3046 matches found
PT-2023-31666 · Unknown · Praveen Goswami Advanced Category Template
Name of the Vulnerable Software and Affected Versions: Praveen Goswami Advanced Category Template versions 0.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on...
TTS API OS Command Injection Vulnerability
The TTS API is a text-to-speech REST API for multiple TTS engines from the individual developer Pedro Trujillo. An operating system command injection vulnerability exists in TTS API version 2.1.4 and earlier, which stems from the onSpeechDone function of a file that can lead to operating system...
CVE-2023-6895
A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.320201113RELEASEHIK. It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondataip with the input netstat -ano leads to os command injection...
OESA-2023-1906 netty security update
Asynchronous event-driven network application Java framework. Security Fixes: Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion...
CVE-2023-41621
A Cross Site Scripting XSS vulnerability was discovered in Emlog Pro v2.1.14 via the component /admin/store.php...
Adobe Substance 3D Stager 缓冲区错误漏洞
Adobe Substance 3D Stager is a virtual 3D studio from the American company Audobee Adobe. An out-of-bounds read vulnerability exists in Adobe Substance 3D Stager version 2.1.1 and prior versions, which can be exploited by an attacker to cause a sensitive memory disclosure...
DoraCMS Cross-Site Scripting Vulnerability (CNVD-2023-9750397)
DoraCMS is a software application. Based on Nodejs+eggjs+mongodb to write a content management system . A cross-site scripting XSS vulnerability exists in DoraCMS version v2.1.8. An attacker can exploit this vulnerability to execute arbitrary code by uploading a specially crafted HTML or image fi...
CVE-2023-38727
IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted SQL statement. IBM X-Force ID: 262257...
PT-2023-7414 · Ibm · Ibm Db2
Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server versions 10.5, 11.1, 11.5 Description: The issue is related to an uncontrolled consumption of resources, which can lead to a denial of service under extreme stress conditions. Th...
CVE-2023-6137
Cross-Site Request Forgery CSRF vulnerability in finnj Frontier Post allows Cross Site Request Forgery.This issue affects Frontier Post: from n/a through 6.1...
PT-2023-30753 · Nitin Rathod · Wp Forms Puzzle Captcha
Name of the Vulnerable Software and Affected Versions: WP Forms Puzzle Captcha versions n/a through 4.1 Description: A Cross-Site Request Forgery CSRF vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Stored XSS. Recommendations: For WP Forms Puzzle Captcha versions n/a through 4.1,...
PT-2023-32639 · Notepad++ · Notepad++
Name of the Vulnerable Software and Affected Versions: NotePad++ versions up to 8.1 Description: A problematic issue was found in NotePad++, affecting an unknown functionality of the file dbghelp.exe. This leads to an uncontrolled search path. The issue can be exploited locally. Recommendations:...
PT-2023-30253 · Unknown · Dreamer Cms
Name of the Vulnerable Software and Affected Versions: Dreamer CMS versions prior to 4.0.1 Description: The issue allows for Directory Traversal, where background template management enables arbitrary modification of template files. This can lead to the reading of system-sensitive files...
PT-2023-31164 · Asana · Asana Desktop
Name of the Vulnerable Software and Affected Versions: Asana Desktop version 2.1.0 Description: The issue allows code injection due to specific Electron Fuses, with inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments. This can be...
google-translate-api-browser Code Issue Vulnerability
google-translate-api-browser is the free and unlimited Google Translate API. A code issue vulnerability exists in versions of google-translate-api-browser prior to 4.1.0, which stems from the translateOptions.tld field not being properly cleaned before being placed in a Google Translate URL. An...
CVE-2023-5466
The Wp anything slider plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
WordPress Plugin UserPro Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
CVE-2023-47650
Cross-Site Request Forgery CSRF vulnerability in Peter Sterling Add Local Avatar.This issue affects Add Local Avatar: from n/a through 12.1...
NEC Expresscluster X Security Vulnerability
NEC Expresscluster X is a specialized high availability cluster software from Nippon Electric NEC. It is used to initiate a quick restore function and continuously protect critical applications and data. A security vulnerability exists in NEC Expresscluster X version 5.1 and prior versions that...