CVE-2023-25841

There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s...

Microsoft Windows Multiple Vulnerabilities (KB5023706)

This host is missing an important security update according to Microsoft KB5023706 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Adobe ColdFusion < 2018.x < 2018u19 / 2021.x < 2021u9 / 2023.x < 2023u3 Multiple Vulnerabilities (APSB23-47)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2018.x update 19, 2021.x update 9, or 2023.x update 3. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB23-47 advisory. - Deserialization of Untrusted Data CWE-502 potentially leading t...

PT-2023-20348 · Esri · Esri Arcgis Server

Name of the Vulnerable Software and Affected Versions: Esri ArcGIS Server versions 10.8.1 through 11.0 Description: There is a stored Cross-site Scripting issue that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary...

CVE-2023-38334

Omnis Studio 10.22.00 has incorrect access control. It advertises an irreversible feature for locking classes within Omnis libraries: it should be no longer possible to delete, view, change, copy, rename, duplicate, or print a locked class. Due to implementation issues, locked classes in Omnis...

VulnCheck KEV: CVE-2023-38205

Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass...

Adobe ColdFusion Improper Access Control Vulnerability

Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass...

Adobe ColdFusion Improper Access Control Vulnerability

Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass...

SUSE-SU-2023:2886-1 Security update for MozillaFirefox, MozillaFirefox-branding-SLE

This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues: Changes in MozillaFirefox and MozillaFirefox-branding-SLE: This update provides Firefox Extended Support Release 115.0 ESR New: - Required fields are now highlighted in PDF forms. - Improved performance on...

CVE-2023-3753

A vulnerability classified as problematic has been found in Creativeitem Mastery LMS 1.2. This affects an unknown part of the file /browse. The manipulation of the argument search/featured/recommended/skill leads to cross site scripting. It is possible to initiate the attack remotely. The...

SUSE CVE-2023-37259

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting XSS. Since the Export Chat feature...

Chipsa CMS 1.0.2 Cross Site Scripting

==================================================================================================================================== | Title : Chipsa CMS v1.0.2 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 63.0.3 32-bit | | Vendor ...

Important: nodejs

Issue Overview: The use of proto in process.mainModule.proto.require can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please no...

PT-2023-3666

Name of the Vulnerable Software and Affected Versions OpenSSH versions 7.9p1-alt4.gost.p10.1, 7.9p1-alt4.p10.6, 9.6p1-alt1.gost, 9.6p1-alt2.gost Description OpenSSH contains a vulnerability where the ssh-agent component incorrectly handles loading certain PKCS11 providers. This can allow a remote...

PimpMyLog v1.7.14 - Improper access control Exploit

Exploit Title: PimpMyLog v1.7.14 - Improper access control Exploit Author: thoughtfault Vendor Homepage: https://www.pimpmylog.com/ Software Link: https://github.com/potsky/PimpMyLog Version: 1.5.2-1.7.14 Tested on: Ubuntu 22.04 CVE : N/A Description: PimpMyLog suffers from improper access contro...

Microsoft Windows Multiple Vulnerabilities (KB5026368)

This host is missing an important security update according to Microsoft KB5026368 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

APSB23-47 : Security update available for Adobe ColdFusion

Adobe has released security updates for ColdFusion versions 2023, 2021 and 2018. These updates resolve critical and moderate vulnerabilities that could lead to arbitrary code execution and security feature bypass...

Weintek Weincloud 授权问题漏洞

Weintek Weincloud is a cloud-based monitoring platform from Weintek, Inc. An authorization issue vulnerability exists in Weintek Weincloud version v0.13.6, which stems from a vulnerability that could allow an attacker to abuse the registration feature and log in to the official website using test...

Path traversal

An executable used in Rockwell Automation ThinManager ThinServer can be configured to enable an API feature in the HTTPS Server Settings. This feature is disabled by default. When the API is enabled and handling requests, a path traversal vulnerability exists that allows a remote actor to leverag...

matrix-react-sdk vulnerable to XSS in Export Chat feature

Description The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored XSS. Impact Since the Export Chat feature generates a separate document, an attacker can only inject code run from the null origin, restrictin...