Nextcloud Server < 22.2.10.16, 23.x < 23.0.12.11, 24.x <24.0.12.7, 25.x < 25.0.11, 26.x < 26.0.6, 27.x < 27.1.0 Multiple Vulnerabilities (GHSA-8JWV-C8C8-9FR3, GHSA-8F69-F9JG-4X3V)

Nextcloud Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nextcloud:nextcloudserver"...

PT-2023-29977 · Prestashop · Motivationsale

Name of the Vulnerable Software and Affected Versions: motivationsale module for PrestaShop versions prior to 3.5.0 Description: The issue concerns a SQL injection flaw in the motivationsaleDataModel::getProductsByIds method, allowing a guest to execute sensitive SQL calls with a simple HTTP...

PT-2023-7559 · Zoho · Zoho Manageengine Recovery Manager Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine RecoveryManager Plus versions prior to 6070 Description: The issue allows admin users to execute arbitrary commands via proxy settings. This is due to a failure to neutralize special elements, which can be exploited by a...

Zephyr Security Breach

Zephyr is an extensible real-time operating system RTOS open-sourced by the Zephyr Project. A security vulnerability exists in Zephyr 3.4 and earlier versions that stems from the presence of a heap-based buffer overflow...

PT-2023-32060 · WordPress · Popup Box

Name of the Vulnerable Software and Affected Versions: Popup box WordPress plugin versions prior to 3.7.9 Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks, even when unfiltered html is disallowed, due to the plugin's failure to sanitise a...

OpenHarmony 安全漏洞

OpenHarmony is a kind of hongmeng operating system open source project. A security vulnerability exists in OpenHarmony prior to version v3.2.2, which can be exploited by an attacker to read and write arbitrary files via improper privilege saving...

PT-2023-31808 · WordPress · Bonus For Woo

Name of the Vulnerable Software and Affected Versions: Bonus for Woo WordPress plugin versions prior to 5.8.3 Description: The issue is related to Reflected Cross-Site Scripting, which occurs because some parameters are not properly sanitised and escaped before being outputted back in pages. This...

Devellion CubeCart Cross-Site Request Forgery Vulnerability

Devellion CubeCart is a free and open source e-commerce shopping cart software from the company of Devellion UK. The software supports selling products, adding/editing products or images in an online store, etc. A cross-site request forgery vulnerability exists in Devellion CubeCart versions prio...

PortlandLabs Concrete CMS Security Vulnerability

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. A security vulnerability exists in PortlandLabs Concrete CMS prior to 8.5.13 and versions prior to 9.2.2, which stems from a File creation function that may grant too many permissions when...

PT-2023-30878

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.176 Description An issue was discovered in the app/Model/AppModel.php file, where it mishandles filters. Recommendations For versions prior to 2.4.176, update to version 2.4.176 or later to resolve the issue...

CVE-2023-44282

Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module. A local low-privileged attacker could potentially exploit this vulnerability, leading to gaining escalated privileges...

PT-2023-8856

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.0.2109 Description The issue is related to the nv z get count function in the Vim text editor, which can overflow when large counts are given for the normal mode z command. This may allow a remote attacker to cause a...

PT-2023-32482

Name of the Vulnerable Software and Affected Versions prefect versions prior to 2.16.5 Description The issue allows an attacker to steal secrets and potentially gain remote code execution via Cross-Site Request Forgery CSRF using the Prefect API. This can be exploited in self-hosted, open source...

PT-2023-32527 · Trellix · Trellix Getsusp

Name of the Vulnerable Software and Affected Versions: Trellix GetSusp versions prior to 5.0.0.27 Description: The issue is caused by improper privilege management, allowing a local, low-privilege attacker to gain access to files that usually require a higher privilege level. This occurs because...

PT-2023-8853

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.0.2106 Description The issue is related to the function win close in the text editor Vim, where it may try to access an already freed window structure when closing a window. This could potentially allow an attacker to...

ManageEngine SupportCenter Plus < 14.2 Build 14200

The version of ManageEngine SupportCenter Plus installed on the remote host is prior to 14.2 Build 14200. It is, therefore, affected by a vulnerability as referenced in the support-centerCVE-2023-38331 advisory. - Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS i...

Elastic Logstash Log Information Disclosure Vulnerability

Elastic Logstash is a suite of log analysis and monitoring tools from Dutch company Elastic. A security vulnerability exists in Elastic Logstash versions prior to 8.11.1, which stems from the fact that sensitive information can be recorded in Logstash logs under certain circumstances...

CVE-2023-6130 Path Traversal: '\..\filename' in salesagility/suitecrm

Path Traversal: '..\filename' in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2...

CVE-2023-47609

SQL injection vulnerability in OSS Calendar versions prior to v.2.0.3 allows a remote authenticated attacker to execute arbitrary code or obtain and/or alter the information stored in the database by sending a specially crafted request...

PT-2023-23926 · Intel · Intel Arc Rgb Controller

Name of the Vulnerable Software and Affected Versions: Intel Arc RGB Controller versions prior to 1.06 Description: The issue is related to incorrect default permissions in the software, which may allow an authenticated user to potentially enable escalation of privilege via local access...