PT-2023-31868 · Hertzbeat · Hertzbeat

Name of the Vulnerable Software and Affected Versions: Hertzbeat versions prior to 1.4.1 Description: Hertzbeat is an open source, real-time monitoring system. Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces, potentially resulting in the...

Hertzbeat Code Injection Vulnerability

Hertzbeat is an open source real-time monitoring system from the dromara organization. A code injection vulnerability exists in Hertzbeat versions prior to 1.4.1, which stems from the presence of a code injection vulnerability. An attacker can exploit this vulnerability to execute any command on...

PT-2023-31802 · Hertzbeat · Hertzbeat

Name of the Vulnerable Software and Affected Versions: Hertzbeat versions prior to 1.4.1 Description: Hertzbeat is an open-source, real-time monitoring system that uses aviatorscript to evaluate alert expressions. Due to improper sanitization for alert expressions, a malicious user can use a...

VulnCheck KEV: CVE-2021-29441

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication -Dnacos.core.auth.enabled=true Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor...

CVE-2023-5942 Medialist < 1.4.1 - Contributor+ Stored XSS

The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress plugin Medialist security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...

CVE-2023-44397

CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller with path starting with matching/API/, which can cause a permission bypass. Version 1.4.1 contains a patch for this issue...

Design/Logic Flaw

CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller with path starting with matching/API/, which can cause a permission bypass. Version 1.4.1 contains a patch for this issue...

CVE-2023-44397

CloudExplorer Lite (prior to v1.4.1) contains a permission bypass in its gateway filter. The issue is caused by a controller handling paths that start with matching/API/, enabling bypass of access controls. The CVE-2023-44397 entry notes a fix in v1.4.1. CVSS data indicates a high impact (possibl...

CVE-2023-44397 CloudExplorer Lite permission bypass vulnerability

CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller with path starting with matching/API/, which can cause a permission bypass. Version 1.4.1 contains a patch for this issue...

CVE-2023-44397 CloudExplorer Lite permission bypass vulnerability

CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller with path starting with matching/API/, which can cause a permission bypass. Version 1.4.1 contains a patch for this issue...

CVE-2023-44397 CloudExplorer Lite permission bypass vulnerability

CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller with path starting with matching/API/, which can cause a permission bypass. Version 1.4.1 contains a patch for this issue...

CloudExplorer Lite License Issue Vulnerability

CloudExplorer Lite is CloudExplorer's platform that provides out-of-the-box basic functionality for cloud hosting management, cloud billing, operational analytics, and security compliance, as well as powerful extensibility to meet the customization needs of enterprises. An authorization issue...

PT-2023-29230 · Unknown · Cloudexplorer Lite

Name of the Vulnerable Software and Affected Versions: CloudExplorer Lite versions prior to 1.4.1 Description: The issue concerns a permission bypass in CloudExplorer Lite, an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter uses a controller with a...

Cross site scripting

A stored cross-site scripting XSS vulnerability in /settings/index.php of Black Cat CMS 1.4.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website header parameter...

PT-2023-29080 · Unknown · Blackcat Cms

Name of the Vulnerable Software and Affected Versions: Black Cat CMS version 1.4.1 Description: A cross-site scripting XSS vulnerability exists in Black Cat CMS, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload. This issue is present in two locations: the...

CVE-2023-42798

AutomataCI is exposed to a release-job issue in 1.4.1 and earlier where the release job can reset the repo root to the very first commit. A fix exists in version 1.5.0. The recommended workaround is to ensure the PROJECT_PATH_RELEASE (e.g., releases/) directory is manually and actually git-cloned...

CVE-2023-42798 AutomataCI Release Job Can Revert Repo to First Commit

AutomataCI is a template git repository equipped with a native built-in semi-autonomous CI tools. An issue in versions 1.4.1 and below can let a release job reset the git root repository to the first commit. Version 1.5.0 has a patch for this issue. As a workaround, make sure the PROJECTPATHRELEA...

PT-2023-28585 · Unknown · Automataci

Name of the Vulnerable Software and Affected Versions: AutomataCI versions 1.4.1 and below Description: An issue in AutomataCI can let a release job reset the git root repository to the first commit. This is a concern for versions prior to 1.5.0. To mitigate this, ensure the PROJECT PATH RELEASE...

AutomataCI Input Validation Error Vulnerability

AutomataCI is a template git repository by the individual developer HollowayKeanHo. An input validation error vulnerability exists in AutomataCI 1.4.1 and earlier versions, which stems from allowing the release job function to reset the git root repository...