PT-2023-28077 · Wpgens · Swifty Bar

Name of the Vulnerable Software and Affected Versions: Swifty Bar, sticky bar by WPGens plugin versions = 1.2.10 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with admin+ authentication. This allows for malicious scripts to be stored on th...

The vulnerability of the HPE Aruba Networking Virtual Intranet Access Client (VIA) VPN service, related to deficiencies in access control, allows a hacker to gain access to the interface and execute arbitrary commands with root privileges.

The vulnerability of the HPE Aruba Networking Virtual Intranet Access Client VIA VPN service is related to deficiencies in access control. Exploiting this vulnerability could allow a attacker to gain access to the underlying system and execute arbitrary commands with root privileges...

PT-2023-29465 · Real Time Automation · Real Time Automation 460 Series

Name of the Vulnerable Software and Affected Versions: Real Time Automation 460 Series products versions prior to 8.9.8 Description: The issue allows an attacker to run any JavaScript reference from the URL string, which could lead to a cross-site scripting attack. If this occurs, the gateway's...

The vulnerability of the handle_interface_acl function in Milesight UR32L router software allows a hacker to execute arbitrary code.

The vulnerability of the handleinterfaceacl function in Milesight UR32L router microprogramming software arises due to a stack-based buffer overflow. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

UBUNTU-CVE-2023-1555

An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A namespace-level banned user can access the API...

PHPValley Micro Jobs 2.0.1 Insecure Direct Object Reference

==================================================================================================================================== | Title : PHPValley Micro Jobs v2.0.1 Missing Authentication Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla...

i2soft CMS 2.0 Insecure Direct Object Reference

==================================================================================================================================== | Title : i2soft CMS v2.0 Insecure Direct Object Reference Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefo...

Cacti security breach

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool obtains data via snmpget, analyzes it using RRDtool drawing graphs, and provides data and user management features. A security vulnerability exists in Cacti versions prior to 1.2.6, which ste...

Vulnerabilities fixed in Aruba Networks ArubaOS and InstantOS

Aruba Networks has fixed vulnerabilities in ArubaOS and InstantOS. A malicious party can exploit the vulnerabilities to gain access to system data, or to execute arbitrary code execute arbitrary code with elevated privileges. Successful exploitation requires the malicious party to have access to...

CVE-2023-3638

In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application...

PT-2023-5481 · Advantech · Eki-1522 +2

Name of the Vulnerable Software and Affected Versions: Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 Description: The issue is related to a Stored Cross-Site Scripting vulnerability. This vulnerability can be triggered by authenticated users in the device name field of the...

PT-2023-25900 · Kofax · Kofax Power Pdf

Name of the Vulnerable Software and Affected Versions: Kofax Power PDF affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a maliciou...

Information disclosure

SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can lead to a leak of user information...

SSPanel UIM 安全漏洞

SSPanel UIM is a multi-purpose proxy service sales management system designed for the Shadowsocks / V2Ray / Trojan protocols by the individual developer Anankke. A security vulnerability exists in SSPanel UIM version 2023.3, which stems from not restricting access to the interface, leading to the...

Citrix ADC and Citrix Gateway Multiple Vulnerabilities (CTX477714)

The remote Citrix ADC or Citrix Gateway device is version 12.1 before 12.1-65.35, 12.1-FIPS before 12.1-55.296, 13.0 before 13.0-90.11 or 13.1 before 13.1-45.61. It is therefore affected by multiple vulnerabilities: - A cross-site scripting vulnerability affecting appliances configured as a Gatew...

Siemens SICAM P850 and SICAM P855 Authentication Bypass By Capture-Replay (CVE-2022-29878)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. Affected devices use a limited range for challenges that are sent during the unencrypted challenge-response communication. An unauthenticated attacker could capture a valid challenge-response pair...

PT-2023-19355 · WordPress · Winwar Media Inline Tweet Sharer – Twitter Sharing Plugin

Name of the Vulnerable Software and Affected Versions: Winwar Media Inline Tweet Sharer – Twitter Sharing Plugin plugin versions = 2.5.3 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inje...

Design/Logic Flaw

An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid information disclosure via an invalid authentication attempt. This can afterwards be used to bypass the device's authentication and get access to the administrative interface...

PT-2023-18591 · Securepoint · Securepoint Utm

Name of the Vulnerable Software and Affected Versions: SecurePoint UTM versions prior to 12.2.5.1 Description: An issue was discovered in the firewall's endpoint at "/spcgi.cgi" that allows sessionid information disclosure via an invalid authentication attempt. This can be used to bypass the...

Siemens SCALANCE W1750D Cryptographic Issues (CVE-2017-13099)

wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application. This vulnerability is referred to as ROBOT. This plugin only works with Tenable.ot...