CVE-2023-27892

Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messages. Flaws in cfconfirmExecTx in ethereumcontracts.c can be used to reveal arbitrary microcontroller memory on the device screen or crash the device. With...

CVE-2023-29681

Cleartext Transmission in cookie:ecospw: in Tenda N301 v6.0, firmware v12.03.01.06pt allows an authenticated attacker on the LAN or WLAN to intercept communications with the router and obtain the password...

Ubiquiti EdgeRouter 命令注入漏洞

The Ubiquiti EdgeRouter is a router from Ubiquiti, Inc. A command injection vulnerability exists in Ubiquiti EdgeRouter X version 2.0.9-hotfix.6 and prior versions, which stems from an incorrect manipulation of the parameter name that can lead to command injection...

PT-2023-21746 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS previously concrete5 versions 9.0 through 9.1.3 Concrete CMS previously concrete5 versions prior to 9.2 Description: The issue is related to Stored XSS on Tags on uploaded files. This allows for malicious code to be stored and...

PortlandLabs Concrete CMS 跨站脚本漏洞

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS versions prior to 9.2. An attacker can exploit this vulnerability to perform cross-site scripti...

PortlandLabs Concrete CMS 授权问题漏洞

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A security vulnerability exists in PortlandLabs Concrete CMS versions prior to 9.1 that stems from the lack of a password reset rate limit...

PT-2023-21989 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS previously concrete5 versions prior to 9.1 Description: The issue concerns stored XSS in the RSS Displayer via the href attribute. This occurs because the link element input was not sanitized, allowing for potential exploitation...

CVE-2023-28471

Concrete CMS previously concrete5 in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name...

PortlandLabs Concrete CMS 跨站脚本漏洞

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS versions prior to 9.1. An attacker can exploit this vulnerability to perform cross-site scripti...

PT-2023-21990 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS previously concrete5 versions prior to 9.1 Description: The issue is related to the lack of a rate limit for password resets in Concrete CMS. This could potentially allow for brute-force attacks on user passwords. Recommendations...

PT-2023-21747 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS previously concrete5 versions 8.5.12 and below Concrete CMS previously concrete5 versions 9.0 through 9.1.3 Description: The issue concerns stored XSS on API Integrations via the name parameter. This allows for potential...

Ubiquiti EdgeRouter 命令注入漏洞

The Ubiquiti EdgeRouter is a router from Ubiquiti USA. A command injection vulnerability exists in Ubiquiti EdgeRouter X version 2.0.9-hotfix.6 and prior versions, which stems from the fact that incorrect manipulation of the parameter suffix-rate-up can lead to command injection...

PortlandLabs Concrete CMS 跨站脚本漏洞

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A security vulnerability exists in PortlandLabs Concrete CMS versions prior to 9.1. An attacker could exploit this vulnerability to perform cross-site scripting attacks...

PortlandLabs Concrete CMS 跨站脚本漏洞

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS versions prior to 9.2. An attacker can exploit this vulnerability to perform cross-site scripti...

PortlandLabs Concrete CMS 跨站脚本漏洞

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS versions prior to 9.2. An attacker can exploit this vulnerability to perform cross-site scripti...

PortlandLabs Concrete CMS 跨站脚本漏洞

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS versions prior to 9.2. An attacker can exploit this vulnerability to perform cross-site scripti...

CVE-2023-28476

Concrete CMS previously concrete5 in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files...

CVE-2023-2339

creationtimestamp| type| source ---|---|--- 2023-04-27 16:42:24+00:00| seen| https://t.me/cibsecurity/62974...

MilleGPG5 权限许可和访问控制问题漏洞

MilleGPG5 is an application from MilleGPG, Inc. MilleGPG5 version 5.9.2 suffers from a privilege license and access control issue vulnerability that stems from the presence of local privilege escalation and incorrect access control...

UBUNTU-CVE-2022-25275

In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However,...