PT-2023-7847 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.18 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form...

Peppermint Security Vulnerabilities

Peppermint is an open source ticket management system from Peppermint Labs. A security vulnerability exists in Peppermint Ticket Management version 0.2.4 and earlier versions. A remote attacker can exploit this vulnerability to read an arbitrary file via a...

Juzaweb CMS Injection Vulnerability

Juzaweb CMS is a content management system developed by Juzaweb Individual Developer based on the Laravel framework and Web platform. A security vulnerability exists in Juzaweb CMS v.3.4 and earlier versions, which originated from a vulnerability that allows remote attackers to execute arbitrary...

CVE-2023-46375

ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery CSRF...

CVE-2023-46375

ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery CSRF...

CVE-2023-46374

ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting XSS...

PT-2023-32350 · WordPress · Neon Text Plugin

Name of the Vulnerable Software and Affected Versions: Neon text plugin for WordPress version 1.1 and earlier Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes, specifically the color attribute, in the plugin's neontext box shortcod...

Nature Easy Soft Network Technology ZenTao Cross-Site Scripting Vulnerability

Nature Easy Soft Network Technology ZenTao is China's easy soft Tianchuang network technology Nature Easy Soft Network Technology company's open source project management software. The software includes product management, project management, quality management and document management and other...

Nature Easy Soft Network Technology ZenTao Cross-Site Scripting Vulnerability

Nature Easy Soft Network Technology ZenTao is China's easy soft Tianchuang network technology Nature Easy Soft Network Technology company's open source project management software. The software includes product management, project management, quality management and document management and other...

CVE-2023-46358

In the module "Referral and Affiliation Program" referralbyphone version 3.5.1 and before from Snegurka for PrestaShop, a guest can perform SQL injection. Method ReferralByPhoneDefaultModuleFrontController::ajaxProcessCartRuleValidate has sensitive SQL calls that can be executed with a trivial ht...

CVE-2023-45835

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Libsyn Libsyn Publisher Hub plugin = 1.4.4 versions...

PT-2023-21037 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue concerns missing authentication in the GetStudentGroupStudents method, allowing unauthenticated attackers to retrieve student and teacher data. Recommendations: For IDWeb...

PT-2023-20736 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue is related to missing authentication in the StudentPopupDetails Timetable method, allowing unauthenticated attackers to extract sensitive student data. Recommendations: For...

IDAttend IDWeb Cross-Site Scripting Vulnerability

IDAttend IDWeb is a web-based module from IDAttend, Inc. A security vulnerability exists in the IDAttend IDWeb application version 3.1.052 and prior versions that stems from a stored cross-site scripting vulnerability...

PT-2023-26181 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 3.5-milestone-1 through 14.10.7 XWiki Platform versions 15.3-rc-1 and earlier Description: Triggering the office converter with a specially crafted file name allows writing the attachment's content to an...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

...

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

...

Improper restriction of XML external entity references (XXE) in Proself

Overview Proself provided by North Grid Corporation improperly restricts XML external entity references XXE CWE-611. The developer states that attacks exploiting this vulnerability have been observed. North Grid Corporation reported this vulnerability to JPCERT/CC to notify users of its solution...

WordPress Plugin MpOperationLogs Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Geth Security Breach

Geth is a library in the Geth open source. A security vulnerability exists in Geth 1.13.4 and earlier versions that stems from allowing an attacker to cause a denial of service DOS via a specially crafted graphql query...