CVE-2023-22939

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘map’ search processing language SPL command lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and only affects instances with...

CVE-2023-22939

The CVE-2023-22939 vulnerability affects Splunk Enterprise versions prior to 8.1.13, 8.2.10, and 9.0.4. It involves the map SPL command that lets a search bypass safeguards for risky commands, requiring a higher-privileged user to initiate a request from a user’s browser and only impacting instan...

CVE-2023-24524

SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to delete the data with a high impact to availability...

CVE-2023-24524

CVE-2023-24524 affects SAP S/4HANA Map Treasury Correspondence Format Data. The accompanying documents describe an missing authorization check for authenticated users, enabling privilege escalation and potential data deletion with high availability impact. The core issue is an authorization gap i...

PT-2023-18782 · Splunk · Splunk Enterprise

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 8.1.13 Splunk Enterprise versions prior to 8.2.10 Splunk Enterprise versions prior to 9.0.4 Description: The issue allows a search to bypass safeguards for risky commands using the map search processing...

PT-2023-4439

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 110 Description The issue is related to the gfx::SourceSurfaceSkia::Map function, where the return value was not being verified, potentially leading to a null pointer dereference. This could allow a remote attacker to...

CVE-2023-24524: Missing Authorization

SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to delete the data with a high impact to availability...

WordPress Interactive SVG Image Map Builder Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Interactive SVG Image Map Builder Type Plugin Vulnerable versions = 1.0 Fixed in 1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25704 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9e6397036265 Credits Lokesh...

Interactive SVG Image Map Builder < 1.1 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-22939: Improper Input Validation

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘map’ search processing language SPL command lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and only affects instances with...

SAP S/4 HANA 安全漏洞

SAP S/4 HANA is an intelligent, integrated ERP software for large enterprises from SAP, Germany. A security vulnerability exists in SAP S/4 HANA Map Treasury Correspondence Format Data, which stems from a lack of authorization checks for users. An attacker could exploit the vulnerability to eleva...

GSD-2023-1002230 misc: fastrpc: Don't remove map on creater_process and device_release

misc: fastrpc: Don't remove map on createrprocess and devicerelease This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.230 by commit...

GSD-2023-1002173 misc: fastrpc: Don't remove map on creater_process and device_release

misc: fastrpc: Don't remove map on createrprocess and devicerelease This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.165 by commit...

GSD-2023-1001971 misc: fastrpc: Don't remove map on creater_process and device_release

misc: fastrpc: Don't remove map on createrprocess and devicerelease This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.8 by commit...

PT-2023-35092

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.1.7 Description The issue is related to an incorrect file map count for invalid pmd in the arm64/mm component. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kern...

sandbox.memoria.map.cnrs.fr Cross Site Scripting vulnerability OBB-3187346

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-3794 · NetGear · Netgear Prosafe Network Management System

Name of the Vulnerable Software and Affected Versions: NETGEAR ProSAFE Network Management System versions affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue,...

CVE-2023-0146

The Naver Map WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0146

The Naver Map WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Cross site scripting

The Naver Map WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...