15469 matches found
CVE-2023-4122 Student Information System v1.0 - Insecure File Upload
Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application...
Student Information System Code Issue Vulnerability
Student Information System is a web-based application platform by Carlo Montero, a personal developer. It can help a university or college to manage student information and academic records. A code issue vulnerability exists in Student Information System v1.0 that stems from vulnerability to an...
CVE-2023-45210
Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticated attacker to view the temporary files uploaded by other users who are not permitted to access...
CVE-2023-45210
Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticated attacker to view the temporary files uploaded by other users who are not permitted to access...
CVE-2023-22522
This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution RCE on an affected instance. Publicly accessible Confluence Da...
PT-2023-29460 · Unknown · Pleasanter
Name of the Vulnerable Software and Affected Versions: Pleasanter versions 1.3.47.0 and earlier Description: The issue is related to improper access control, which may allow a remote authenticated attacker to view temporary files uploaded by other users who are not permitted to access...
Atlassian Confluence 4.x < 7.19.17 Template Injection
According to its self-reported version number, the Atlassian Confluence application running on the remote host is 4.x prior to 7.19.17, 8.x prior to 8.4.5, 8.5.x prior to 8.5.4, 8.6.x prior to 8.6.2 or 8.7.x prior to 8.7.1. It is, therefore, affected by a template injection vulnerability which...
Atlassian Confluence 8.6.x < 8.6.2 Template Injection
According to its self-reported version number, the Atlassian Confluence application running on the remote host is 4.x prior to 7.19.17, 8.x prior to 8.4.5, 8.5.x prior to 8.5.4, 8.6.x prior to 8.6.2 or 8.7.x prior to 8.7.1. It is, therefore, affected by a template injection vulnerability which...
Atlassian Confluence 8.7.x < 8.7.1 Template Injection
According to its self-reported version number, the Atlassian Confluence application running on the remote host is 4.x prior to 7.19.17, 8.x prior to 8.4.5, 8.5.x prior to 8.5.4, 8.6.x prior to 8.6.2 or 8.7.x prior to 8.7.1. It is, therefore, affected by a template injection vulnerability which...
Atlassian Confluence 8.x < 8.4.5 Template Injection
According to its self-reported version number, the Atlassian Confluence application running on the remote host is 4.x prior to 7.19.17, 8.x prior to 8.4.5, 8.5.x prior to 8.5.4, 8.6.x prior to 8.6.2 or 8.7.x prior to 8.7.1. It is, therefore, affected by a template injection vulnerability which...
RCE (Remote Code Execution) in Confluence Data Center and Server
This High severity RCE Remote Code Execution vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to...
CVE-2023-44221
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a ‘nobody’ user, potentially leading to OS Command Injection Vulnerability. Recent assessments: Assessed...
SonicWall SSL-VPN SMA100 Version 10.x Is Affected By Multiple Vulnerabilities
1 CVE-2023-44221 - Post Authentication OS Command Injection VulnerabilityImproper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading...
Security Bulletin: Multiple Linux Kernel vulnerabilities may affect IBM Elastic Storage System
Summary There are some vulnerabilities in the Linux kernel, used by IBM Elastic Storage System, which could allow a denial of service. Fixes for these vulnerabilities are available. Vulnerability Details CVEID:CVE-2023-32233 DESCRIPTION: Linux Kernel could allow a local authenticated attacker to...
CVE-2023-6449 Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload
The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7antiscriptfilename' function in versions up to, and including, 5.8.3. This makes it possible for...
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues
Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues. IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data has migrated to a new base image for the Operators used by our Speech Services. The following vulnerabilities...
CVE-2023-34390
An input validation vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote authenticated attacker to create a denial of service against the system and locking out services. See product Instruction Manual Appendix A dated 20230830 for more details...
CVE-2023-34389
An allocation of resources without limits or throttling vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote authenticated attacker to make the system unavailable for an indefinite amount of time. See product Instruction Manual Appendix A dated 20230830 for more...
