OESA-2023-1996 mybatis security update

The MyBatis data mapper framework makes it easier to use a relational database with object-oriented applications. MyBatis couples objects with stored procedures or SQL statements using a XML descriptor or annotations. Simplicity is the biggest advantage of the MyBatis data mapper over object...

OESA-2023-1997 mybatis security update

The MyBatis data mapper framework makes it easier to use a relational database with object-oriented applications. MyBatis couples objects with stored procedures or SQL statements using a XML descriptor or annotations. Simplicity is the biggest advantage of the MyBatis data mapper over object...

OESA-2023-1998 mybatis security update

The MyBatis data mapper framework makes it easier to use a relational database with object-oriented applications. MyBatis couples objects with stored procedures or SQL statements using a XML descriptor or annotations. Simplicity is the biggest advantage of the MyBatis data mapper over object...

CVE-2023-7166

A vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0. This affects an unknown part of the file /user/updateUserInfo of the component HTTP POST Request Handler. The manipulation of the argument nickName leads to cross site scripting. It is possible to initiate the...

Cross site scripting

A vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0. This affects an unknown part of the file /user/updateUserInfo of the component HTTP POST Request Handler. The manipulation of the argument nickName leads to cross site scripting. It is possible to initiate the...

CVE-2023-7166 Novel-Plus HTTP POST Request updateUserInfo cross site scripting

A vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0. This affects an unknown part of the file /user/updateUserInfo of the component HTTP POST Request Handler. The manipulation of the argument nickName leads to cross site scripting. It is possible to initiate the...

CVE-2023-7166 Novel-Plus HTTP POST Request updateUserInfo cross site scripting

A vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0. This affects an unknown part of the file /user/updateUserInfo of the component HTTP POST Request Handler. The manipulation of the argument nickName leads to cross site scripting. It is possible to initiate the...

CVE-2023-7166

Novel-Plus up to 4.2.0 contains a cross-site scripting vulnerability in the HTTP POST handler at /user/updateUserInfo via the nickName parameter. The issue can be triggered remotely, and the exploit has been disclosed publicly. A patch is identified by c62da9bb3a9b3603014d0edb436146512631100d, an...

PT-2023-9281 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions 7260 and below Description: The issue is related to insufficient access control in Zoho ManageEngine ADAudit Plus, a Windows Active Directory management and reporting tool. This allows unauthorized loca...

PT-2023-32918 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus versions up to 4.2.0 Description: A vulnerability was found in the component Friendly Link Handler, specifically in the file novel-admin/src/main/java/com/java2nb/novel/controller/FriendLinkController.java. The manipulation of an...

Novel-Plus Cross-Site Scripting Vulnerability

Novel-Plus is an online social reading and writing platform from Novel-Plus, Inc. A cross-site scripting vulnerability exists in Novel-Plus 4.2.0 and earlier versions, which stems from the file novel-admin/src/main/java/com/java2nb/novel/controller/FriendLinkController.java that causes cross-site...

PT-2023-32917 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus versions up to 4.2.0 Description: A problematic vulnerability has been found in Novel-Plus, affecting an unknown part of the file /user/updateUserInfo of the component HTTP POST Request Handler. The manipulation of the nickName...

Novel-Plus Cross-Site Scripting Vulnerability

Novel-Plus is an online social reading and writing platform from Novel-Plus, Inc. A cross-site scripting vulnerability exists in Novel-Plus 4.2.0 and earlier versions, which stems from the parameter nickName in the file /user/updateUserInfo that causes cross-site scripting...

CVE-2023-46918

Phlox com.phlox.simpleserver.plus aka Simple HTTP Server PLUS 1.8.1-plus has an Android manifest file that contains an entry with the android:allowBackup attribute set to true. This could be leveraged by an attacker with physical access to the device...

Hardcoded credentials

Phlox com.phlox.simpleserver aka Simple HTTP Server 1.8 and com.phlox.simpleserver.plus aka Simple HTTP Server PLUS 1.8.1-plus have a hardcoded aKySWb2jjrr4dzkYXczKRt7K encryption key. The threat is from a man-in-the-middle attacker who can intercept and potentially modify data during transmissio...

Fedir Tsapana Simple HTTP Server PLUS Security Vulnerability

Fedir Tsapana Simple HTTP Server PLUS is an application from Fedir Tsapana that allows you to run small local HTTP servers with static content. A security vulnerability exists in Fedir Tsapana Simple HTTP Server PLUS 1.8.1-plus and earlier versions, which arises from the application containing a...

PT-2023-9278 · Zoho · Zoho Manageengine Adselfservice Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADSelfService Plus versions below 6401 Description: The issue is related to an uncontrolled resource consumption in the password reset software, which can be exploited by a remote attacker to cause a denial of service. The...

PT-2023-30262 · Phlox · Simple Http Server Plus +1

Name of the Vulnerable Software and Affected Versions: Phlox com.phlox.simpleserver aka Simple HTTP Server version 1.8 com.phlox.simpleserver.plus aka Simple HTTP Server PLUS version 1.8.1-plus Description: The issue is related to a hardcoded encryption key, specifically aKySWb2jjrr4dzkYXczKRt7K,...

CVE-2023-46918

CVE-2023-46918 affects com.phlox.simpleserver.plus (Simple HTTP Server PLUS) 1.8.1-plus. The root cause is an Android manifest entry where android:allowBackup is set to true, which could expose plaintext data if an attacker has physical access to the device. No exploitation details are provided i...

PT-2023-30261 · Unknown · Com.Phlox.Simpleserver.Plus

Name of the Vulnerable Software and Affected Versions: com.phlox.simpleserver.plus aka Simple HTTP Server PLUS version 1.8.1-plus Description: The Android manifest file of the affected software contains an entry with the android:allowBackup attribute set to true. This could be leveraged by an...