CVE-2023-24470

ArcSight Logger prior to version 7.3.0 is vulnerable to XML External Entity (XXE) injection (CVE-2023-24470). The root cause is XXE in the product’s XML processing, enabling an attacker to potentially access or exfiltrate data via crafted XML. Public advisories confirm fixes in ArcSight Logger 7....

CVE-2023-24469

Potential Cross-Site Scripting in ArcSight Logger versions prior to 7.3.0...

CVE-2023-24470

Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0...

PT-2023-19627 · Micro Focus · Arcsight Logger

Name of the Vulnerable Software and Affected Versions: ArcSight Logger versions prior to 7.3.0 Description: The issue is related to a Potential XML External Entity Injection. Recommendations: For versions prior to 7.3.0, update to version 7.3.0 or later to resolve the issue...

PT-2023-19625 · Micro Focus · Arcsight Logger

Name of the Vulnerable Software and Affected Versions: ArcSight Logger versions prior to 7.3.0 Description: The issue is related to Potential Cross-Site Scripting. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this...

CVE-2023-24469: Improper Neutralization of Input During Web Page Generation

Potential Cross-Site Scripting in ArcSight Logger versions prior to 7.3.0...

CVE-2023-24470: Improper Restriction of XML External Entity Reference

Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0...

WordPress Lana Email Logger Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Lana Email Logger Type Plugin Vulnerable versions = 1.0.2 Fixed in 1.1.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3166 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 87d6e5f60784 Credits Alex Thomas Required...

Chrome Logger Information Disclosure

Chrome Logger is a Google Chrome extension used to debug server side applications in the Chrome console. By installing the extension in their Chrome browser and a server-side library on their application, developers can retrieve the configured debug information directly in Chrome. As Chrome Logge...

Malicious Package

Overview nf-cl-logger is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

MAL-2023-1217 Malicious code in javascript-appfabric-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9f8b7cd0cdd29ede135536b1e9ca802d8bfd2343e149fb7fd4ff7de38a4d1813 The OpenSSF Package Analysis project identified 'javascript-appfabric-logger' @ 966.0.0 npm as malicious. It is considered malicious because: -...

Malicious code in javascript-appfabric-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9f8b7cd0cdd29ede135536b1e9ca802d8bfd2343e149fb7fd4ff7de38a4d1813 The OpenSSF Package Analysis project identified 'javascript-appfabric-logger' @ 966.0.0 npm as malicious. It is considered malicious because: -...

SQL injection in some Admin Sort functions

Description SQL injection due to unsanitized concatenating strings into ORDER BY clause, 'sort' parameter Proof of Concept Log in as an admin, go to Admin Translations or Application Logger functions, and perform a sort action Observer the request on Burpsuite and injection point is the 'sort'...

CVE-2023-27387

Cross-site request forgery CSRF in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to conduct an arbitrary operation by having a logged-in user view a malicious page. Affected products and versions are as follows: T&D Corporation data logger...

CVE-2023-27387

Cross-site request forgery CSRF in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to conduct an arbitrary operation by having a logged-in user view a malicious page. Affected products and versions are as follows: T&D Corporation data logger...

CVE-2023-27388

Improper authentication vulnerability in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to login to the product as a registered user. Affected products and versions are as follows: T&D Corporation data logger products TR-71W/72W all firmware...

CVE-2023-22654

Client-side enforcement of server-side security issue exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may lead to an arbitrary script execution on a logged-in user's web browser. Affected products and versions are as follows: T&D Corporation data logger products TR-71W/7...

CVE-2023-23545

Missing authentication for critical function exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may allow a remote unauthenticated attacker to alter the product settings without authentication. Affected products and versions are as follows: T&D Corporation data logger...

Authentication flaw

Missing authentication for critical function exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may allow a remote unauthenticated attacker to alter the product settings without authentication. Affected products and versions are as follows: T&D Corporation data logger...

Cross site request forgery (csrf)

Cross-site request forgery CSRF in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to conduct an arbitrary operation by having a logged-in user view a malicious page. Affected products and versions are as follows: T&D Corporation data logger...