4793 matches found
Fortinet FortiADC 操作系统命令注入漏洞
Fortinet FortiADC is an application delivery controller from Fortinet, Inc. A security vulnerability exists in the Fortinet FortiADC that stems from improper neutralization of the special elements used...
CVE-2023-2986
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated...
The configuration file authorize.conf of the Splunk Enterprise platform is vulnerable, allowing attackers to increase their privileges.
The vulnerability of the authorize.conf configuration file on the Splunk Enterprise operating system is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to increase their privileges by sending a specially crafted web request remotely...
Authentication flaw
Weak session management in DB Elettronica Telecomunicazioni SpA SFT DAB 600/C Firmware: 1.9.3 Bios firmware: 7.1 Apr 19 2021 Gui: 2.46 FPGA: 169.55 uc: 6.15 allows attackers on the same network to bypass authentication by re-using the IP address assigned to the device by the NAT protocol...
Shell component vulnerability: The Admin/InnoDB Cluster of the Oracle MySQL Server database management system, which allows attackers to gain full control over the application.
Shell component vulnerability: The Admin/InnoDB Cluster of the Oracle MySQL Server database management system is vulnerable due to insufficient protection for operational data. Exploiting this vulnerability could allow an attacker to gain full control over the application using the MySQL protocol...
The vulnerability of the event forwarding mechanism in IBM QRadar WinCollect Agent, related to access control deficiencies, allows attackers to escalate their privileges and execute arbitrary commands.
The vulnerability of the event forwarding mechanism in IBM QRadar WinCollect Agent is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges and execute arbitrary commands...
pamtours.pt Cross Site Scripting vulnerability OBB-3383225
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-2781
The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticateuserbyemail in versions up to, and including, 3.5.0. This is due to a random token generation weakness in the resendverificationemail function. This allows unauthenticated...
PT-2023-3518 · Microsoft · Windows
Name of the Vulnerable Software and Affected Versions: Windows versions prior to 8 Description: The issue is related to a flaw in the TCP/IP protocol implementation in Windows operating systems, specifically concerning authentication procedure weaknesses. This can be exploited by a remote attacke...
PT-2023-3015
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.0.5 Splunk Enterprise versions prior to 8.2.11 Splunk Enterprise versions prior to 8.1.14 Splunk Cloud Platform versions prior to 9.0.2303.100 Description A low-privileged user with the edit user capabilit...
The vulnerability of the Message and Bulletin components of the Cybozu Garoon data exchange platform, which allows a perpetrator to compromise the integrity of the protected information.
The vulnerability of the Message and Bulletin components of the Cybozu Garoon data exchange platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...
CVE-2023-29731
SoLive 1.6.14 thru 1.6.20 for Android has an exposed component that provides a method to modify the SharedPreference file. An attacker can leverage this method to inject a large amount of data into any SharedPreference file, which will be loaded into memory when the application is opened. When an...
New MVC Shop 1.0 SQL Injection / Missing Attributes
Title: new-mvc-shop-1.0 - SQLi + SameSite attribute weak security PHPSESSID Hijacking Author: nu11secur1ty Date: 05.29.2023 Vendor: https://chikoiquan.tanhongit.com/ Software: https://github.com/tanhongit/new-mvc-shop/releases/tag/v1.0 Reference: https://portswigger.net/web-security/sql-injection...
The vulnerability of the Webhook component in the Kubernets Rancher cluster management software allows a hacker to increase their privileges.
The vulnerability of the Webhook component in Kubernets Rancher’s cluster management software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...
AZL-43702 CVE-2023-31147 affecting package python-pycares 3.1.1-3
c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom are unavailable, c-ares uses rand to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand so will generate predictable output. Input from the random number generator i...
AZL-34776 CVE-2023-31147 affecting package grpc for versions less than 1.62.0-2
c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom are unavailable, c-ares uses rand to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand so will generate predictable output. Input from the random number generator i...
CVE-2023-31761
Weak security in the transmitter of Blitzwolf BW-IS22 Smart Home Security Alarm v1.0 allows attackers to gain full access to the system via a code replay attack...
Code injection
Weak security in the transmitter of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to gain full access to the system via a code replay attack...
The vulnerability of the ksmbd module in Linux operating systems allows attackers to execute a brute-force attack.
The vulnerability of the ksmbd module in Linux operating systems is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to carry out an attack using brute-force methods...
