Debian: Security Advisory (DLA-3592-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 39 Update: plantuml-1.2023.11-1.fc39

PlantUML is a program allowing to draw UML diagrams, using a simple and human readable text description. It is extremely useful for code documenting, sketching project architecture during team conversations and so on. PlantUML supports the following diagram types - sequence diagram - use case...

CVE-2023-43732

Os Commerce is currently susceptible to a Cross-Site Scripting XSS vulnerability. This vulnerability allows attackers to inject JS through the "taxclasstitle" parameter, potentially leading to unauthorized execution of scripts within a user's web browser...

PT-2023-28953 · Unknown · Oscommerce

Name of the Vulnerable Software and Affected Versions: Os Commerce affected versions not specified Description: The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to inject JavaScript through the tax class title parameter. This could potentially lead to unauthorized...

Engineers Online Portal SQL Injection Vulnerability

Engineers Online Portal is open source an online portal . It is developed using PHP, MySQL database, HTML, CSS, Javascript, jQuery, Ajax, Bootstrap and some other libraries. Engineers Online Portal suffers from a SQL injection vulnerability that stems from the fact that manipulation of the...

Incorrect Authorization in User role

Description Incorrect Authorization in User role Proof of Concept 1 .Default, administrator User ID =1 cannot add user roles 2 .Remove the "disable" class at Inspect 3 .After that, add the user role success Video Poc https://drive.google.com/file/d/1vQPHZwaghByHsqEgQI9p3EiGeVCTbLK7/view?usp=shari...

PT-2023-6719 · Ilias · Ilias

Name of the Vulnerable Software and Affected Versions: ILIAS version 7.25 Description: The issue is related to the exec function in the execQuoted method of the ilUtil class, which lacks input sanitization. This allows attackers to inject malicious commands into the system, potentially compromisi...

Weaver Xtreme Theme Support < 6.3.1 - Admin+ PHP Object Injection

Description The plugin unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog. PoC To simulate a gadget chain, put the following code in a plugin: class Te...

PT-2023-36019 · Icu · Icu

Name of the Vulnerable Software and Affected Versions: icu 74 affected versions not specified Description: The issue is related to a heap-buffer-overflow read error. Technical details about the crash indicate it occurs in the icu 74::SimpleDateFormat class, specifically in the subFormat, format,...

The vulnerability of the ProjectInstance class in the Microsoft Exchange Server mail server allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the ProjectInstance class in Microsoft Exchange Server involves deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

The vulnerability of the in_class_node function in the microprogramming system of the Milesight UR32L router allows a hacker to execute arbitrary code.

The vulnerability of the inclassnode function in the Milesight UR32L router’s microprogramming system arises due to a stack-based buffer overflow. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

Stored XSS at LOGO+USER menu

Description Please enter a description of the vulnerability. Proof of Concept login with admin account visit https://demo.instantcms.io/admin/widgets?templatename=modern&scrollto=row-14 navigate to logo+user menu tab insert payload 1" onmouseover = "alert'hackedbytisha' at Parent row Tag CSS clas...

GHSA-CGWF-W82Q-5JRR Apache Commons Compress denial of service vulnerability

Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to upgrade to version 1.24.0, which fixes the issue. A third party can create a malformed...

Input validation

Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to upgrade to version 1.24.0, which fixes the issue. A third party can create a malformed...

CVE-2023-42503 Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file

Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to upgrade to version 1.24.0, which fixes the issue. A third party can create a malformed...

SUSE CVE-2023-4921

A use-after-free vulnerability in the Linux kernel's net/sched: schqfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfqdequeue due to the incorrect .peek handler of...

CVE-2023-2071

Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve remote code executed via crafted malicious packets. The device has the functionality, through a CIP class, to execute exported functions...

Design/Logic Flaw

Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve remote code executed via crafted malicious packets. The device has the functionality, through a CIP class, to execute exported functions...

CVE-2023-2071 FactoryTalk View Machine Edition Vulnerable to Remote Code Execution

Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve remote code executed via crafted malicious packets. The device has the functionality, through a CIP class, to execute exported functions...

CVE-2023-2071: Improper Input Validation

Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve remote code executed via crafted malicious packets. The device has the functionality, through a CIP class, to execute exported functions...