CVE-2023-4803

A reflected cross-site scripting vulnerability in the WriteWindowTitle endpoint of the Insider Threat Management ITM Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to 7.14.3.69...

CVE-2023-4802

A reflected cross-site scripting vulnerability in the UpdateInstalledSoftware endpoint of the Insider Threat Management ITM Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to...

Cross site scripting

A reflected cross-site scripting vulnerability in the UpdateInstalledSoftware endpoint of the Insider Threat Management ITM Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to...

PT-2023-30675 · Unknown · Itm Server

Name of the Vulnerable Software and Affected Versions: Insider Threat Management ITM Server versions prior to 7.14.3.69 Description: A reflected cross-site scripting issue in the "WriteWindowTitle" endpoint of the ITM Server's web console could allow an authenticated administrator to execute...

Delinea Secret Server Security Vulnerability

Delinea Secret Server is a powerful PAM in the cloud or locally from Delinea USA. A security vulnerability exists in Delinea Secret Server versions v10.9.000002 and v11.4.000002, which originates from allowing an authenticated user with administrative privileges to create a backup file in the...

CVE-2023-24412

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Web-Settler Image Social Feed plugin = 1.7.6 versions...

CVE-2023-3252

An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges could alter logging variables to overwrite arbitrary files on the remote host with log data, which could lead to a denial of service condition...

PT-2023-8513 · Qnap · Quts Hero +2

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 5.1.2.2533 build 20230926 QuTS hero versions prior to h5.1.2.2534 build 20230927 QuTScloud versions prior to c5.1.5.2651 Description: A buffer copy without checking the size of input vulnerability has been reported to...

PT-2023-8514 · Qnap · Quts Hero +2

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 5.1.2.2533 build 20230926 QuTS hero versions prior to h5.1.2.2534 build 20230927 QuTScloud versions prior to c5.1.5.2651 Description: A NULL pointer dereference issue has been reported to affect QNAP operating system...

PT-2023-7251 · Zyxel · Zyxel Usg Flex Series +3

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series version 5.37 Zyxel USG FLEX series version 5.37 Zyxel USG FLEX 50W series version 5.37 Zyxel USG20W-VPN series version 5.37 Description: A buffer overflow issue in the firmware could allow an authenticated local attacker with...

CVE-2023-30749

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in ihomefinder Optima Express + MarketBoost IDX Plugin plugin = 7.3.0 versions...

PT-2023-7520 · Aleos · Aleos

Name of the Vulnerable Software and Affected Versions: ALEOS versions 4.16 and earlier Description: The issue is related to the ACEManager component of the ALEOS operating system, which does not properly validate file names in a file upload field. This can lead to a Stored Cross-Site Scripting...

Format string

An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not checking the correct file format. Every subsequent application request will return an error. The whole application in rendered unusable until a console intervention...

CVE-2023-23903 DoS via SAML configuration in Guardian/CMC before 22.6.2

An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not checking the correct file format. Every subsequent application request will return an error. The whole application in rendered unusable until a console intervention...

Nozomi Networks Guardian Cross-Site Scripting Vulnerability

Nozomi Networks Guardian is an IoT device and software inspection system from Nozomi Networks, USA. Nozomi Networks Guardian suffers from a cross-site scripting vulnerability that originates from an authenticated attacker with administrator access who can inject malicious JavaScript code into the...

Nozomi Networks Guardian Security Breach

Nozomi Networks Guardian is an IoT device and software inspection system from Nozomi Networks, USA. Nozomi Networks Guardian suffers from a security vulnerability that originates from an authenticated administrator being able to upload an incorrectly formatted SAML configuration file without the...

CVE-2023-35081

A path traversal vulnerability in Ivanti EPMM versions 11.10.x 11.10.0.3, 11.9.x 11.9.1.2 and 11.8.x 11.8.1.2 allows an authenticated administrator to write arbitrary files onto the appliance...

CVE-2023-35081

Ivanti Endpoint Manager Mobile (EPMM) is affected by CVE-2023-35081, a path traversal vulnerability that allows an authenticated administrator to write arbitrary files to the appliance. The issue impacts EPMM versions 11.10.x prior to 11.10.0.3, 11.9.x prior to 11.9.1.2, and 11.8.x prior to 11.8....

Ivanti EPMM Path Traversal Vulnerability

Ivanti EPMM is a mobile management software engine from Ivanti Corporation. A path traversal vulnerability exists in Ivanti EPMM versions prior to 11.10.0.3, prior to 11.9.1.2, and prior to 11.8.1.2, which could allow an authenticated administrator to write arbitrary files to the device...

CVE-2023-35081

A path traversal vulnerability in Ivanti EPMM versions 11.10.x 11.10.0.3, 11.9.x 11.9.1.2 and 11.8.x 11.8.1.2 allows an authenticated administrator to write arbitrary files onto the appliance. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...