2049 matches found
CVE-2023-38883
A reflected cross-site scripting XSS vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'ajax' parameter in 'ParentLookup.php'...
CVE-2023-38880
The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality. Whenever an admin generates a database backup, the backup is stored in the web root while the file name has a format of "opensisBackup.sql" e.g...
Cross site scripting
A reflected cross-site scripting XSS vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'include' parameter in 'ForExport.php'...
Design/Logic Flaw
An Insecure Direct Object Reference IDOR vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting '/assets/studentfiles/-'...
CVE-2023-38884
CVE-2023-38884 affects the Community Edition (openSIS Classic) v9.0. The issue is an Insecure Direct Object Reference (IDOR) that allows an unauthenticated remote attacker to access any student’s files by visiting a direct file URL under /assets/studentfiles/-. The vulnerability stems from insuff...
CVE-2023-38885
OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery CSRF protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request...
PT-2023-26665 · Unknown · Opensis Classic Community Edition
Name of the Vulnerable Software and Affected Versions: OpenSIS Classic Community Edition version 9.0 Description: The issue lacks cross-site request forgery CSRF protection throughout the application, which may allow an attacker to trick an authenticated user into performing any kind of...
CVE-2023-38883
CVE-2023-38883 describes a reflected cross-site scripting (XSS) vulnerability in the Open Solutions For Education (OS4ED) openSIS Classic Community Edition v9.0 . The issue affects the web application through the parameter 'ajax' in ParentLookup.php , allowing remote attackers to cause the browse...
CVE-2023-38884
An Insecure Direct Object Reference IDOR vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting '/assets/studentfiles/-'...
Fedora 37 : frr (2023-ce436d56f8)
The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ce436d56f8 advisory. New version 8.5.3. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...
Request Smuggling org.apache.tomcat:tomcat-coyote in Confluence Data Center and Server
This High severity Third-Party Dependency vulnerability was introduced in version 7.19.0 of Confluence Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows an unauthenticated attacker t...
Security Bulletin: IBM MQ is affected by a denial-of-service vulnerability
Summary IBM MQ has addressed an error within the IBM MQ clustering logic, in which a specially crafted message could cause a denial-of-service. Vulnerability Details CVEID: CVE-2023-45177 DESCRIPTION: IBM MQ is vulnerable to a denial-of-service attack due to an error within the IBM MQ clustering...
Security Bulletin: IBM MQ is affected by a vulnerability in libcURL
Summary An issue was identified within the libcurl library that affects IBM MQ. IBM MQ uses libcurl to provide HTTPURL functionality. This is only used to download remote CCDT files and is not used to send or receive messages. Vulnerability Details CVEID: CVE-2023-38039 DESCRIPTION: cURL libcurl ...
WordPress Image vertical reel scroll slideshow Plugin <= 9.0 is vulnerable to SQL Injection
Software Image vertical reel scroll slideshow Type Plugin Vulnerable versions = 9.0 Fixed in 9.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-5428 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 370354776dcc Credits István Márton Required privilege...
Important: Red Hat Security Advisory: kernel-rt security and bug fix update
An update for kernel-rt is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...
CVE-2023-44765
A Cross Site Scripting XSS vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings...
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager (CVE-2023-35890)
Summary IBM WebSphere Application Server is used by IBM Tivoli System Automation Application Manager and could provide weaker than expected security. Required fixes for affected WebSphere Application Server has been published in the security bulletin links below. Vulnerability Details Refer to th...
Fedora: Security Advisory for golang-github-xhit-str2duration (FEDORA-2023-1b25579262)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
