The vulnerability of the graphical interface of FortiWeb web applications allows attackers to bypass security restrictions and execute arbitrary code.

The vulnerability of the graphical interface of FortiWeb web applications is related to a breach of data protection mechanisms. Exploiting this vulnerability allows an attacker to bypass security restrictions and execute arbitrary code by sending specially crafted HTTP requests remotely...

CVE-2023-34984

A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests...

The vulnerability of the SetQuickVPNSettings() function in the microprogramming software for D-Link DIR-3040 routers allows a hacker to execute arbitrary code.

The vulnerability of the SetQuickVPNSettings function in the D-Link DIR-3040 wireless router’s microprogramming software is related to the execution of an operation that goes beyond the buffer in memory as a result of executing the prog.cgi script. Exploiting this vulnerability allows a remote...

CVE-2023-4893

The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Server Side Request Forgery via the 'crayon' shortcode in versions up to, and including, 2.8.4. This can allow authenticated attackers with contributor-level permissions or above to make web requests to arbitrary locations...

PT-2023-31013 · WordPress · Crayon Syntax Highlighter

Name of the Vulnerable Software and Affected Versions: Crayon Syntax Highlighter plugin for WordPress versions up to, and including, 2.8.4 Description: The issue allows authenticated attackers with contributor-level permissions or above to make web requests to arbitrary locations originating from...

MoFi Network MOFI4500-4GXeLTE-V2 Authorization Issues Vulnerability

The MoFi Network MOFI4500-4GXeLTE-V2 is a wireless router from MoFi Network Canada. A security vulnerability exists in the MoFi Network MOFI4500-4GXeLTE-V2 version 3.5.6-xnet-5052, which originates from a vulnerability that allows an attacker to bypass authentication and execute arbitrary code vi...

IBM Aspera Security Vulnerability

IBM Aspera is a suite of fast file transfer and streaming solutions from International Business Machines IBM built on the IBM FASP protocol. A security vulnerability exists in IBM Aspera Faspex versions prior to 5.0.6 that stems from a vulnerability that could allow a malicious actor to bypass IP...

PT-2023-5167 · Fortinet · Fortiweb

Name of the Vulnerable Software and Affected Versions: Fortinet FortiWeb versions 6.3.6 through 6.3.23 Fortinet FortiWeb versions 6.4.0 through 6.4.3 Fortinet FortiWeb versions 7.0.0 through 7.0.6 Fortinet FortiWeb versions 7.2.0 through 7.2.1 Description: A protection mechanism failure in Fortin...

LibreY Code Issue Vulnerability

LibreY is a fork of LibreX, a frameless and JavaScript-free privacy-respecting metasearch engine by hnhx. A code issue vulnerability exists in LibreY. An attacker could use this vulnerability to request the server to send an HTTP GET request to an arbitrary target and conduct a Denial of Service...

Vim 输入验证错误漏洞

Vim is a cross-platform text editor. An input validation error vulnerability exists in versions prior to Vim 9.0.1846 that stems from the presence of an integer overflow or wrap-around issue. A remote attacker can exploit this vulnerability by sending a malicious HTTP or HTTPS request to execute...

PT-2023-5319

Name of the Vulnerable Software and Affected Versions Qlik Sense Enterprise for Windows versions May 2023 Patch 3 and earlier Qlik Sense Enterprise for Windows versions February 2023 Patch 7 and earlier Qlik Sense Enterprise for Windows versions November 2022 Patch 10 and earlier Qlik Sense...

CVE-2023-3704

The vulnerability exists in CP-Plus DVR due to an improper input validation within the web-based management interface of the affected products. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device. Successful...

Cisco Unified Contact Center Express 输入验证错误漏洞

Cisco Unified Contact Center Express Unified CCX is a customer relationship management component of a unified communications solution from Cisco. The component supports features such as self-service voice, call distribution, and customer access control. An input validation error vulnerability...

ZKTeco BioAccess IVS 安全漏洞

ZKTeco BioAccess IVS is a lite web-based security platform from ZKTeco, China. An Access Control Error vulnerability exists in ZKTeco BioAccess IVS v3.3.1, which arises from improper access control and can be exploited by an attacker to arbitrarily close and open the door to the platform...

CVE-2023-39109

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery SSRF via the patha parameter in the doDiff Function of /classes/compareClass.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs...

CVE-2023-32637

GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyone who can upload files through the product may execute arbitrary code on the server...

The vulnerability relates to the MS Excel-specific software component used in Oracle Web Applications. It is a part of the Oracle E-Business Suite, a system for automating business processes. This vulnerability allows an attacker to gain access to data and modify it.

The vulnerability of the MS Excel-specific software component used for working with Oracle Web Applications, a desktop integrator system in the Oracle E-Business Suite, exists due to insufficient verification of input data. Exploiting this vulnerability allows an attacker operating remotely to ga...

The vulnerability of the Diagnostics component of the Oracle Applications Framework software, a system for automating business operations in enterprises under the Oracle E-Business Suite, allows a perpetrator to gain access to and modify data.

The vulnerability of the Diagnostics component of the Oracle Applications Framework software in the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to gain access to read, modify, add, or delete dat...

CVE-2023-25606

An improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability CWE-23 in FortiAnalyzer and FortiManager management interface 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4 all versions may allow a remote and authenticated attacker to retrieve arbitrary files from the...

Path traversal

An improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability CWE-22 in FortiExtender management interface 7.0.0 through 7.0.3, 4.2.0 through 4.2.4, 4.1.1 through 4.1.8, 4.0.0 through 4.0.2, 3.3.0 through 3.3.2, 3.2.1 through 3.2.3, 5.3 all versions may allow an...