‼ CVE-2023-38508 ‼
📖 Read
via "National Vulnerability Database".
Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14.11.99.28 and Tuleap Enterprise Edition prior to versions 14.10-6 and 14.11-3, the preview of an artifact link with a type does not respect the project, tracker and artifact level permissions. The issue occurs on the artifact view (not reproducible on the artifact modal). Users might get access to information they should not have access to. Only the title, status, assigned to and last update date fields as defined by the semantics are impacted. If those fields have strict permissions (e.g. the title is only visible to a specific user group) those permissions are still enforced. Tuleap Community Edition 14.11.99.28, Tuleap Enterprise Edition 14.10-6, and Tuleap Enterprise Edition 14.11-3 contain a fix for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40022 ‼
📖 Read
via "National Vulnerability Database".
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in `consume_count` of `src/gnu_v2/cplus-dem.c`. The overflow check is valid logic but, is missing the modulus if the block once compiled. The compiler sees this block as unreachable code since the prior statement is multiplication by 10 and fails to consider overflow assuming the count will always be a multiple of 10. Rizin version 0.6.1 contains a fix for the issue. A temporary workaround would be disabling C++ demangling using the configuration option `bin.demangle=false`.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32755 ‼
📖 Read
via "National Vulnerability Database".
e-Excellence U-Office Force generates an error message in webiste service. An unauthenticated remote attacker can obtain partial sensitive system information from error message by sending a crafted command.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41173 ‼
📖 Read
via "National Vulnerability Database".
AdGuard DNS before 2.2 allows remote attackers to cause a denial of service via malformed UDP packets.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3425 ‼
📖 Read
via "National Vulnerability Database".
Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32584 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in John Newcombe eBecas plugin <=Â 3.1.3 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32577 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eji Osigwe DevBuddy Twitter Feed plugin <=Â 4.0.0 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32576 ‼
📖 Read
via "National Vulnerability Database".
Auth. (subscriber+) Stored Cross-Site Scripting') vulnerability in Plainware Locatoraid Store Locator plugin <=Â 3.9.18 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32518 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ono Oogami WP Chinese Conversion plugin <=Â 1.1.16 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3406 ‼
📖 Read
via "National Vulnerability Database".
Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read some restricted files on the web server📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32591 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Cloud Primero B.V DBargain plugin <=Â 3.0.0 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32756 ‼
📖 Read
via "National Vulnerability Database".
e-Excellence U-Office Force has a path traversal vulnerability within its file uploading and downloading functions. An unauthenticated remote attacker can exploit this vulnerability to read arbitrary system files, but can’t control system or disrupt service.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32757 ‼
📖 Read
via "National Vulnerability Database".
e-Excellence U-Office Force file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker without logging the service can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.📖 Read
via "National Vulnerability Database".
📢 FBI alerts Barracuda customers after ineffective patch 📢
📖 Read
via "ITPro".
Despite issuing a patch in May, Barracuda ESG appliance users are still at high risk 📖 Read
via "ITPro".
ITPro
FBI alerts Barracuda customers after ineffective patch
Despite issuing a patch in May, Barracuda ESG appliance users are still at high risk
‼ CVE-2023-32575 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin <=Â 1.3.25 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32596 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wolfgang Ertl weebotLite plugin <=Â 1.0.0 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4478 ‼
📖 Read
via "National Vulnerability Database".
Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32595 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Palasthotel by Edward Bock, Katharina Rompf Sunny Search plugin <=Â 1.0.2 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25981 ‼
📖 Read
via "National Vulnerability Database".
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form plugin <=Â 2.8.1 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24394 ‼
📖 Read
via "National Vulnerability Database".
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy iframe popup plugin <=Â 3.3 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25649 ‼
📖 Read
via "National Vulnerability Database".
There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.📖 Read
via "National Vulnerability Database".