2018 matches found
CVE-2023-4672
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Talent Software ECOP allows Reflected XSS.This issue affects ECOP: before 32255...
PT-2023-32254 · WordPress · Wp Mail Log
Name of the Vulnerable Software and Affected Versions: WP Mail Log WordPress plugin versions prior to 1.1.3 Description: The issue allows attackers to upload PHP files due to improper validation of file extensions when uploading files to attach to emails, leading to remote code execution...
Blosc C-Blosc2 Security Vulnerability
Blosc C-Blosc2 is a code library from the Blosc team that enables deep compression of binary data. The goal of the software is to reduce the size of large datasets on disk or in memory, to speed up memory-bound computations, and to support BloscLZ, a compression program based on FastLZ, LZ4 and...
PT-2023-31801 · Unknown · Sandbox Accounts For Events
Name of the Vulnerable Software and Affected Versions: Sandbox Accounts for Events versions prior to 1.10.0 Description: The issue allows authenticated users to potentially read data from the events table by sending request payloads to the "events API", collecting information on planned events,...
Resque Cross-Site Scripting Vulnerability
Resque Scheduler is Resque open source a lightweight job scheduling system built on Resque . Resque version 2.1.0 before the cross-site scripting vulnerability , the vulnerability stems from easy through the queue endpoint path in the currentqueue parameter by reflective cross-site scripting XSS...
CVE-2023-38481
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in CRM Perks Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin.This issue affects Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin: from n/a before 1.3.7...
CVE-2023-46686
A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diagnostics Service to use less secure communication protocols. This issue affects: Gallagher Diagnostics Service prior to v1.3.0 distributed in 9.00.1507MR1...
Microweber Security Breach
Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in Microweber versions prior to 2.0, which stems from a...
CVE-2023-48663
Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the affected system...
EverShop Security Breach
EverShop is EverShop open source a NodeJS e-commerce platform. A security vulnerability exists in EverShop versions prior to v.1.0.0-rc.5. A remote attacker can exploit this vulnerability to obtain sensitive information from the admin panel via a specially crafted script...
PT-2023-27146 · Ericsson · Ericsson Network Manager
Name of the Vulnerable Software and Affected Versions: Ericsson Network Manager versions prior to 23.2 Description: The issue is related to mishandled Access Control, allowing unauthenticated low-privilege users to access the NCM application. Recommendations: For versions prior to 23.2, update to...
Microweber Security Breach
Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in Microweber versions prior to 2.0, which stems from a...
CVE-2023-5635
Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ArslanSoft Education Portal allows Account Footprinting. This issue affects Education Portal: before v1.1...
CVE-2023-5634
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ArslanSoft Education Portal allows SQL Injection. This issue affects Education Portal: before v1.1...
CVE-2023-5634
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ArslanSoft Education Portal allows SQL Injection.This issue affects Education Portal: before v1.1...
SUSE CVE-2023-6350
Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted avif file. Chromium security severity: High...
DEBIAN-CVE-2023-6350
Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted avif file. Chromium security severity: High...
CVE-2023-6151
Incorrect Use of Privileged APIs vulnerability in ESKOM Computer e-municipality module allows Collect Data as Provided by Users. This issue affects e-municipality module: before v.105...