Oracle VM VirtualBox 安全漏洞

A security vulnerability exists in Oracle VM VirtualBox, a virtual machine management software from Oracle Corporation. A low privilege attacker can compromise Oracle VM VirtualBox by logging into the infrastructure where Oracle VM VirtualBox is executing...

Oracle Business Intelligence Enterprise Edition 安全漏洞

Oracle Business Intelligence Enterprise Edition is an intelligent business analytics software from Oracle. Visualize and analyze enterprise data to support decision-making, reduce total cost of ownership, and improve ROI across the organization. A security vulnerability exists in Oracle Business...

PT-2023-14797 · Opentext · Opentext Content Suite Platform

Name of the Vulnerable Software and Affected Versions: OpenText Content Suite Platform version 16.2.19.1803 Description: An issue was discovered that allows a low-privilege user to delete arbitrary files on the server's local filesystem through the "itemtemplate.createtemplate2" endpoint...

PT-2023-16105 · Unknown · Velociraptor

Name of the Vulnerable Software and Affected Versions: Velociraptor versions prior to 0.6.7-5 Description: The issue allows a low privilege user to overwrite files on the server, including Velociraptor configuration files, due to the VQL copy function not checking for permission to write files. T...

Oracle Business Intelligence Enterprise Edition has an unspecified vulnerability (CNVD-2023-05499)

Oracle Business Intelligence Enterprise Edition is an intelligent business analytics software from Oracle Corporation USA. Oracle Business Intelligence Enterprise Edition is a security vulnerability that can be exploited by a low-privilege attacker to compromise Oracle Business Intelligence...

VulnCheck KEV: CVE-2021-24164

In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wpajaxnfoauth, and retrieve the connection url needed to establish a connection. They could also retrieve the clientid for an already established OAuth...

Oracle Global Lifecycle Management 安全漏洞

Oracle Global Lifecycle Management is a database lifecycle management solution for Oracle Enterprise Manager from Oracle Corporation that automates time-consuming tasks related to discovery, initial provisioning and cloning, patching, configuration management, continuous change management, and...

CVE-2022-45926

An issue was discovered in OpenText Content Suite Platform 22.1 16.2.19.1803. The endpoint notify.localizeEmailTemplate allows a low-privilege user to evaluate webreports...

Oracle VM VirtualBox has an unspecified vulnerability (CNVD-2023-05479)

A security vulnerability exists in Oracle VM VirtualBox, a virtual machine management software from Oracle Corporation. A low privilege attacker can log into the server where Oracle VM VirtualBox resides to compromise Oracle VM VirtualBox...

OpenText Content Suite Platform 代码问题漏洞

OpenText Content Suite Platform is a top-of-the-line enterprise content management ECM system from OpenText. It can manage the entire enterprise information lifecycle, from capture to archiving and disposal. A security vulnerability exists in OpenText Content Suite Platform version 22.1, which...

Oracle VM VirtualBox 安全漏洞

A security vulnerability exists in Oracle VM VirtualBox, a virtual machine management software from Oracle Corporation. A low privilege attacker can compromise Oracle VM VirtualBox by logging into the infrastructure where Oracle VM VirtualBox is executing...

PT-2023-1268 · Oracle · Oracle Database

Name of the Vulnerable Software and Affected Versions: Oracle Database versions 19c through 21c Description: The issue is related to insufficient input validation in the Oracle Database RDBMS Security component. It allows a low-privileged attacker with Create Session privilege and network access...

PT-2023-1190 · Oracle · Oracle Bi Publisher

Name of the Vulnerable Software and Affected Versions: Oracle BI Publisher versions 5.9.0.0.0, 6.4.0.0.0, and 12.2.1.4.0 Description: The issue is related to insufficient input validation in the Security component of Oracle BI Publisher, part of Oracle Fusion Middleware. This easily exploitable...

Simple URLs < 115 - Subscriber+ SQLi

The plugin does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber. PoC Run the below command in the developer console of the web browser...

Oracle Business Intelligence Enterprise Edition 安全漏洞

Oracle Business Intelligence Enterprise Edition is an intelligent business analytics software from Oracle Corporation USA. Oracle Business Intelligence Enterprise Edition is a security vulnerability that can be exploited by a low-privilege attacker to compromise Oracle Business Intelligence...

PT-2023-1201 · Oracle · Oracle E-Business Suite

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.12 Description: The issue is related to insufficient input validation in the Workflow, Approval, and Work Force Management components of Oracle Self-Service Human Resources. This allows a...

CVE-2022-4578

The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used again...

CVE-2022-4544

The MashShare WordPress plugin before 3.8.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege...

CVE-2022-4508

The ConvertKit WordPress plugin before 2.0.5 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privile...

CVE-2022-4478

The Font Awesome WordPress plugin before 4.3.2 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins...