Smart Office Web 20.28 Information Disclosure / Insecure Direct Object Reference

Exploit Title: Smart Office Web 20.28 - Remote Information Disclosure Unauthenticated Shodan Dork:: inurl:"https://www.shodan.io/search?query=smart+office" Date: 09/Dec/2022 Exploit Author: Tejas Nitin Pingulkar https://cvewalkthrough.com/ Vendor Homepage: https://smartofficepayroll.com/ Software...

PT-2023-4527 · Node.Js +10 · Node.Js +10

Name of the Vulnerable Software and Affected Versions: Node.js affected versions not specified Description: The generateKeys API function returned from crypto.createDiffieHellman only generates missing or outdated keys, that is, it only generates a private key if none has been set yet, but the...

CVE-2022-48497

Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability...

PT-2023-3786 · Trend Micro · Trend Micro Apex Central

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central affected versions not specified Description: The issue exists due to a lack of protection for the web page structure, allowing for potential cross-site scripting XSS attacks. This could enable a remote attacker to...

PT-2023-35800 · Git +1 · Clamav

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ. The crash state involves several functions: cli html normalise, html normalise map, and cli scanhtm...

PT-2023-2666 · Oracle · Oracle Sql Developer

Name of the Vulnerable Software and Affected Versions: Oracle SQL Developer versions prior to 23.1.0 Description: The issue is related to insufficient input validation in the Installation component of Oracle SQL Developer, allowing a high-privileged attacker with logon to the infrastructure where...

Juniper Networks Junos OS Evolved 授权问题漏洞

Juniper Networks Junos OS Evolved is an upgraded version of Juniper Networks' Junos OS. Juniper Networks Junos OS Evolved suffers from an authorization issue vulnerability that arises from improper authorization in the "sysmanctl" shell command, which could be exploited by an attacker to execute...

QNAP Systems QTS 和 QuTS hero 命令注入漏洞

QNAP Systems QTS is an operating system for use with entry to mid-level QNAP NAS from China's Weilian Technology QNAP Systems. A command injection vulnerability exists in QNAP Systems QTS and QuTS hero, which can be exploited to allow an authenticated remote user to execute arbitrary commands fro...

PT-2023-15728 · Unknown · Secure Os Module

Name of the Vulnerable Software and Affected Versions: Secure OS module affected versions not specified Description: The issue is related to configuration defects in the secure OS module. It may impact availability if successfully exploited. Recommendations: At the moment, there is no information...

PT-2023-21056 · Git +1 · Opencats

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit malicious...

PT-2023-12067 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about a specific vulnerability. It appears to be a notification about a rejected candidate...

SUSE CVE-2016-1251

There is a vulnerability of type use-after-free affecting DBD::mysql aka DBD-mysql or the Database Interface DBI MySQL driver for Perl 3.x and 4.x before 4.041 when used with mysqlserverprepare=1...

PT-2023-6855 · Microsoft · Azure Machine Learning

Name of the Vulnerable Software and Affected Versions: Azure Machine Learning affected versions not specified Description: The issue is related to a lack of protection for service data in Azure Machine Learning, which can allow a remote attacker to gain unauthorized access to protected informatio...

PT-2023-8986 · Dell Emc · Dell Emc Networker

Name of the Vulnerable Software and Affected Versions: Dell EMC NetWorker affected versions not specified Description: The issue is related to an unauthenticated remote code execution vulnerability in the NetWorker Client execution service nsrexecd. This vulnerability may allow a remote attacker ...

PT-2023-15574 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The descriptions mention an issue but do not provide specific details about it, such as its nature, potential impact, or affected systems. They appear t...

PT-2023-35517 · Git +1 · Clamav

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type identified as Memcpy-param-overlap, according to an OSS-Fuzz report. The crash state includes repeat and p ere, but ...

PT-2022-14750 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: A missing permission check in the createDialog of WifiScanModeActivity.java allows a Guest user to enable location-sensitive settings. This could lead to local escalation of privilege from the Guest us...

CVE-2022-34313

IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can...

Borrower can put their address when submiting addCredit() which can make the lender not be able to withdraw tokens

Lines of code Vulnerability details Impact when calling addCredit by borrower, they can choose to put in their address as the lender instead of the actuall lender. this can bring problems later on when the lender is trying to withdraw funds from the contract. they wont be able to withdraw the fun...

PT-2022-21411 · Vcu · Vcu

Name of the Vulnerable Software and Affected Versions: vcu affected versions not specified Description: The issue is related to a possible memory corruption due to a race condition, which could lead to local escalation of privilege. System execution privileges are needed for exploitation, and use...