CVE-2023-32608

Directory traversal vulnerability in Pleasanter Community Edition and Enterprise Edition 1.3.39.2 and earlier versions allows a remote authenticated attacker to alter an arbitrary file on the server...

Vulnerabilities fixed in GitLab Enterprise Edition and Community Edition

GitLab has fixed vulnerabilities in GitLab Enterprise Edition EE and Community Edition CE. A malicious party could vulnerabilities to exploit attacks that can result in the following categories of damage: Denial-of-Service DoS. Manipulation of data Circumvention of security measure Accessing...

CVE-2023-32607: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting vulnerability in Pleasanter Community Edition and Enterprise Edition 1.3.39.2 and earlier versions allows a remote authenticated attacker to inject an arbitrary script...

PT-2023-8202 · Opnsense · Opnsense

Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: A directory traversal vulnerability exists in the Captive Portal templates of OPNsense, allowing attackers to execute arbitrary...

CVE-2023-34939

Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution RCE vulnerability via the component UploadProgress.ashx...

CVE-2023-34939

Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution RCE vulnerability via the component UploadProgress.ashx...

Remote code execution

Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution RCE vulnerability via the component UploadProgress.ashx...

CVE-2023-34939: Improper Limitation of a Pathname to a Restricted Directory

Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution RCE vulnerability via the component UploadProgress.ashx...

CVE-2023-34939

Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution RCE vulnerability via the component UploadProgress.ashx...

CVE-2023-34939

Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution RCE vulnerability via the component UploadProgress.ashx...

CVE-2023-34939

The CVE-2023-34939 issue affects Onlyoffice Community Server prior to v12.5.2, with a remote code execution (RCE) flaw in the UploadProgress.ashx component. The root cause is described as errors in handling the relative path to a directory with limited access, enabling an attacker to execute arbi...

CVE-2023-34939

Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution RCE vulnerability via the component UploadProgress.ashx...

JVN#97818024: Multiple vulnerabilities in Pleasanter

Pleasanter provided by Implem Inc. contains multiple vulnerabilities listed below. Stored cross-site scripting vulnerability CWE-79 - CVE-2023-32607 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N| Base Score: 5.4 CVSS v2| AV:N/AC:M/Au:S/C:N/I:P/A:N| Base...

PT-2023-4141 · Onlyoffice · Onlyoffice Community Server

Name of the Vulnerable Software and Affected Versions: Onlyoffice Community Server versions prior to 12.5.2 Description: The issue is related to a remote code execution vulnerability in the UploadProgress.ashx component. It is associated with errors in handling the relative path to a directory wi...

Missing Support for Integrity Check

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Missing Support for Integrity Check due to improper handling of authorization checks. An attacker can bypass security features and access restricted...

Incorrect Authorization

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Incorrect Authorization due to improper handling of authorization logic. An attacker can bypass security measures and access sensitive user data...

Improper Input Validation

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Input Validation through the input validation process. An attacker with administrative privileges can bypass certain security features, impacting the availability ...

Server-side Request Forgery (SSRF)

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the injection of arbitrary URLs. An admin-privilege authenticated attacker can force the application to make arbitrary requests,...

Server-side Request Forgery (SSRF)

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the injection of arbitrary URLs. An admin-privilege authenticated attacker can force the application to make...

Access Control Bypass

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Access Control Bypass due to a flaw in the security feature implementation. A low-privileged attacker could exploit this vulnerability to bypass...