🚨 CVE-2023-48056
PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.
🎖@cveNotify
PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.
🎖@cveNotify
🚨 CVE-2023-48192
An issue in TOTOlink A3700R v.9.1.2u.6134_B20201202 allows a local attacker to execute arbitrary code via the setTracerouteCfg function.
🎖@cveNotify
An issue in TOTOlink A3700R v.9.1.2u.6134_B20201202 allows a local attacker to execute arbitrary code via the setTracerouteCfg function.
🎖@cveNotify
GitHub
GitHub - zxsssd/TotoLink-: cstecgi.cgi的setTracerouteCfg接口存在未授权任意命令执行
cstecgi.cgi的setTracerouteCfg接口存在未授权任意命令执行. Contribute to zxsssd/TotoLink- development by creating an account on GitHub.
🚨 CVE-2023-48105
An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of service via the wasm_loader_prepare_bytecode function in core/iwasm/interpreter/wasm_loader.c.
🎖@cveNotify
An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of service via the wasm_loader_prepare_bytecode function in core/iwasm/interpreter/wasm_loader.c.
🎖@cveNotify
GitHub
Heap overflow in wasm_loader_prepare_bytecode · Issue #2726 · bytecodealliance/wasm-micro-runtime
Environments OS : Ubuntu 18.04 5.4.0-150-generic Commit : 52db362 Version : iwasm 1.2.3 Vulnerability Description Affected Tool : iwasm (linux build) Affected Version : = 1.2.3 Impact : Heap out of...
🚨 CVE-2023-48193
Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. NOTE: this is disputed because command filtering is not intended to restrict what code can be run by authorized users who are allowed to execute files.
🎖@cveNotify
Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. NOTE: this is disputed because command filtering is not intended to restrict what code can be run by authorized users who are allowed to execute files.
🎖@cveNotify
Fit2Cloud
说明丨关于JumpServer CVE-2023-48193漏洞披露的相关说明
感谢广大用户对JumpServer开源项目的关注和支持。
🚨 CVE-2023-23324
Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain hardcoded credentials for the Administrator account.
🎖@cveNotify
Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain hardcoded credentials for the Administrator account.
🎖@cveNotify
Tinexta Cyber
Il polo italiano della Cyber Security
Costruiamo un digitale sicuro, insieme. Sicurezza, Resilienza, Innovazione Tinexta Cyber è una delle principali realtà italiane nel campo della cybersecurity e della system integration, parte del Gruppo Tinexta. Con un approccio integrato che unisce competenza…
🚨 CVE-2023-23325
Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain a command injection vulnerability via the NetHostname parameter.
🎖@cveNotify
Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain a command injection vulnerability via the NetHostname parameter.
🎖@cveNotify
Tinexta Cyber
Il polo italiano della Cyber Security
Costruiamo un digitale sicuro, insieme. Sicurezza, Resilienza, Innovazione Tinexta Cyber è una delle principali realtà italiane nel campo della cybersecurity e della system integration, parte del Gruppo Tinexta. Con un approccio integrato che unisce competenza…
🚨 CVE-2023-24294
Zumtobel Netlink CCD Onboard v3.74 - Firmware v3.80 was discovered to contain a buffer overflow via the component NetlinkWeb::Information::SetDeviceIdentification.
🎖@cveNotify
Zumtobel Netlink CCD Onboard v3.74 - Firmware v3.80 was discovered to contain a buffer overflow via the component NetlinkWeb::Information::SetDeviceIdentification.
🎖@cveNotify
Tinexta Cyber
Il polo italiano della Cyber Security
Costruiamo un digitale sicuro, insieme. Sicurezza, Resilienza, Innovazione Tinexta Cyber è una delle principali realtà italiane nel campo della cybersecurity e della system integration, parte del Gruppo Tinexta. Con un approccio integrato che unisce competenza…
🚨 CVE-2023-48940
A stored cross-site scripting (XSS) vulnerability in /admin.php of DaiCuo v2.5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
🎖@cveNotify
A stored cross-site scripting (XSS) vulnerability in /admin.php of DaiCuo v2.5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
🎖@cveNotify
🚨 CVE-2023-43303
An issue in craftbeer bar canvas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token (via captured network traffic).
