Incorrect Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Incorrect Authorization through the authorization mechanism. A low-privileged attacker could access other users' data without requiring user interaction. Remediation Upgrad...

XML Injection

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to XML Injection through the XML processing mechanism. An attacker can read arbitrary files on the system by crafting malicious XML input. Remediation Upgrade...

Command Injection

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Command Injection via the command execution interface. An attacker can execute arbitrary code by injecting malicious commands into the system. This ...

CVE-2023-37860

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote unauthenticated attacker can obtain the r/w community string of the SNMPv2 daemon...

CVE-2023-37860

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote unauthenticated attacker can obtain the r/w community string of the SNMPv2 daemon...

CVE-2023-37859

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 the SNMP daemon is running with root privileges allowing a remote attacker with knowledge of the SNMPv2 r/w community string to execute system commands as root...

Exploit for Prototype Pollution in Sheetjs

POC - CVE-2023-30533 A POC for CVE-2023-30533 Copied as per:...

CVE-2023-37860

PHOENIX CONTACT WP 6xxx series web panels are affected in versions before 4.0.10. An unauthenticated remote attacker can obtain the read/write (r/w) SNMPv2 community string from the web panel, exposing SNMP credentials and potentially enabling indirect impact on device management. The issue is fi...

PT-2023-26733 · Opnsense · Opnsense Community Edition +1

Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: The issue allows for XSS via the openAction in the app/controllers/OPNsense/Cron/ItemController.php file, specifically in the...

PT-2023-26732 · Opnsense · Opnsense Community Edition +1

Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: The issue is related to the Crash Reporter component, specifically the crash reporter.php file, which mishandles input...

PT-2023-26731 · Opnsense · Opnsense Business Edition +1

Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: The issue is related to insecure permissions for configd.socket. Recommendations: For OPNsense Community Edition versions prior ...

PT-2023-26724 · Opnsense · Opnsense Community Edition +1

Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: A Cross-Site Request Forgery CSRF issue in the System Halt API at the "/system/halt" endpoint allows attackers to cause a Denial...

PT-2023-26729 · Opnsense · Opnsense Community Edition +1

Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: The issue is related to insecure permissions in the directory /tmp. Recommendations: For OPNsense Community Edition versions pri...

CVE-2023-39003

OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp...

PT-2023-26730 · Opnsense · Opnsense Community Edition +1

Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: The issue is related to insecure permissions in the configuration directory /conf/ of OPNsense, allowing attackers to access...

CVE-2023-39008

A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands...

CVE-2023-39002

A cross-site scripting XSS vulnerability in the act parameter of systemcertmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2023-39000

OPNsense Community Edition before 23.7 and OPNsense Business Edition before 23.4.2 contain a reflected XSS in /ui/diagnostics/log/core/ that allows an attacker to inject arbitrary JavaScript via the URL path. Root cause is likely improper validation/escaping of the path component. Reported impact...

CVE-2023-39002

A cross-site scripting XSS vulnerability in the act parameter of systemcertmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2023-39004

CVE-2023-39004 concerns insecure permissions in the OPNSense configuration directory (/conf/). Affected: OPNSense Community Edition prior to 23.7 and Business Edition prior to 23.4.2. Root cause: misconfigured directory permissions may allow attackers to read sensitive data (e.g., hashed root pas...