🚨 CVE-2022-48519
Unauthorized access vulnerability in the SystemUI module. Successful exploitation of this vulnerability may affect confidentiality.
🎖@cveNotify
Unauthorized access vulnerability in the SystemUI module. Successful exploitation of this vulnerability may affect confidentiality.
🎖@cveNotify
Harmonyos
July-2023-HarmonyOS Security Bulletins-Updates-HarmonyOSDevice
July HarmonyOS Security Bulletin - July 2023 This bulletin contains details a……
🚨 CVE-2022-48520
Unauthorized access vulnerability in the SystemUI module. Successful exploitation of this vulnerability may affect confidentiality.
🎖@cveNotify
Unauthorized access vulnerability in the SystemUI module. Successful exploitation of this vulnerability may affect confidentiality.
🎖@cveNotify
Harmonyos
July-2023-HarmonyOS Security Bulletins-Updates-HarmonyOSDevice
July HarmonyOS Security Bulletin - July 2023 This bulletin contains details a……
🚨 CVE-2023-1691
Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.
🎖@cveNotify
Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.
🎖@cveNotify
Harmonyos
July-2023-HarmonyOS Security Bulletins-Updates-HarmonyOSDevice
July HarmonyOS Security Bulletin - July 2023 This bulletin contains details a……
🚨 CVE-2023-1695
Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.
🎖@cveNotify
Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.
🎖@cveNotify
Harmonyos
July-2023-HarmonyOS Security Bulletins-Updates-HarmonyOSDevice
July HarmonyOS Security Bulletin - July 2023 This bulletin contains details a……
🚨 CVE-2023-34164
Vulnerability of incomplete input parameter verification in the communication framework module. Successful exploitation of this vulnerability may affect availability.
🎖@cveNotify
Vulnerability of incomplete input parameter verification in the communication framework module. Successful exploitation of this vulnerability may affect availability.
🎖@cveNotify
Harmonyos
July-2023-HarmonyOS Security Bulletins-Updates-HarmonyOSDevice
July HarmonyOS Security Bulletin - July 2023 This bulletin contains details a……
🚨 CVE-2023-37238
Vulnerability of apps' permission to access a certain API being incompletely verified in the wireless projection module. Successful exploitation of this vulnerability may affect some wireless projection features.
🎖@cveNotify
Vulnerability of apps' permission to access a certain API being incompletely verified in the wireless projection module. Successful exploitation of this vulnerability may affect some wireless projection features.
🎖@cveNotify
Harmonyos
July-2023-HarmonyOS Security Bulletins-Updates-HarmonyOSDevice
July HarmonyOS Security Bulletin - July 2023 This bulletin contains details a……
🚨 CVE-2023-29381
An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters.
🎖@cveNotify
An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters.
🎖@cveNotify
🚨 CVE-2023-35948
Novu provides an API for sending notifications through multiple channels. Versions prior to 0.16.0 contain an open redirect vulnerability in the "Sign In with GitHub" functionality of Novu's open-source repository. It could have allowed an attacker to force a victim into opening a malicious URL and thus, potentially log into the repository under the victim's account gaining full control of the account. This vulnerability only affected the Novu Cloud and Open-Source deployments if the user manually enabled the GitHub OAuth on their self-hosted instance of Novu. Users should upgrade to version 0.16.0 to receive a patch.
🎖@cveNotify
Novu provides an API for sending notifications through multiple channels. Versions prior to 0.16.0 contain an open redirect vulnerability in the "Sign In with GitHub" functionality of Novu's open-source repository. It could have allowed an attacker to force a victim into opening a malicious URL and thus, potentially log into the repository under the victim's account gaining full control of the account. This vulnerability only affected the Novu Cloud and Open-Source deployments if the user manually enabled the GitHub OAuth on their self-hosted instance of Novu. Users should upgrade to version 0.16.0 to receive a patch.
🎖@cveNotify
GitHub
Open Redirect Vulnerability in Sign-In with GitHub Functionality
We have recently identified and addressed a significant security vulnerability concerning an open redirect in the "Sign In with GitHub" functionality of our login process. This vulnerabil...
🚨 CVE-2023-29382
An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component.
🎖@cveNotify
An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component.
🎖@cveNotify
🚨 CVE-2023-30320
Cross Site Scripting (XSS) vulnerability in textMessage field in /src/chatbotapp/chatWindow.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code.
🎖@cveNotify
Cross Site Scripting (XSS) vulnerability in textMessage field in /src/chatbotapp/chatWindow.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code.
🎖@cveNotify
GitHub
ChatEngine/src/chatbotapp/chatWindow.java at master · wliang6/ChatEngine
A JavaEE web application built using Eclipse plugins: Oracle Database Tools, Database Development, and Derby then deployed into Tomcat. - wliang6/ChatEngine
🚨 CVE-2023-30319
Cross Site Scripting (XSS) vulnerability in username field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code.
🎖@cveNotify
Cross Site Scripting (XSS) vulnerability in username field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code.
