CVE-2023-44827

An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code via a crafted script to the Office Conversion Settings function...

CVE-2023-44827

An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code via a crafted script to the Office Conversion Settings function...

CVE-2023-44827

Summary of CVE-2023-44827 : This vulnerability affects ZenTao components as follows: ZenTao Community Edition ≤ v18.6, ZenTao Biz ≤ v8.6, and ZenTao Max ≤ v4.7. An attacker can achieve arbitrary code execution by supplying a crafted script via the Office Conversion Settings function. Root cause i...

PT-2023-29306 · Unknown · Zentao Community Edition +2

Name of the Vulnerable Software and Affected Versions: ZenTao Community Edition versions 18.6 and earlier ZenTao Biz versions 8.6 and earlier ZenTao Max versions 4.7 and earlier Description: The issue allows an attacker to execute arbitrary code via a crafted script to the Office Conversion...

CVE-2023-44827

An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code via a crafted script to the Office Conversion Settings function...

The reality of Apple watch pen testing

Introduction We were approached to do an Apple Watch application test. It seems this isnt a service offered by many companies including us, although we’ve done plenty of work on Android Wear before but also, little information exists online about attempts, experiences or if it’s even possible. So...

Cross-Chain Token Cap Disparity

Lines of code Vulnerability details Impact Potential loss of token value when minted values exceed the uint capacity of target chains, leading to incorrect token representation and financial discrepancies. Proof of Concept This function mints tokens or at least a representation of other chain...

CVE-2023-43775

Denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows attacker to potentially force an unexpected restart of the automation platform, impacting the availability of the product. In rare situations, the issue could cause the SMP device to restart in Safe Mode or Max Safe...

CVE-2023-43775

Denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows attacker to potentially force an unexpected restart of the automation platform, impacting the availability of the product. In rare situations, the issue could cause the SMP device to restart in Safe Mode or Max Safe...

FreeBSD : xrdp -- Improper handling of session establishment errors allows bypassing OS-level session restrictions (c9ff1150-5d63-11ee-bbae-1c61b4739ac9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c9ff1150-5d63-11ee-bbae-1c61b4739ac9 advisory. - xrdp is an open source remote desktop protocol RDP server. In versions prior to 0.9.23 improper...

CVE-2023-43775 Security issue in SMP Gateway automation platform

Denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows attacker to potentially force an unexpected restart of the automation platform, impacting the availability of the product. In rare situations, the issue could cause the SMP device to restart in Safe Mode or Max Safe...

PT-2023-28976 · Eaton · Eaton Smp Sg-4260 +1

Name of the Vulnerable Software and Affected Versions: Eaton SMP Gateway affected versions not specified Eaton SMP SG-4260 affected versions not specified Description: A denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows an attacker to potentially force an unexpecte...

Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2023-2854)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-4974

A vulnerability was found in Academy LMS 6.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument pricemin/pricemax leads to sql injection. The attack may be...

Creative Item Academy LMS SQL Injection Vulnerability

Creative Item Academy LMS is an online course-based learning management system from Creative Item, Inc. An SQL injection vulnerability exists in Creative Item Academy LMS version 6.2 Windows, which stems from the presence of an unknown function in /academy/tutor/filter in the component GET...

CVE-2023-4270

The Min Max Control WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-4270

The Min Max Control WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Cross site scripting

The Min Max Control WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-4270 Min Max Control < 4.6 - Reflected XSS

The Min Max Control WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-4270

The vulnerability CVE-2023-4270 affects the Min Max Control WordPress plugin for versions before 4.6. It arises from inadequate sanitisation/escaping of a parameter, resulting in a Reflected Cross-Site Scripting (XSS) that could affect high-privilege users (e.g., admins). The issue is exploitable...