TestingPlatform Input Validation Error Vulnerability

TestingPlatform is @NC3-LU's standardized testing platform for Internet security. TestingPlatform version 2.1.0 suffers from an input validation error vulnerability that stems from not properly filtering user input, which can be exploited by an attacker to create a log file in a specified locatio...

CVE-2023-39325 affecting package blobfuse2 for versions less than 2.1.1-1

CVE-2023-39325 affecting package blobfuse2 for versions less than 2.1.1-1. An upgraded version of the package is available that resolves this issue...

Path traversal

In the module "SoNice Retour" soniceretour up to version 2.1.0 from Common-Services for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a gues...

PT-2023-29539 · Unknown · Sonice Retour +1

Name of the Vulnerable Software and Affected Versions: SoNice Retour module for PrestaShop versions up to 2.1.0 Description: The issue allows a guest to download personal information without restriction by performing a path traversal attack. This is due to a lack of permissions control and a lack...

CVE-2023-5741

The POWR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'powr-powr-pack' shortcode in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2023-5741 POWR <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The POWR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'powr-powr-pack' shortcode in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress plugin POWR security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

SUSE CVE-2023-6069

Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0...

CVE-2023-6069 Improper Link Resolution Before File Access in froxlor/froxlor

Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0...

PT-2023-32495 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: froxlor versions prior to 2.1.0 Description: The issue is related to improper input validation in the GitHub repository froxlor/froxlor. This can lead to potential security risks. Recommendations: For versions prior to 2.1.0, update to versio...

Remote code execution

Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection SSTI which can be escalated to Remote Code Execution RCE. The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the...

PT-2023-29925 · Kimai · Kimai

Name of the Vulnerable Software and Affected Versions: Kimai versions prior to 2.1.0 Description: Kimai, a web-based multi-user time-tracking application, is vulnerable to a Server-Side Template Injection SSTI which can be escalated to Remote Code Execution RCE. The vulnerability arises when a...

Security Bulletin: IBM PowerVM Novalink is vulnerable because An unspecified vulnerability in Java SE related to the VM component. (CVE-2023-22045)

Summary Security Bulletin: IBM PowerVM Novalink is vulnerable because An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause low confidentiality impacts. Vulnerability Details CVEID: CVE-2023-22045 DESCRIPTION: An unspecified vulnerability in Ja...

SUSE CVE-2023-5564

Cross-site Scripting XSS - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1...

CVE-2023-5564

Cross-site Scripting XSS - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1...

CVE-2023-5564 Cross-site Scripting (XSS) - Stored in froxlor/froxlor

Cross-site Scripting XSS - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1...

CVE-2023-5564

CVE-2023-5564 describes a stored cross-site scripting (XSS) vulnerability in Froxlor/Froxlor prior to version 2.1.0-dev1. The issue arises from storing unvalidated user input, enabling script injection that could impact affected users. Multiple connected sources corroborate the store-time XSS in ...

Froxlor Cross-Site Scripting Vulnerability

Froxlor is a lightweight server management software from the Froxlor team. A cross-site scripting vulnerability exists in Froxlor versions prior to 2.1.0-dev1, which stems from vulnerability to stored cross-site scripting XSS attacks...

PT-2023-32179 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: froxlor versions prior to 2.1.0-dev1 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input without proper validation, allowing attackers to inject malicious scripts. This ca...

CVE-2022-22298

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiIsolator version 1.0.0, FortiIsolator version 1.1.0, FortiIsolator version 1.2.0 through 1.2.2, FortiIsolator version 2.0.0 through 2.0.1, FortiIsolator version 2.1.0 through 2.1.2,...