🎖@cveNotify
Payatu
Cross Site Scripting (XSS) in username field in ChatEngine 1.0 - Payatu
Vulnerability Cross Site Scripting (XSS) vulnerability in username field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine, allows attackers to execute arbitrary code. Description The Application does not sanitize or escape username parameter, making…
🚨 CVE-2023-34192
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.
🎖@cveNotify
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.
🎖@cveNotify
🚨 CVE-2023-30321
Cross Site Scripting (XSS) vulnerability in textMessage field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code.
🎖@cveNotify
Cross Site Scripting (XSS) vulnerability in textMessage field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code.
🎖@cveNotify
GitHub
ChatEngine/src/chatbotapp/LoginServlet.java at fded8e710ad59f816867ad47d7fc4862f6502f3e · wliang6/ChatEngine
A JavaEE web application built using Eclipse plugins: Oracle Database Tools, Database Development, and Derby then deployed into Tomcat. - wliang6/ChatEngine
🚨 CVE-2023-34193
File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function.
🎖@cveNotify
File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function.
🎖@cveNotify
🚨 CVE-2023-37560
Cross-site scripting vulnerability in WRH-300WH-H v2.12 and earlier, and WTC-300HWH v1.09 and earlier allows a remote unauthenticated attacker to inject an arbitrary script.
🎖@cveNotify
Cross-site scripting vulnerability in WRH-300WH-H v2.12 and earlier, and WTC-300HWH v1.09 and earlier allows a remote unauthenticated attacker to inject an arbitrary script.
🎖@cveNotify
エレコム株式会社 - パソコン・スマートフォン・タブレット・デジタル周辺機器メーカー
無線LANルーター・中継器のセキュリティ向上のためのファームウェアアップデートのお願い | エレコム株式会社 ELECOM
当社製の一部の無線LANルーター・中継器におきまして、以下脆弱性が判明いたしました。つきましては、下記内容に従って当社対象製品のファームウェアアップデートを行っていただきますようお願い申し上げます。
🚨 CVE-2023-2190
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. It may be possible for users to view new commits to private projects in a fork created while the project was public.
🎖@cveNotify
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. It may be possible for users to view new commits to private projects in a fork created while the project was public.
🎖@cveNotify
🚨 CVE-2023-34129
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in SonicWall GMS and Analytics allows an authenticated remote attacker to traverse the directory and extract arbitrary files using Zip Slip method to any location on the underlying filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
🎖@cveNotify
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in SonicWall GMS and Analytics allows an authenticated remote attacker to traverse the directory and extract arbitrary files using Zip Slip method to any location on the underlying filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
🎖@cveNotify
🚨 CVE-2023-37568
ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC-1167GEBK-S v1.03 and earlier allow a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page.
🎖@cveNotify
ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC-1167GEBK-S v1.03 and earlier allow a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page.
🎖@cveNotify
エレコム株式会社 - パソコン・スマートフォン・タブレット・デジタル周辺機器メーカー
無線LANルーター・中継器のセキュリティ向上のためのファームウェアアップデートのお願い | エレコム株式会社 ELECOM
当社製の一部の無線LANルーター・中継器におきまして、以下脆弱性が判明いたしました。つきましては、下記内容に従って当社対象製品のファームウェアアップデートを行っていただきますようお願い申し上げます。
🚨 CVE-2023-37561
Open redirect vulnerability in ELECOM wireless LAN routers and ELECOM wireless LAN repeaters allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL. Affected products and versions are as follows: WRH-300WH-H v2.12 and earlier, WTC-300HWH v1.09 and earlier, WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier.
🎖@cveNotify
Open redirect vulnerability in ELECOM wireless LAN routers and ELECOM wireless LAN repeaters allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL. Affected products and versions are as follows: WRH-300WH-H v2.12 and earlier, WTC-300HWH v1.09 and earlier, WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier.
🎖@cveNotify
エレコム株式会社 - パソコン・スマートフォン・タブレット・デジタル周辺機器メーカー
無線LANルーター・中継器のセキュリティ向上のためのファームウェアアップデートのお願い | エレコム株式会社 ELECOM
当社製の一部の無線LANルーター・中継器におきまして、以下脆弱性が判明いたしました。つきましては、下記内容に従って当社対象製品のファームウェアアップデートを行っていただきますようお願い申し上げます。
🚨 CVE-2023-37566
ELECOM wireless LAN routers WRC-1167GHBK3-A v1.24 and earlier, and WRC-1167FEBK-A v1.18 and earlier allow a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page.
🎖@cveNotify
ELECOM wireless LAN routers WRC-1167GHBK3-A v1.24 and earlier, and WRC-1167FEBK-A v1.18 and earlier allow a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page.
🎖@cveNotify
エレコム株式会社 - パソコン・スマートフォン・タブレット・デジタル周辺機器メーカー
無線LANルーター・中継器のセキュリティ向上のためのファームウェアアップデートのお願い | エレコム株式会社 ELECOM
当社製の一部の無線LANルーター・中継器におきまして、以下脆弱性が判明いたしました。つきましては、下記内容に従って当社対象製品のファームウェアアップデートを行っていただきますようお願い申し上げます。
🚨 CVE-2023-34130
SonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
🎖@cveNotify
SonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
🎖@cveNotify