PT-2023-18456 · Unknown · Skybridge Mb-A100/110

Name of the Vulnerable Software and Affected Versions: SkyBridge MB-A100/110 firmware versions 4.2.0 and earlier Description: The issue is related to improper privilege management, allowing a remote authenticated attacker to alter the WebUI password of the product. This can be exploited by an...

CVE-2023-28125

An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attacker to gain access to the server by registering to receive messages from the server and perform an authentication bypass...

CVE-2023-28128

An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution...

CVE-2023-25831

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser...

mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

mysql: InnoDB unspecified vulnerability (CPU Jan 2023)

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of thi...

PT-2023-2734 · Adobe · Substance3D - Painter

Name of the Vulnerable Software and Affected Versions: Adobe Substance 3D Painter versions 8.3.0 and earlier Description: The issue is related to a Stack-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires use...

WordPress plugin Product Specifications for Woocommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Ivanti Avalanche 代码问题漏洞

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A code issue vulnerability exists in Ivanti Avalanche version 6.3.x and prior versions, which stems from a failure ...

PT-2023-22513 · Imgproxy · Imgproxy

Name of the Vulnerable Software and Affected Versions: imgproxy versions 3.14.0 and earlier imgproxy prior to version 3.15.0 Description: The issue is related to Server-Side Request Forgery SSRF due to a lack of sanitization of the imageURL parameter. This allows for potential exploitation...

PT-2023-16393 · WordPress · Sloth Logo Customizer

Name of the Vulnerable Software and Affected Versions: Sloth Logo Customizer WordPress plugin versions prior to 2.0.3 Description: The issue concerns a lack of CSRF check when updating settings, as well as missing sanitization and escaping. This could allow attackers to make logged-in admins add...

WordPress plugin Cloud Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

Advantech 缓冲区错误漏洞

Advantech, a China-based Advantech company, provides intelligent electric bus management systems for applications. A security vulnerability exists in Advantech EKI-1524, EKI-1522, EKI-1521 version 1.21 and prior versions, which stems from the discovery of a vulnerability containing a buffer...

Advantech 命令注入漏洞

Advantech, a China-based Advantech application, provides intelligent electric bus management systems. A security vulnerability exists in Advantech EKI-1524, EKI-1522, EKI-1521 version 1.21 and prior versions, which stems from the discovery of a command injection vulnerability included...

CVE-2023-25977

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in 9seeds.Com CPT – Speakers plugin = 1.1 versions...

PT-2023-22623 · Prestashop · Prestashop Scexportcustomers

Name of the Vulnerable Software and Affected Versions: PrestaShop scexportcustomers versions 3.6.1 and earlier Description: The issue is related to Incorrect Access Control due to a lack of permissions control. This allows a guest to access exports from the module, potentially leading to a leak o...

WordPress plugin Sticky Ad Bar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin FireCask Like & Share Button 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

FunAdmin 跨站脚本漏洞

FunAdmin is FunAdmin open source based on ThinkPHP6+Layui development of a lightweight high-profile backend development system . FunAdmin version 3.2.3 and previous versions of cross-site scripting vulnerability , the vulnerability stems from the wrong operation of the parameter file leads to...

SUSE CVE-2023-26938

REJECT DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2019-9587. Reason: This record is a reservation duplicate of CVE-2019-9587. Notes: All CVE users should reference CVE-2019-9587 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...