A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system.
This vulnerability exists bec...
AFFECTED_PRODUCTS:
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center
... (+4)
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface.
This vulnerability is due to the web-based management interface not...
AFFECTED_PRODUCTS:
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center
... (+36)
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker with Administrator-level privileges to execute arbitrary commands on the underlying operating...
AFFECTED_PRODUCTS:
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center
... (+39)
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insuffic...
AFFECTED_PRODUCTS:
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center
... (+88)
A vulnerability in the Cisco FXOS CLI feature on specific hardware platforms for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to elevate their administrative privileges to root. The attacker would need...
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficie...
AFFECTED_PRODUCTS:
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center
... (+39)
A vulnerability was found in PHPGurukul Medical Card Generation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/changeimage.php of the component Managecard Edit Image Page. The manipulation of the argument editid leads to sql injecti...
AFFECTED_PRODUCTS:
Anujk305 Medical Card Generation System
Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-Poly1305 and x25519). An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i386...
AFFECTED_PRODUCTS:
Botan Project Botan
Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.
AFFECTED_PRODUCTS:
Botan Project Botan
AshPostgres is the PostgreSQL data layer for Ash Framework. Starting in version 2.0.0 and prior to version 2.4.10, in certain very specific situations, it was possible for the policies of an update action to be skipped. This occurred only on "empty" update actions (no changing fields), and would all...
A vulnerability in the TCP/IP traffic handling function of the Snort Detection Engine of Cisco Firepower Threat Defense (FTD) Software and Cisco FirePOWER Services could allow an unauthenticated, remote attacker to cause legitimate network traffic to be dropped, resulting in a denial of service (DoS...
AFFECTED_PRODUCTS:
Cisco Firepower Threat Defense Software,
Cisco Firepower Threat Defense Software,
Cisco Firepower Threat Defense Software
... (+82)
Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured rate limiting filter.
This vulnerability is due to an incorrect connection count comparison. An att...
AFFECTED_PRODUCTS:
Cisco Snort,
Cisco Firepower Threat Defense Software,
Cisco Firepower Threat Defense Software
... (+3)
A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a browser that is accessing an affected...
AFFECTED_PRODUCTS:
Cisco Adaptive Security Appliance Software,
Cisco Adaptive Security Appliance Software,
Cisco Adaptive Security Appliance Software
... (+269)
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to perform an SQL injection attack against an affected device. To exploit this vulnerability,...
AFFECTED_PRODUCTS:
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center
... (+36)
A vulnerability in the TLS processing feature of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to an issue that occurs when...
AFFECTED_PRODUCTS:
Cisco Firepower Threat Defense Software,
Cisco Firepower Threat Defense Software,
Cisco Firepower Threat Defense Software
... (+77)
A vulnerability in the session authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to prevent users from authenticating.
This vulnera...
AFFECTED_PRODUCTS:
Cisco Adaptive Security Appliance Software,
Cisco Adaptive Security Appliance Software,
Cisco Adaptive Security Appliance Software
... (+269)
A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause memory corruption, which could cause the Snort detection engine to restart unex...
AFFECTED_PRODUCTS:
Cisco Firepower Threat Defense,
Cisco Firepower Threat Defense,
Cisco Firepower Threat Defense
... (+34)
A vulnerability in the SSH subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to execute operating system commands as root.
This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by...
AFFECTED_PRODUCTS:
Cisco Adaptive Security Appliance Software,
Cisco Adaptive Security Appliance Software,
Cisco Adaptive Security Appliance Software
... (+24)
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficient vali...
AFFECTED_PRODUCTS:
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center
... (+82)
A vulnerability in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should have been denied to flow th...
AFFECTED_PRODUCTS:
Cisco Adaptive Security Appliance Software,
Cisco Adaptive Security Appliance Software,
Cisco Adaptive Security Appliance Software
... (+222)
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficient vali...
AFFECTED_PRODUCTS:
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center
... (+4)
A vulnerability in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should have been denied to flow th...
AFFECTED_PRODUCTS:
Cisco Adaptive Security Appliance Software,
Cisco Adaptive Security Appliance Software,
Cisco Adaptive Security Appliance Software
... (+256)
A vulnerability in the cluster backup feature of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system.
This vulnerability is due to insu...
AFFECTED_PRODUCTS:
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center
... (+19)
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to inject arbitrary HTML content into a device-generated document.
This vulnerability is du...
AFFECTED_PRODUCTS:
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center
... (+83)
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficient va...
AFFECTED_PRODUCTS:
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center
... (+80)
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficient vali...
AFFECTED_PRODUCTS:
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center
... (+80)
A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause an unexpected reload of the device.
This vulnerability is due to in...
AFFECTED_PRODUCTS:
Cisco Adaptive Security Appliance Software,
Cisco Adaptive Security Appliance Software,
Cisco Adaptive Security Appliance Software
... (+141)
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficient vali...
