2262 matches found
PT-2023-23002 · H2O · H2O
Name of the Vulnerable Software and Affected Versions: H2O versions 2.3.0-beta2 and prior Description: H2O is an HTTP server. When the reverse proxy handler tries to process a certain type of invalid HTTP request, it tries to build an upstream URL by reading from an uninitialized pointer. This...
PT-2023-12782 · Drupal · Drupal
Name of the Vulnerable Software and Affected Versions: Drupal version 9.3 Description: The issue arises from the incomplete integration of the generic entity access API for entity revisions with existing permissions in Drupal 9.3. This results in possible access bypass for users who have access t...
PT-2023-21583 · Avalanche · Avalanche
Name of the Vulnerable Software and Affected Versions: Avalanche versions 6.3.x and below Description: An authentication bypass issue exists that could allow an attacker to gain access by exploiting the SetUser method or by exploiting a Race Condition in the authentication message. Recommendation...
PT-2023-21584 · Avalanche · Avalanche
Name of the Vulnerable Software and Affected Versions: Avalanche versions 6.3.x and below Description: A path traversal vulnerability exists that could result in possible information disclosure when exploited. Recommendations: For Avalanche versions 6.3.x and below, at the moment, there is no...
PT-2023-21732 · Pretalx · Pretalx
Name of the Vulnerable Software and Affected Versions: pretalx versions 2.3.1 through 2.3.1 Description: The issue allows path traversal in HTML export, a non-default feature. Users can upload crafted HTML documents that trigger the reading of arbitrary files. Recommendations: For pretalx version...
pretalx 路径遍历漏洞
pretalx is a meeting planning tool from pretalx open source. Focused on providing the best experience for organizers, speakers, reviewers and attendees. A security vulnerability exists in pretalx version 2.3.1 up to versions prior to 2.3.2. An attacker can exploit the vulnerability to overwrite...
CVE-2023-27779
AM Presencia v3.7.3 was discovered to contain a SQL injection vulnerability via the user parameter in the login form...
WordPress plugin Metform Elementor Contact Form Builder 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...
CVE-2023-23987
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPEverest User Registration plugin = 2.3.0 versions...
PT-2023-20896 · Tenda · Tenda Ac10
Name of the Vulnerable Software and Affected Versions: Tenda AC10 US AC10V4.0si V16.03.10.13 cn Description: The issue is related to a stack overflow via the get parentControl list Info function, allowing attackers to cause a Denial of Service DoS or execute arbitrary code via a crafted payload...
PT-2023-15436 · Unknown · Quantumcloud Ai Chatbot Plugin
Name of the Vulnerable Software and Affected Versions: QuantumCloud AI ChatBot plugin versions prior to 4.3.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions prior to 4.3.0,...
PT-2023-19009 · Apple · Ipados +3
Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.3 iOS versions prior to 16.4 iPadOS versions prior to 16.4 Description: A logic issue was addressed with improved restrictions, allowing photos belonging to the Hidden Photos Album to be viewed without...
PT-2023-21618 · Apple · Apple Macos
Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.3 Description: A denial-of-service issue was addressed with improved input validation. A remote user may be able to cause a denial-of-service. Recommendations: For versions prior to 13.3, update to macOS Ventura 13....
PT-2023-21626 · Apple · Apple Macos
Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.3 Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. An app may be able to disclose kernel memory. Recommendations: For...
PT-2023-12946 · Totolink · Totolink Outdoor Cpe Cp900
Name of the Vulnerable Software and Affected Versions: TOTOLink outdoor CPE CP900 version 6.3c.566 B20171026 Description: A command injection issue exists in the setUpgradeFW function via the filename parameter, allowing attackers to execute arbitrary commands through a crafted request...
Ascensio System ONLYOFFICE 代码问题漏洞
Ascensio System ONLYOFFICE is an office software from Ascensio System, Latvia. A security vulnerability exists in ONLYOFFICE Docs versions prior to 7.3 that originates from a vulnerability that allows local users to gain privileges via the Trojan horse libgccs.so.1 in the current working director...
CVE-2023-22700
Cross-Site Request Forgery CSRF vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL TAG Manager plugin = 9.3.0 versions...
IBM MQ 安全漏洞
IBM MQ IBM WebSphere MQ is a messaging middleware product from International Business Machines IBM. The product focuses on providing a reliable and proven messaging backbone for Service Oriented Architecture SOA. A security vulnerability exists in IBM MQ version 9.2 CD, version 9.2 LTS, version 9...
PT-2023-14507 · Avalanche · Avalanche
Name of the Vulnerable Software and Affected Versions: Avalanche versions 6.3.x and below Description: An improper authentication issue exists, allowing an unauthenticated attacker to modify properties on a specific port. Recommendations: For Avalanche versions 6.3.x and below, update to a versio...