Fortinet FortiSIEM 加密问题漏洞

Fortinet FortiSIEM is a suite of security information and event management systems from the American company Fiat Fortinet. The system includes features such as asset discovery, workflow automation and unified management. A security vulnerability exists in Fortinet FortiSIEM versions prior to 6.7...

PT-2023-3622 · Microsoft +1 · Windows +6

Name of the Vulnerable Software and Affected Versions: SIMATIC NET PC Software versions V14 through V15 SIMATIC PCS 7 versions V8.2 through V9.1 SIMATIC WinCC versions prior to V8.0 SINAUT Software ST7sc affected versions not specified Description: The issue is related to the use of outdated...

PT-2023-24771 · Unknown · @Keystone-6/Auth

Name of the Vulnerable Software and Affected Versions: @keystone-6/auth versions 7.0.0 and prior Description: Keystone is a content management system for Node.JS. There is an open redirect in the @keystone-6/auth package, where the redirect leading / filter can be bypassed. Users may be redirecte...

PT-2023-20594 · Hewlett Packard · Hp Device Manager

Name of the Vulnerable Software and Affected Versions: HP Device Manager versions prior to 5.0.10 Description: The issue potentially allows command injection and/or elevation of privileges. Recommendations: For versions prior to 5.0.10, update to version 5.0.10 or later to resolve the issue...

Node.js 安全特征问题漏洞

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in versions of Node.js prior to version 3.2.1 that stems from the crypto-js package generating random numbers by concatenating strings, but using integers, which makes the output predictable...

Froxlor 安全漏洞

Froxlor is a suite of lightweight server management software from the Froxlor team. A security vulnerability exists in Froxlor versions prior to 2.0.20 that stems from an improper restriction on excessive authentication attempts...

PT-2023-4194 · Langchain · Langchain

Name of the Vulnerable Software and Affected Versions: LangChain versions prior to 0.0.247 Description: The issue is related to a SQL injection vulnerability that allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component. This vulnerability is due to the lack of...

Dahua Smart Parking Management 代码问题漏洞

Dahua Smart Parking Management is a parking solution from Dahua, China. A code issue vulnerability exists in Dahua Smart Parking Management 20230528 and prior versions, which stems from an issue with unknown code in the file /ipms/imageConvert/image, where manipulation of the parameter fileUrl ca...

PT-2023-20263 · WordPress · Quiz Maker

Name of the Vulnerable Software and Affected Versions: The Quiz Maker WordPress plugin versions prior to 6.4.2.7 Description: The issue is related to Reflected Cross-Site Scripting, which occurs because some parameters are not properly escaped before being outputted back in attributes. This could...

PT-2023-22627 · Unknown +1 · Prestashop +1

Name of the Vulnerable Software and Affected Versions: King-Avis versions prior to 17.3.15 Description: The issue is related to Improper Limitation of a Pathname, leading to a Path Traversal vulnerability in the King-Avis module for Prestashop. This allows a user with knowledge of the download...

coreBOS 跨站脚本漏洞

coreBOS is a JPL TSolucio open source commercial software capable of managing day-to-day business needs. A cross-site scripting vulnerability exists in versions prior to coreBOS 8, which can be exploited by attackers to perform cross-site scripting attacks...

CVE-2023-24584

Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature. This issue affects Controller 6000: before vCR8.80.230201a, before vCR8.70.230201a, before vCR8.60.230201b, before vCR8.50.230201a, all versions of vCR8.40 and prior...

CVE-2023-23952

Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vulnerability...

PT-2023-23720 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 1.18.7 Description: The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references IDOR. This could result in a user deleting another user's dashboard o...

PT-2023-23981 · Splunk · Splunk App For Stream +1

Name of the Vulnerable Software and Affected Versions: Splunk App for Stream versions prior to 8.1.1 Description: A low-privileged user could use a vulnerability in the streamfwd process within the Splunk App for Stream to escalate their privileges on the machine that runs the Splunk Enterprise...

Guangdong Pythagorean OA Office System 跨站请求伪造漏洞

Guangdong Pythagorean OA Office System Gougu OA is a practical enterprise office system of China Gouguopen open source gouguopen open source . A cross-site request forgery vulnerability exists in Guangdong Pythagorean OA Office System versions prior to 4.50.31. The vulnerability stems from the...

PT-2023-19320 · Unknown · Advanced Secure Gateway/Content Analysis

Name of the Vulnerable Software and Affected Versions: Advanced Secure Gateway and Content Analysis versions prior to 7.3.13.1 / 3.1.6.0 Description: The issue is related to a Stored Cross-Site Scripting vulnerability. No information is provided about the estimated number of potentially affected...

PT-2023-21876 · Unknown · Conprosys Hmi System

Name of the Vulnerable Software and Affected Versions: CONPROSYS HMI System CHS versions prior to 3.5.3 Description: A cross-site scripting issue exists, allowing an arbitrary script to be executed on the web browser of another user with administrative privileges if specially crafted settings are...

PT-2023-24743 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2023.05 Description: The issue allows bypass of permission checks, enabling the performance of admin actions. Recommendations: For versions prior to 2023.05, update to version 2023.05 or later to resolve t...

PT-2023-24611 · Unknown +1 · Formcreator +1

Name of the Vulnerable Software and Affected Versions: Formcreator versions 2.13.5 and prior Description: A stored cross-site scripting issue is present in the Formcreator plugin, potentially allowing arbitrary javascript code execution in an admin or tech context. This is due to the use of...