AFFECTED_PRODUCTS:
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center,
Cisco Secure Firewall Management Center
... (+12)
A vulnerability in the VPN and management web servers of the Cisco Adaptive Security Virtual Appliance (ASAv) and Cisco Secure Firewall Threat Defense Virtual (FTDv), formerly Cisco Firepower Threat Defense Virtual, platforms could allow an unauthenticated, remote attacker to cause the virtual devic...
A vulnerability was found in PHPGurukul Medical Card Generation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/card-bwdates-reports-details.php of the component Report of Medical Card Page. The manipulation of the argument...
AFFECTED_PRODUCTS:
Phpgurukul Medical Card Generation System
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Prior to commit 5d118a902872d7941f099ad1fb918e2421e79ccd, a user could inject HTML through SaaS signup inputs. The user who injected the unsafe HTML code would only...
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Theme Horse Mags.This issue affects Mags: from n/a through 1.1.6.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Qode Interactive Qi Blocks.This issue affects Qi Blocks: from n/a through 1.3.2.
Deserialization of Untrusted Data vulnerability in Revmakx Backup and Staging by WP Time Capsule allows Object Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through 1.22.21.
Unrestricted Upload of File with Dangerous Type vulnerability in Michael Bourne Custom Icons for Elementor allows Upload a Web Shell to a Web Server.This issue affects Custom Icons for Elementor: from n/a through 0.3.3.
Unrestricted Upload of File with Dangerous Type vulnerability in Dogu Pekgoz AI Image Generator for Your Content & Featured Images – AI Postpix allows Upload a Web Shell to a Web Server.This issue affects AI Image Generator for Your Content & Featured Images – AI Postpix: from n/a through 1.1.8.
Unrestricted Upload of File with Dangerous Type vulnerability in Alexander De Ridder INK Official allows Upload a Web Shell to a Web Server.This issue affects INK Official: from n/a through 4.1.2.
Unrestricted Upload of File with Dangerous Type vulnerability in Admin Verbalize WP Upload a Web Shell to a Web Server.This issue affects Verbalize WP: from n/a through 1.0.
Unrestricted Upload of File with Dangerous Type vulnerability in Ecomerciar Woocommerce Custom Profile Picture allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Custom Profile Picture: from n/a through 1.0.
Missing Authorization vulnerability in ReneeCussack 3D Work In Progress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D Work In Progress: from n/a through 1.0.3.
Unrestricted Upload of File with Dangerous Type vulnerability in James Eggers Portfolleo portfolleo allows Upload a Web Shell to a Web Server.This issue affects Portfolleo: from n/a through 1.2.
Unrestricted Upload of File with Dangerous Type vulnerability in ReneeCussack 3D Work In Progress allows Upload a Web Shell to a Web Server.This issue affects 3D Work In Progress: from n/a through 1.0.3.
HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol. An attacker could potentially use this service endpoint maliciously.
A vulnerability was found in ZZCMS 2023. It has been classified as critical. Affected is the function Ebak_SetGotoPak of the file 3/Ebbak5.1/upload/class/functions.php. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has b...
AFFECTED_PRODUCTS:
Zzcms Zzcms
A vulnerability was found in ZZCMS 2023 and classified as critical. This issue affects some unknown processing of the file 3/Ebak5.1/upload/ChangeTable.php. The manipulation of the argument savefilename leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclose...
AFFECTED_PRODUCTS:
Zzcms Zzcms
A vulnerability has been found in ZZCMS 2023 and classified as critical. This vulnerability affects the function Ebak_DoExecSQL/Ebak_DotranExecutSQL of the file 3/Ebak5.1/upload/phome.php. The manipulation of the argument phome leads to sql injection. The attack can be initiated remotely. The exploi...
AFFECTED_PRODUCTS:
Zzcms Zzcms
Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database (SMTP or HTTP proxy credentials, user tokens, tokens, among others). The affected versions relied on a...
AFFECTED_PRODUCTS:
Sonatype Nexus
Authentication Bypass Using an Alternate Path or Channel vulnerability in Vitalii Bryl iBryl Switch User allows Authentication Bypass.This issue affects iBryl Switch User: from n/a through 1.0.1.
AFFECTED_PRODUCTS:
Vitaliibryl Switch User
Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Backend Password" is set to true, the change password function in Portal Profile sets the new password. Prior to Pimcore portal engine versions 4.1.7 and 3.1.16,...
AFFECTED_PRODUCTS:
Pimcore Pimcore,
Pimcore Pimcore
A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The affected devices contain a SUID binary that could allow an a...
AFFECTED_PRODUCTS:
Siemens Intermesh 7177 Hybrid 2.0 Subscriber,
Siemens Intermesh 7707 Fire Subscriber Firmware