SUSE CVE-2022-39306

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non...

SUSE CVE-2023-0290

Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. It was possible to provide a client id of "../clients/server" to schedule the collection for the server as a server...

CVE-2022-47372 Stored cross-site scripting vulnerability in create event section

Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability by injecting XSS payloads on popular pages of a site or passing a link to a victim, tricking them into viewing the page that contains the...

CVE-2022-47372: Cross-Site Request Forgery (CSRF)

Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability by injecting XSS payloads on popular pages of a site or passing a link to a victim, tricking them into viewing the page that contains the...

CVE-2023-22804: Missing Authentication for Critical Function

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to create users on the PLC. This could allow an attacker to create and use an account with elevated privileges and take control of the device...

PT-2023-15287 · Unknown · Pandora Fms Console

Name of the Vulnerable Software and Affected Versions: Pandora FMS Console versions v766 and lower Description: A stored cross-site scripting vulnerability exists in the Create event section. An attacker can exploit this by injecting XSS payloads on popular pages or passing a link to a victim,...

PT-2023-35350 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.270 Description: The issue is related to an overflow before widen in the bitmap ip create function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2023-35084

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.1.7 Description The issue is related to an overflow before widen in the bitmap ip create function in the ipset module of the netfilter component. The actual impact and attack plausibility have not yet been...

PT-2023-35265

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.164 Description The issue is related to an overflow before widen in the bitmap ip create function in the ipset module of the netfilter component. The actual impact and attack plausibility have not yet been...

Exploit for Unrestricted Upload of File with Dangerous Type in Pwndoc_Project Pwndoc

CVE-2022-45771 The PwnDoc...

CVE-2022-46677

Wyse Management Suite 3.8 and below contain an improper access control vulnerability with which an custom group admin can create a subgroup under a group for which the admin is not authorized...

Stored DOM-based Cross-site Scripting in Tags Functionality

Description A stored, DOM-based cross-site scripting vulnerability exists in answer version 1.0.4 within the question tagging functionality. Steps Step 1. Log in. Step 2. Proceed to create a new question. Populate the Title and Body input. Step 3. Click on the Add tag button, shown in the followi...

CVE-2023-25163: Insertion of Sensitive Information into Log File

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error...

PT-2023-3787 · NetGear · Netgear Prosafe Network Management System

Name of the Vulnerable Software and Affected Versions: NETGEAR ProSAFE Network Management System affected versions not specified Description: This issue allows remote attackers to escalate privileges on affected installations. Although authentication is required to exploit this, the existing...

Dogecoin Core security vulnerability

Dogecoin is a community-driven cryptocurrency open-sourced by Dogecoin. A security vulnerability exists in Dogecoin Core 1.14.3 and earlier versions, which stems from an issue in src/wallet/wallet.cpp that can be exploited by an attacker to view sensitive information via the...

CVE-2022-25855

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

CVE-2022-25855

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

Exploit for Missing Authentication for Critical Function in Oracle E-Business_Suite

CVE-2022-21587-POC- CVE-2022-21587 POC file exploit.py w...

PT-2023-12823

Name of the Vulnerable Software and Affected Versions create-choo-app3 affected versions not specified Description The issue is related to Command Injection via the devInstall function due to improper user-input sanitization. This allows for potential exploitation. No information is provided abou...

CVE-2022-25855: Improper Neutralization of Special Elements used in an OS Command

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...