CVE-2023-37979

The CVE-2023-37979 entry maps to the Ninja Forms WordPress plugin with reflected XSS in versions

CVE-2023-37979

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Saturday Drive Ninja Forms Contact Form plugin = 3.6.25 versions...

CVE-2023-37979: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Saturday Drive Ninja Forms Contact Form plugin = 3.6.25 versions...

PT-2023-26226

Name of the Vulnerable Software and Affected Versions Saturday Drive Ninja Forms Contact Form plugin versions = 3.6.25 Description The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a...

WordPress Integrate Google Drive Plugin < 1.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Integrate Google Drive Type Plugin Vulnerable versions 1.2.3 Fixed in 1.2.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5711b66138ac Credits Rafie Muhammad Patchstack...

PT-2023-23625 · Softlab · Softlab Integrate Google Drive

Name of the Vulnerable Software and Affected Versions: SoftLab Integrate Google Drive versions n/a through 1.1.99 Description: The issue is related to a Missing Authorization vulnerability in SoftLab Integrate Google Drive, allowing exploitation of incorrectly configured access control security...

WordPress Integrate Google Drive Plugin <= 1.1.99 is vulnerable to Broken Access Control

Software Integrate Google Drive Type Plugin Vulnerable versions = 1.1.99 Fixed in 1.2.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32117 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 3ff47a38ff41 Credits Abdi Pranata Requir...

The vulnerability of the GLPI system’s request and incident handling process, related to improper input cancellation during the generation of web pages, allows attackers to carry out attacks using cross-site scripts.

The vulnerability of the GLPI system for handling requests and incidents is related to insufficient cleaning of user data in the administration panel. Users can inject and execute arbitrary HTML and scripts in the user’s browser within the context of the vulnerable website. Exploiting this...

CVE-2023-2991

Fortra Globalscape EFT's administration server suffers from an information disclosure vulnerability where the serial number of the harddrive that Globalscape is installed on can be remotely determined via a "trial extension request" message...

Multiple Vulnerabilities in Fortra Globalscape EFT Administration Server [FIXED]

!Multiple Vulnerabilities in Fortra Globalscape EFT Administration Server \FIXED\https://blog.rapid7.com/content/images/2023/06/GettyImages-1345443906.jpg Earlier this year, Rapid7 researchers undertook a project to analyze managed file transfer applications, due to the number of recent...

PT-2023-22466

Name of the Vulnerable Software and Affected Versions Fortra Globalscape EFT affected versions not specified Description The administration server of Fortra Globalscape EFT has an information disclosure issue. This allows the serial number of the hard drive where Globalscape is installed to be...

Eaton 9000X Drive Stack-Based Buffer Overflow (CVE-2018-8847)

Eaton 9000X DriveA versions 2.0.29 and prior has a stack-based buffer overflow vulnerability, which may allow remote code execution. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

CVE-2023-34105 SRS has command injection vulnerability in demonstration api-server for HTTP callback.

SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and 6.0.48, SRS's api-server server is vulnerable to a drive-by command injection. An attacker may send a request to the /api/v1/snapshots endpoint containing an...

PT-2023-24676 · Srs · Srs

Name of the Vulnerable Software and Affected Versions: SRS versions prior to 5.0.157 SRS versions prior to 5.0-b1 SRS versions prior to 6.0.48 Description: The issue concerns a drive-by command injection in the api-server server. An attacker can send a request to the "/api/v1/snapshots" endpoint...

Formula Injection vulnerability in CSV export feature

Description The admidio application is vulnerable to Formula Injection/CSV injection via the Firstname, Lastname input fields. These vulnerabilities allow unauthenticated attackers to execute arbitrary code via a a crafted excel file. Proof of Concept 1. Create a member with role Associations boa...

Brook's tproxy server is vulnerable to a drive-by command injection.

The tproxy server is vulnerable to a drive-by command injection. An attacker may fool a victim into visiting a malicious web page which will trigger requests to the local tproxy service leading to remote code execution...

GHSA-VFRJ-FV6P-3CPF Brook's tproxy server is vulnerable to a drive-by command injection.

The tproxy server is vulnerable to a drive-by command injection. An attacker may fool a victim into visiting a malicious web page which will trigger requests to the local tproxy service leading to remote code execution...

Alarming Surge in TrueBot Activity Revealed with New Delivery Vectors

A surge in TrueBot activity was observed in May 2023, cybersecurity researchers disclosed. "TrueBot is a downloader trojan botnet that uses command and control servers to collect information on compromised systems and uses that compromised system as a launching point for further attacks," VMware'...

Alarming Surge in TrueBot Activity Revealed with New Delivery Vectors

A surge in TrueBot activity was observed in May 2023, cybersecurity researchers disclosed. "TrueBot is a downloader trojan botnet that uses command and control servers to collect information on compromised systems and uses that compromised system as a launching point for further attacks," VMware'...

Command injection

Brook is a cross-platform programmable network tool. The tproxy server is vulnerable to a drive-by command injection. An attacker may fool a victim into visiting a malicious web page which will trigger requests to the local tproxy service leading to remote code execution. A patch is available in...