2023

Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism

PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit

A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. When pa

A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especi

fake_upload.cgi on the Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, allows unauthenticated

D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config_upl

D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_d

D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50.

D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a stack overflow vulnerability in the function update_users.

D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_downl

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the hi_up parameter in the qos_ex

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the id parameter in the yyxz.data

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the prev parameter in the H5/logi

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the popupId parameter in the H5/h

D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the fn parameter in the tgfile.as

D-Link DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the zn_jb parameter in the arp_sys.asp f

An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to esc

An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on t

An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates a

A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, r

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untr

A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assert

The ping_from parameter of ping_tracerte.cgi in the web UI of Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware vers

The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsi

Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a cu

M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to an arbitrary HTML Document craftin

Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber

Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8.

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly whe

A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context

M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerabilit

Use after free vulnerability exists in Kostac PLC Programming Software Version 1.6.11.0. Arbitrary code may be executed

Double free issue exists in Kostac PLC Programming Software Version 1.6.11.0 and earlier. Arbitrary code may be executed

A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a

Vulnerability in the RCPbind service running on UDP port (111), allowing a remote attacker to create a denial of service

The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into

The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to

An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users

An issue was discovered in Croc through 9.6.5. A sender may place ANSI or CSI escape sequences in a filename to attack t

An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable c

An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in clear

An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction.

Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, res

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insuffici

The Widget Responsive for Youtube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube' shortc

The WordPress Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wp_charts' shortcode in vers

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products

NVIDIA DGX H100 BMC contains a vulnerability in the REST service where a host user may cause as improper authentication

NVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application on