PT-2023-22951

Name of the Vulnerable Software and Affected Versions ihomefinder Optima Express + MarketBoost IDX Plugin plugin versions = 7.3.0 Description The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious...

CVE-2023-30749: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in ihomefinder Optima Express + MarketBoost IDX Plugin plugin = 7.3.0 versions...

Malicious code in express-opentelemetry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ed088c6b3be9fd1e7dd96d1f3411e57d0fe1af782a8b488f6222d11cbf9f725e The OpenSSF Package Analysis project identified 'express-opentelemetry' @ 99.99.9 npm as malicious. It is considered malicious because: - The...

MAL-2023-1451 Malicious code in express-opentelemetry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ed088c6b3be9fd1e7dd96d1f3411e57d0fe1af782a8b488f6222d11cbf9f725e The OpenSSF Package Analysis project identified 'express-opentelemetry' @ 99.99.9 npm as malicious. It is considered malicious because: - The...

expressvirtualassistant.com Cross Site Scripting vulnerability OBB-3552960

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of the Application Express component in the Oracle Application Express development environment allows access to data modification, addition, deletion, or partial service disruption.

The vulnerability of the Application Express development environment for Oracle Application Express is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker operating remotely to gain access to modify, add, or delete data, or cause a partial service...

The vulnerability of the Application Express component in the Oracle Application Express development environment allows a hacker to gain full control over the application.

The vulnerability of the Application Express development environment for Oracle Application Express is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain full control over the application using the HTTP protocol...

Unspecified Vulnerability in Oracle Application Expresses

Oracle Application Express is the United States Oracle Oracle, a low-code development platform. A security vulnerability exists in the Application Express Customers Plugin for Oracle Application Express, which can be exploited by an attacker to cause the Application Express Customers Plugin to be...

Unspecified Vulnerability in Oracle Application Expresses (CNVD-2023-78671)

Oracle Application Express is the United States Oracle Oracle, a low-code development platform. A security vulnerability in Application Express Administration in Oracle Application Express can be exploited by an attacker to cause unauthorized update, insertion, or deletion access to certain...

The vulnerability of the Application Express Customers Plugin component in the Oracle Application Express development environment allows a attacker to read data and modify it.

The vulnerability of the Application Express Customers Plugin component in the Oracle Application Express development environment exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify, add, or delet...

CVE-2023-29260

IBM Sterling Connect:Express for UNIX 1.5 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 252135...

CVE-2023-29259

IBM Sterling Connect:Express for UNIX 1.5 browser UI is vulnerable to attacks that rely on the use of cookies without the SameSite attribute. IBM X-Force ID: 252055...

CVE-2023-29259

IBM Sterling Connect:Express for UNIX 1.5 browser UI is vulnerable to attacks that rely on the use of cookies without the SameSite attribute. IBM X-Force ID: 252055...

CVE-2023-29260

IBM Sterling Connect:Express for UNIX 1.5 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 252135...

Code injection

IBM Sterling Connect:Express for UNIX 1.5 browser UI is vulnerable to attacks that rely on the use of cookies without the SameSite attribute. IBM X-Force ID: 252055...

CVE-2023-29260

CVE-2023-29260: IBM Sterling Connect:Express for UNIX 1.5 is vulnerable to SSRF (server-side request forgery). An authenticated attacker can trigger unauthorized requests from the affected system, potentially enabling network enumeration or other attacks. Root cause is SSRF in the server componen...

CVE-2023-29259

CVE-2023-29259 affects IBM Sterling Connect:Express for UNIX browser UI (1.5.x). The underlying issue is cookies sent without the SameSite attribute, enabling potentially cookie-based attacks. IBM bulletin lists CVSS base score 3.7 (LOW) and notes affected version 1.5.x. Remediation is to upgrade...

IBM Sterling Connect:Express for UNIX 代码问题漏洞

IBM Sterling Connect:Express for UNIX is a file transfer solution from International Business Machines IBM for the UNIX platform. A security vulnerability exists in IBM Sterling Connect Express for UNIX version 1.5 that stems from vulnerability to server-side request forgery SSRF attacks, which c...

WordPress Stripe Express Plugin <= 1.12.0 is vulnerable to Cross Site Scripting (XSS)

Software Stripe Express Type Plugin Vulnerable versions = 1.12.0 Fixed in 1.12.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 2d97e8c50280 Credits Rafie Muhammad Patchstack Required...

IBM Sterling Connect:Express for UNIX 安全漏洞

IBM Sterling Connect:Express for UNIX is a file transfer solution from International Business Machines IBM for the UNIX platform. A security vulnerability exists in IBM Sterling Connect:Express for UNIX version 1.5, which stems from the vulnerability of the browser UI to cookies...