from vulnerability to SQL...

Apache InLong 代码问题漏洞

Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. Provides automated, secure and reliable data transfer capabilities. A deserialization vulnerability exists in Apache InLong versions 1.4.0 to 1.7.0. The vulnerability stems from insecure...

NodeBB 路径遍历漏洞

NodeBB is a forum system built using Node.js a web application platform built on top of Google's V8 JavaScript engine by the Design Create Play team. A path traversal vulnerability exists in NodeBB versions 2.5.0 to 2.8.7, which is caused by the use of object deconstruction assignment syntax in t...

Gallagher Command Centre Server 缓冲区错误漏洞

Gallagher Command Center Server is a management system used by Gallagher New Zealand to monitor and manage infrastructure in buildings. A security vulnerability exists in Gallagher Command Centre Server versions 8.80 through 8.80.1192 MR2, which stems from a stack-based buffer overflow that allow...

PT-2023-25026 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 12.8 through 15.11.10 GitLab EE versions 16.0 through 16.0.6 GitLab EE versions 16.1 through 16.1.1 Description: An issue has been discovered in GitLab EE, allowing an attacker to change the name or path of a public top-lev...

Galaxy Software Services Vitals ESP 信任管理问题漏洞

Galaxy Software Services Vitals ESP is a knowledge management system for office use by Galaxy Software Services China. A trust management issue vulnerability exists in Vitals ESP versions 3.0.8 through 6.2.0, which arises from the use of a hard-coded encryption key that can be exploited by an...

HashiCorp Nomad 安全漏洞

HashiCorp Nomad is a simple and flexible scheduler and orchestrator from HashiCorp USA. for managing containerized and non-containerized applications at scale, both locally and in the cloud. A security vulnerability exists in HashiCorp Nomad and Nomad Enterpris that stems from an HTTP search API...

IBM Spectrum Protect 输入验证错误漏洞

IBM Spectrum Protect formerly known as Tivoli Storage Manager is a suite of data protection platforms from International Business Machines IBM. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud...