The secret value used for access to critical UDS services of the MIB3 infotainment is hardcoded in the firmware.
Vulnerability discovered on Å koda Superb III (3V3) - 2.0 TDI manufactured in 2022.
AFFECTED_PRODUCTS:
Skoda-Auto Superb 3 Firmware
Verydows v2.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /protected/controller/backend/role_controller
AFFECTED_PRODUCTS:
Verydows Verydows
The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, provided there is an active user session.
AFFECTED_PRODUCTS:
Hongdian H8951 4g Esp Firmware
The "tokenKey" value used in user authorization is visible in the HTML source of the login page.
AFFECTED_PRODUCTS:
Hongdian H8951 4g Esp Firmware
An XSS attack can be performed by changing the MOTD banner and pointing the victim to the "terminal_tool.cgi" path. It can be used together with the vulnerability CVE-2023-49255.
AFFECTED_PRODUCTS:
Hongdian H8951 4g Esp Firmware
The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a reasonable time.
AFFECTED_PRODUCTS:
Hongdian H8951 4g Esp Firmware
User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging the XSS vulnerability located at "/gui/terminal_tool.cgi" in the "data" parameter.
AFFECTED_PRODUCTS:
Hongdian H8951 4g Esp Firmware
An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility and execute it with the root user privileges.
AFFECTED_PRODUCTS:
Hongdian H8951 4g Esp Firmware
It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key.
AFFECTED_PRODUCTS:
Hongdian H8951 4g Esp Firmware
The router console is accessible without authentication at "data" field, and while a user needs to be logged in in order to modify the configuration, the session state is shared. If any other user is currently logged in, the anonymous user can execute commands in the context of the authenticated one...
AFFECTED_PRODUCTS:
Hongdian H8951 4g Esp Firmware
Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools. This is similar to the vulnerability CVE-2021-28151 mitigated on the user interface level by blacklisting characters with JavaScript, however,...
AFFECTED_PRODUCTS:
Hongdian H8951 4g Esp Firmware
Root user password is hardcoded into the device and cannot be changed in the user interface.
AFFECTED_PRODUCTS:
Hongdian H8951 4g Esp Firmware
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an u...
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
... (+11)
A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
... (+1)
Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
... (+1)
An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding changes to a previously approved merge request...
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
... (+1)
An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
... (+1)
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.
AFFECTED_PRODUCTS:
MongoDB C Driver
TOTOlink EX1800T V9.1.0cu.2112_B20220316 was discovered to contain a remote command execution (RCE) vulnerability via the telnet_enabled parameter of the setTelnetCfg interface
AFFECTED_PRODUCTS:
Totolink Ex1800t Firmware
File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file.
AFFECTED_PRODUCTS:
Ujcms Ujcms
Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in the Admin Tools plug-in component.
AFFECTED_PRODUCTS:
Piwigo Piwigo
A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved.
Applications are only affected if they are using the ChrootOS...
AFFECTED_PRODUCTS:
Go-Git Project Go Git
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients.
Applications using on...
AFFECTED_PRODUCTS:
Go-Git Project Go Git
An issue was discovered in Jave2 version 3.3.1, allows attackers to execute arbitrary code via the FFmpeg function.
AFFECTED_PRODUCTS:
Aarboard Jave2
SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via sub_event_id parameter in sub_event_details_edit.php.
AFFECTED_PRODUCTS:
Oretnom23 Judging Management System
SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via txtsearch parameter in review_search.php.
AFFECTED_PRODUCTS:
Oretnom23 Judging Management System
SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via sub_event_id parameter in sub_event_stat_update.php.
AFFECTED_PRODUCTS:
Oretnom23 Judging Management System
Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges
AFFECTED_PRODUCTS:
Checkmk Checkmk,
Checkmk Checkmk,
Checkmk Checkmk
... (+1)
Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges
AFFECTED_PRODUCTS:
Checkmk Checkmk,
Checkmk Checkmk,
Checkmk Checkmk
... (+1)
An issue was discovered on GL.iNet devices before version 4.5.0. They assign the same session ID after each user reboot, allowing attackers to share session identifiers between different sessions and bypass authentication or access control measures. Attackers can impersonate legitimate users or perf...
AFFECTED_PRODUCTS:
Gl-Inet Gl Mt300n V2 Firmware,
Gl-Inet Gl Mt300n V2 Firmware,
Gl-Inet Gl Ax1800 Firmware
... (+21)
An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M...
AFFECTED_PRODUCTS:
Gl-Inet Gl Mt300n V2 Firmware,
Gl-Inet Gl Mt300n V2 Firmware,
Gl-Inet Gl Ax1800 Firmware
... (+21)
An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. Lack of access control protections allows remote attackers to arbitrarily delete the contractors from any user's account when the user ID and contractor information is known.
Insufficient authentication flow in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows attacker to use locked credentials
AFFECTED_PRODUCTS:
Checkmk Checkmk,
Checkmk Checkmk,
Checkmk Checkmk
... (+1)
Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a Denial of Service (DoS) attack against external services.
AFFECTED_PRODUCTS:
Ays-Pro Quiz Maker
A heap-use-after-free vulnerability was found in live555 version 2023.05.10 while handling the SETUP.
AFFECTED_PRODUCTS:
Live555 Live555
Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack. An unauthenticated attacker can use this vulnerability to force route pruning and therefore degrade the service availability of the Cloud Foundry deployment.
AFFECTED_PRODUCTS:
Pivotal Cloud Foundry Deployment,
Pivotal Cloud Foundry Routing Release
An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. For a Special:GlobalBlock?uselang=x-xss URI, i18n-based XSS can occur via the parentheses message. This affects subtitle links in buildSubtitleLinks.
AFFECTED_PRODUCTS:
Mediawiki Mediawiki
An issue was discovered in the Phonos extension in MediaWiki before 1.40.2. PhonosButton.js allows i18n-based XSS via the phonos-purge-needed-error message.
AFFECTED_PRODUCTS:
Mediawiki Mediawiki
An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2. XSS can occur via the Special:PageStatistics page parameter.
AFFECTED_PRODUCTS:
Mediawiki Mediawiki
Rejected reason: This CVE ID was unused by the CNA.
An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via the rev-deleted-user, pagetriage-tags-quickfilter-label, pagetriage-triage, pagetriage-filter-date-range-format-placeholder, pagetriage-fi...
AFFECTED_PRODUCTS:
Mediawiki Mediawiki,
Mediawiki Mediawiki,
Mediawiki Mediawiki
An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php.
AFFECTED_PRODUCTS:
Mediawiki Mediawiki,
Mediawiki Mediawiki,
Mediawiki Mediawiki
An issue was discovered in the CheckUser extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via message definitions. e.g., in SpecialCheckUserLog.
AFFECTED_PRODUCTS:
Mediawiki Mediawiki,
Mediawiki Mediawiki,
Mediawiki Mediawiki
An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:EventDetails page allows XSS via the x-xss language setting for internationalization (i18n).
AFFECTED_PRODUCTS:
Mediawiki Mediawiki,
Mediawiki Mediawiki,
Mediawiki Mediawiki
A vulnerability was found in Weitong Mall 1.0.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file platform-shop\src\main\resources\com\platform\dao\OrderDao.xml. The manipulation of the argument sidx/order leads to sql injection. The associated...
AFFECTED_PRODUCTS:
Fuyanglipengjun Wetong Mall
uev (aka libuev) before 2.4.1 has a buffer overflow in epoll_wait if maxevents is a large number.
AFFECTED_PRODUCTS:
Troglobit Libeuv
A vulnerability, which was classified as problematic, has been found in cloudfavorites favorites-web 1.3.0. Affected by this issue is some unknown functionality of the component Nickname Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has bee...
AFFECTED_PRODUCTS:
Favorites-Web Project Favorites Web
An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service (panic) because input_set_capability mishandles the situation in which an event code falls outside of a bitmap.
AFFECTED_PRODUCTS:
Linux Linux Kernel
In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-webrsync is used, Portage is not vulnerable.
AFFECTED_PRODUCTS:
Gentoo Portage
ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.
This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.
Version which is lower than 3.0.12011.08009(Legacy)/3.3....
AFFECTED_PRODUCTS:
Emc Elan Match On Chip Fpr Solution Firmware,
Emc Elan Match On Chip Fpr Solution Firmware