PT-2023-30788 · Imagely · Imagely Wordpress Gallery Plugin - Nextgen Gallery

Name of the Vulnerable Software and Affected Versions: Imagely WordPress Gallery Plugin – NextGEN Gallery versions through 3.37 Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This can lead to various security problems, includi...

WordPress NextGEN Gallery Plugin <= 3.37 is vulnerable to Cross Site Request Forgery (CSRF)

Software NextGEN Gallery Type Plugin Vulnerable versions = 3.37 Fixed in 3.39 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-48328 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b8ea9e94978b Credits RE-ALTER Required...

Multiple instances of reentrancy

Lines of code Vulnerability details Impact This can lead to massive loss of funds and asset in Nextgen. Proof of Concept There are multiple instances of reentrancy in NextGenCore.sol, MinterContract.sol and AuctionMemo.sol. These reentrancy is due to the use of ERC721 safeMint... for token transf...

Switching to sales model 3 for a collection with pre-existing supply could brick the ' mint() ' function for that collection.

Lines of code Vulnerability details Impact ' Periodic sales' model cannot be used in a collection with Pre-existing supply because of how timeOfLastMint is calculated in mint function. This prevents the system from flexibly combining different sales models in a single collection as intended by th...

The vulnerability of the NextGen Installer component affects the software platform Oracle Fusion Middleware’s NextGen OUI Framework. This vulnerability allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the NextGen Installer component of the Oracle Global Lifecycle Management NextGen OUI Framework software platform exists due to insufficient validation of input data. Exploiting this vulnerability could allow attackers to compromise the confidentiality, integrity, and...

NextGen Mirth Connect Detection

Binary data mirthconnectwebdetect.nbin...

NextGen Mirth Connect < 4.4.1 RCE (CVE-2023-43208)

According to its self-reported version, the instance of NextGen Mirth Connect running on the remote web server is 4.4.1. It is, therefore, affected by a remote code execution vulnerability that could allow a remote attacker to bypass authentication and execute arbitrary commands. Note that Nessus...

NextGen Mirth Connect < 4.4.0 RCE (CVE-2023-37679)

According to its self-reported version, the instance of NextGen Mirth Connect running on the remote web server is 4.4.0. It is, therefore, affected by a remote code execution vulnerability that could allow a remote attacker to bypass authentication and execute arbitrary commands. Note that Nessus...

CVE-2023-43208

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679...

Remote code execution

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679...

Critical Flaw in NextGen's Mirth Connect Could Expose Healthcare Data

Users of Mirth Connect, an open-source data integration platform from NextGen HealthCare, are being urged to update to the latest version following the discovery of an unauthenticated remote code execution vulnerability. Tracked as CVE-2023-43208, the vulnerability has been addressed in version...

CVE-2023-43208

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679...

CVE-2023-43208

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679...

CVE-2023-43208

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679...

CVE-2023-43208

NextGen Healthcare Mirth Connect (before 4.4.1) is affected by a deserialization of untrusted data vulnerability that allows unauthenticated remote code execution. Root cause: an incomplete patch of CVE-2023-37679 left a gadget chain bypassing the original deny list, enabling RCE via crafted HTTP...

CVE-2023-43208

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679. Recent assessments: ccondon-r7 at January 27, 2024 7:41pm UTC reported: Knocking down attacker value a bi...

The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in improper session management, allowing attackers to execute arbitrary code.

The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in improper session management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by writing the file to any location within the file system...

The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in the improper limitation of the path name for the restricted access directory. This allows a perpetrator to obtain an arbitrary file size from the file system.

The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in improper restrictions on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor, operating remotely, to obtain an arbitrary file size from the file system using the FTP SIZ...

The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in the improper restriction on the path name to the restricted directory. This allows attackers to write files to any location within the file system.

The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in improper restrictions on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to write files to any location within the file system...

The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in the improper restriction on the path name to the restricted directory. This allows attackers to read arbitrary files from the file system.

The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in improper restrictions on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to remotely read arbitrary files from the file system...