CVE-2023-45825 Token in custom credentials object can leak through logs in ydb-go-sdk

ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object implementation of interface Credentials it may leak into logs. This happens because this object could be serialized into an error message using...

NETIS SYSTEMS N3 Operating System Command Injection Vulnerability

NETIS SYSTEMS N3 is a router from NETIS SYSTEMS. An operating system command injection vulnerability exists in the Netis N3Mv2-V.1.0.1.865 version, which stems from a command injection vulnerability in the Hostname parameter...

Acronis Cyber Protect Security Vulnerability

Acronis Cyber Protect is an all-in-one cyber protection solution for business and enterprise from Acronis Singapore. It combines backup, anti-malware, cybersecurity and endpoint management features such as vulnerability assessment, URL filtering, patch management, and more. A security vulnerabili...

Acronis Cyber Protect Security Vulnerability

Acronis Cyber Protect is an all-in-one cyber protection solution for business and enterprise from Acronis Singapore. It combines backup, anti-malware, cybersecurity and endpoint management features such as vulnerability assessment, URL filtering, patch management, and more. A security vulnerabili...

Take-Note App Cross-Site Request Forgery Vulnerability

Take-Note App is a note-taking application by the individual developer Remy Andrade. A cross-site request forgery vulnerability exists in Take-Note App version 1.0. An attacker can exploit this vulnerability to perform cross-site request forgery attacks...

MystenLabs Sui Buffer Error Vulnerability

Mysten Labs Sui is a smart contract platform from Mysten Labs Labs. A security vulnerability exists in Mysten Labs Sui v1.2.0, which stems from a stack overflow in component /spec/openrpc.json...

WordPress User Private Files Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

Software User Private Files Type Plugin Vulnerable versions = 2.0.3 Fixed in 2.0.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4636 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a3eddd47293a Credits Shuning Xu Required...

TechView LA-5570 安全漏洞

The TechView LA-5570 is a wireless router. A security vulnerability exists in the TechView LA-5570 version 1.0.19T53,which originates from a vulnerability that allows an attacker to gain escalated privileges via the UART interface...

WordPress plugin eBecas 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2021-40265

A heap overflow bug exists FreeImage before 1.18.0 via ofLoad function in PluginJPEG.cpp...

Cockpit 跨站脚本漏洞

Cockpit is an interactive server management interface. A cross-site scripting vulnerability exists in cockpit versions prior to 2.6.4. An attacker could exploit this vulnerability to perform cross-site scripting attacks...

Apple macOS Ventura Security Vulnerability

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Ventura version 13.3, which stems from the handling of maliciously crafted AppleScript binaries may result in unexpected application termination or process memory...

MIT Kerberos Buffer Error Vulnerability

MIT Kerberos is a Massachusetts Institute of Technology MIT software for authentication in network clusters.Kerberos also serves as a network authentication protocol designed to provide strong authentication services to client/server applications through a key system. A security vulnerability...

Bug Finder MineStack 跨站脚本漏洞

Bug Finder MineStack is a digital mining platform from Bug Finder, Inc. A cross-site scripting vulnerability exists in Bug Finder MineStack version 1.0, which stems from some unknown processing in the file /user/ticket/create in the component Ticket Handler, leading to cross-site scripting via th...

Marui Official 安全漏洞

Marui Official is an application from Marui Inc. A security vulnerability exists in Marui Official version v.13.6.1, which originates from a vulnerability that allows remote attackers to gain access to sensitive information via a channel access token in the miniapp Marui Official store...

FeiFeiCms 跨站请求伪造漏洞

FeiFeiCms FeiFei Movie & TV Navigation System is a PHP-based movie & TV content management system CMS. A security vulnerability exists in FeiFeiCMS v4.1.190209. An attacker can exploit this vulnerability to create an administrator account via /index.php?s=Admin-Admin-Insert...

CVE-2023-35167 When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id

Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the @Entity decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the id of an entity instance is not authorized to access, can gain...

Globalscape Enhanced File Transfer 缓冲区错误漏洞

Globalscape Enhanced File Transfer Globalscape EFT is a best-in-class Managed File Transfer MFT solution from Globalscape USA. A security vulnerability exists in Globalscape Enhanced File Transfer versions prior to 8.1.0.16 that stems from an out-of-bounds memory read issue that could cause the...

.NET Core Multiple Vulnerabilities - Windows

.NET Core is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:microsoft:asp.netcore";...

PT-2023-11868 · WordPress · The Ultimate Reviews

Name of the Vulnerable Software and Affected Versions: The Ultimate Reviews plugin for WordPress versions up to and including 2.1.32 Description: The issue allows unauthenticated attackers to inject a PHP Object via deserialization of untrusted input in several vulnerable functions, as no POP cha...