CVE-2023-7094 Netentsec NS-ASG Application Security Gateway nsasg6.0.tgz information disclosure

A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected by this vulnerability is an unknown functionality of the file /protocol/nsasg6.0.tgz. The manipulation leads to information disclosure. The attack can be launched remotely. The explo...

PT-2023-32869 · Netentsec · Netentsec Ns-Asg Application Security Gateway

Name of the Vulnerable Software and Affected Versions: Netentsec NS-ASG Application Security Gateway version 6.3 Description: A vulnerability was found in the Netentsec NS-ASG Application Security Gateway, affecting an unknown functionality of the file /protocol/nsasg6.0.tgz. This issue leads to...

Shifting from reCAPTCHA to hCaptcha

We are adding another CAPTCHA vendor and helping our customers migrate from Googles reCAPTCHA to hCaptcha. Why We Are Making This Change We continuously evaluate our security measures to ensure they align with the evolving landscape of threats. After carefully evaluating several different CAPTCHA...

SUSE SLES15 Security Update : openssl-1_1-livepatches (SUSE-SU-2023:4918-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:4918-1 advisory. Security issue fixed: - CVE-2023-5678: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very...

The vulnerability of the ProfileGrid plugin of the WordPress content management system allows attackers to perform cross-site scripting attacks.

The vulnerability of the ProfileGrid plugin in the WordPress content management system is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...

CVE-2023-50703

An attacker with network access could perform a man-in-the-middle MitM attack and capture sensitive information to gain unauthorized access to the application...

Information disclosure

An attacker with network access could perform a man-in-the-middle MitM attack and capture sensitive information to gain unauthorized access to the application...

CVE-2023-50704

EFACEC UC 500E is affected by CVE-2023-50704 (Open Redirect). Affected product: UC 500E (example 10.1.0); vulnerability arises when an attacker constructs a URL in the application that redirects to an arbitrary external domain, enabling phishing against users. Mitigation: EFACEC has released UC 5...

CVE-2023-50703 Cleartext Transmission of Sensitive Information in EFACEC UC 500E

An attacker with network access could perform a man-in-the-middle MitM attack and capture sensitive information to gain unauthorized access to the application...

CVE-2023-6689

CVE-2023-6689 affects EFACEC BCU 500 (automation/control device). The CSRF vulnerability could force state-changing requests, potentially compromising the web application when the victim is an administrative account. Public sources (CISA ICS advisory ICSA-23-353-02) outline affected product/versi...

Apache Dubbo deserialization vulnerability (CNVD-2023-10112488)

Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A deserialization vulnerability...

CVE-2023-6903

CVE-2023-6903 affects Netentsec NS-ASG Application Security Gateway 6.3.1. Affected component/path is /admin/singlelogin.php?submit=1, where manipulation of loginId enables SQL injection. The vulnerability can be exploited remotely and the exploit has been disclosed publicly. Multiple sources con...

CVE-2023-6903 Netentsec NS-ASG Application Security Gateway sql injection

A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1. This affects an unknown part of the file /admin/singlelogin.php?submit=1. The manipulation of the argument loginId leads to sql injection. It is possible to initiate the attack remotely...

web.bioucm.es Cross Site Scripting vulnerability OBB-3816039

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GO-2023-2400 Escalation of privileges in github.com/sap/cloud-security-client-go

An unauthenticated attacker can obtain arbitrary permissions within the application under certain conditions...

Bug or Feature? Hidden Web Application Vulnerabilities Uncovered

Web Application Security consists of a myriad of security controls that ensure that a web application: 1. Functions as expected. 2. Cannot be exploited to operate out of bounds. 3. Cannot initiate operations that it is not supposed to do. Web Applications have become ubiquitous after the expansio...

CVE-2023-48540

Adobe Experience Manager (AEM) 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability (CVE-2023-48540) in vulnerable form fields, enabling a low-privileged attacker to inject JavaScript that runs in a victim’s browser when visiting the page containing the field. Impa...

Design/Logic Flaw

Temporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false...

Design/Logic Flaw

Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false...

CVE-2023-49346

CVE-2023-49346 involves the Budgie Extras WeatherShow applet. The vulnerability arises from temporary data passed between application components being stored in a location accessible to any user with local access, allowing attackers to pre-create/control the file to present false information to u...