PT-2023-15603

Name of the Vulnerable Software and Affected Versions X2CRM Open Source Sales CRM versions 6.6 through 6.9 Description A stored cross-site scripting XSS issue was found in the Create Action function, specifically via the "index.php/actions/update" URI. This allows for potential malicious script...

AZL-26247 CVE-2023-29383 affecting package shadow-utils for versions less than 4.9-13

In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn change finger. Although it is not possible to exploit this directly e.g., adding a new user fails because \n is in the block list, it is possible to misrepresent the /etc/passwd file when...

TOTOLINK X18 命令注入漏洞

TOTOLINK X18 is a mesh router system from China's Gion Electronics TOTOLINK. A security vulnerability exists in TOTOLINK X18 version V9.1.0cu.2024B20220329, which originates from a command injection vulnerability via the ip parameter in the setDiagnosisCfg function...

GHSA-XJ72-WVFV-8985 vm2 Sandbox Escape vulnerability

There exists a vulnerability in source code transformer exception sanitization logic of vm2 for versions up to 3.9.15, allowing attackers to bypass handleException and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. Impact A threat...

DNN Corp DotNetNuke 跨站脚本漏洞

DNN also known as DotNetNuke is a set of U.S. DNN by Microsoft support , based on the ASP.NET platform for open source content management system CMS. The system is easy to install , scalable , feature-rich and so on. A security vulnerability exists in DNN Corp DotNetNuke versions v7.0.0 through...

PT-2023-9517 · Openlink +4 · Openlink Virtuoso-Opensource +4

Name of the Vulnerable Software and Affected Versions: openlink virtuoso-opensource version 7.2.9 Description: The issue is related to the dfe unit col loci component of openlink virtuoso-opensource, which is associated with the improper neutralization of special elements used in SQL commands. Th...

PT-2023-9519 · Openlink +4 · Openlink Virtuoso-Opensource +4

Name of the Vulnerable Software and Affected Versions: openlink virtuoso-opensource version 7.2.9 Description: The issue in the libc longjmp component of the openlink virtuoso-opensource platform is related to the improper neutralization of special elements used in SQL commands. Exploitation of...

PT-2023-9527 · Openlink +4 · Openlink Virtuoso-Opensource +4

Name of the Vulnerable Software and Affected Versions: openlink virtuoso-opensource version 7.2.9 Description: The issue is related to the mp box copy component and involves improper neutralization of special elements used in SQL commands. This can be exploited by attackers to cause a Denial of...

Arista Networks Extensible Operating System 安全漏洞

Arista Networks Extensible Operating System EOS is a scalable operating system for next-generation data center and cloud solutions from Arista Networks, Inc. in the United States. A security vulnerability exists in the Arista Networks Extensible Operating System that stems from specially crafted...

CVE-2023-21769 Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

...

CVE-2023-28766

A vulnerability has been identified in SIPROTEC 5 6MD85 CP300 All versions = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 V9.40, SIP...

SAP SapSetup 代码问题漏洞

SAP SapSetup is an application from SAP, Germany. A suite of tools for installing, updating, maintaining, and distributing software on Windows. A code issue vulnerability exists in SAP SapSetup version 9.0, which can be exploited by an attacker for elevation of privilege...

Microsoft Dynamics 跨站脚本漏洞

Microsoft Dynamics is a suite of ERP business solutions for multinational organizations from Microsoft USA. The product includes financial management, production management and business intelligence management. A security vulnerability exists in Microsoft Dynamics. The following products and...

CVE-2023-0983

The stylish-cost-calculator-premium WordPress plugin before 7.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Stored Cross-Site Scripting which could be used against admins when viewing submissions submitted through the Email Quote Form...

PT-2023-9521 · Openlink +4 · Openlink Virtuoso-Opensource +4

Name of the Vulnerable Software and Affected Versions: openlink virtuoso-opensource version 7.2.9 Description: The issue is related to the mp box deserialize string function, which is vulnerable due to improper neutralization of special elements used in SQL commands. This can be exploited by a...

X2Engine X2CRM 跨站脚本漏洞

X2Engine X2CRM is an application from X2Engine USA. a next-generation open source social selling application for small and medium-sized businesses. A security vulnerability exists in X2Engine X2CRM versions v6.6 and v6.9 that stems from the presence of a stored cross-site scripting XSS...

X2Engine X2CRM 跨站脚本漏洞

X2Engine X2CRM is an application from X2Engine USA. a next-generation open source social selling application for small and medium-sized businesses. A security vulnerability exists in X2Engine X2CRM versions v6.6 and v6.9, which stems from the presence of a Reflective Cross-Site Scripting XSS...

tcpdump 缓冲区错误漏洞

tcpdump is a set of sniffing tools from Tcpdump team running under command line. The tool is mainly used for packet analysis and network traffic capturing, among others. A security vulnerability exists in tcpdump version 4.99.3, which stems from an SMB protocol decoder that can perform...

GLPI 跨站脚本漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

PT-2023-17245 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 15.9 through 15.9.3 GitLab versions 15.10 through 15.10.0 Description: An issue has been discovered in GitLab where a search timeout could be triggered if a specific HTML payload was used in the issue description...