🎖@cveNotify
An issue in craftbeer bar canvas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token (via captured network traffic).
🎖@cveNotify
🚨 CVE-2023-33411
A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to 3.17.02, allows remote unauthenticated users to perform directory traversal, potentially disclosing sensitive information.
🎖@cveNotify
A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to 3.17.02, allows remote unauthenticated users to perform directory traversal, potentially disclosing sensitive information.
🎖@cveNotify
🚨 CVE-2023-33412
The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targeting vulnerable cgi endpoints.
🎖@cveNotify
The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targeting vulnerable cgi endpoints.
🎖@cveNotify
🚨 CVE-2023-33413
The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to execute arbitrary commands.
🎖@cveNotify
The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to execute arbitrary commands.
🎖@cveNotify
🚨 CVE-2023-47320
Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in "Maintenance Mode" due to broken access control. This makes the application unavailable to all users. This affects Silverpeas Core 6.3.1 and below.
🎖@cveNotify
Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in "Maintenance Mode" due to broken access control. This makes the application unavailable to all users. This affects Silverpeas Core 6.3.1 and below.
🎖@cveNotify
GitHub
CVEs/CVE-2023-47320 at master · RhinoSecurityLabs/CVEs
Proof-of-Concept exploits for CVEs found by the team at Rhino Security Labs - RhinoSecurityLabs/CVEs
🚨 CVE-2023-47321
Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets.
🎖@cveNotify
Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets.
🎖@cveNotify
GitHub
CVEs/CVE-2023-47321 at master · RhinoSecurityLabs/CVEs
Proof-of-Concept exploits for CVEs found by the team at Rhino Security Labs - RhinoSecurityLabs/CVEs
🚨 CVE-2023-47322
The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute making the attacker an administrator user in the application.
🎖@cveNotify
The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute making the attacker an administrator user in the application.
🎖@cveNotify
GitHub
CVEs/CVE-2023-47322 at master · RhinoSecurityLabs/CVEs
Proof-of-Concept exploits for CVEs found by the team at Rhino Security Labs - RhinoSecurityLabs/CVEs
🚨 CVE-2023-47323
The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.
🎖@cveNotify
The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.
🎖@cveNotify
GitHub
CVEs/CVE-2023-47323 at master · RhinoSecurityLabs/CVEs
Proof-of-Concept exploits for CVEs found by the team at Rhino Security Labs - RhinoSecurityLabs/CVEs
🚨 CVE-2023-47324
Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature.
🎖@cveNotify
Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature.
🎖@cveNotify
GitHub
CVEs/CVE-2023-47324 at master · RhinoSecurityLabs/CVEs
Proof-of-Concept exploits for CVEs found by the team at Rhino Security Labs - RhinoSecurityLabs/CVEs
🚨 CVE-2023-47325
Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the spaces.
🎖@cveNotify
Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the spaces.
🎖@cveNotify
GitHub
CVEs/CVE-2023-47325 at master · RhinoSecurityLabs/CVEs
Proof-of-Concept exploits for CVEs found by the team at Rhino Security Labs - RhinoSecurityLabs/CVEs
🚨 CVE-2023-47326
Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) via the Domain SQL Create function.
🎖@cveNotify
Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) via the Domain SQL Create function.
🎖@cveNotify
GitHub
CVEs/CVE-2023-47326 at master · RhinoSecurityLabs/CVEs
Proof-of-Concept exploits for CVEs found by the team at Rhino Security Labs - RhinoSecurityLabs/CVEs
🚨 CVE-2023-47327
The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL.
🎖@cveNotify
The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL.
🎖@cveNotify
GitHub
CVEs/CVE-2023-47327 at master · RhinoSecurityLabs/CVEs
Proof-of-Concept exploits for CVEs found by the team at Rhino Security Labs - RhinoSecurityLabs/CVEs
🚨 CVE-2023-50983
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function.
🎖@cveNotify
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function.
🎖@cveNotify