10978 matches found
PT-2023-8625 · Apache · Apache Airflow
Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.7.1 Description: The issue allows authenticated users who have access to see the task/dag in the UI to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be...
PT-2023-5488 · Google +2 · Google Chrome +2
Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 117.0.5938.62 Description: The issue is related to insufficient policy enforcement in the Autofill feature of Google Chrome, allowing a remote attacker to bypass Autofill restrictions via a crafted HTML page...
AnythingLLM SQL Injection Vulnerability
AnythingLLM is a document chatbot that meets business requirements. AnythingLLM versions prior to 0.0.1 suffer from a SQL injection vulnerability that stems from susceptibility to SQL injection attacks...
WordPress plugin Appointment booking addon for Gravity Forms Cross Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
PT-2023-31024 · Mintplex · Anything-Llm
Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm versions prior to 0.0.1 Description: The issue is related to SQL Injection in the GitHub repository mintplex-labs/anything-llm. Recommendations: For versions prior to 0.0.1, update to version 0.0.1 or later to resol...
Symfony UX Autocomplete Input Validation Error Vulnerability
Symfony UX Autocomplete is a Symfony open source JavaScript autocomplete feature for Symfony. An input validation error vulnerability exists in Symfony UX Autocomplete versions prior to 2.11.2. An attacker can exploit this vulnerability to successfully submit an invalid entity ID...
CVE-2023-4879 Cross-site Scripting (XSS) - Stored in instantsoft/icms2
Cross-site Scripting XSS - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git...
matrix-media-repo Cross-Site Scripting Vulnerability
Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. A cross-site scripting vulnerability exists in matrix-media-repo versions prior to 1.3.0, which originates from a vulnerability that allows an attacker to upload an SVG image containing JavaScript script to a serv...
PT-2023-27704
Name of the Vulnerable Software and Affected Versions SolarView Compact versions prior to 6.00 Description The issue is related to Directory Traversal. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was...
HCL Domino Security Vulnerability
HCL Technologies HCL Domino is an application software from HCL Technologies, Inc. It provides a platform for application development. A security vulnerability exists in HCL Domino versions prior to 12.0.2 FixPack 2, which stems from the possibility that server hostnames may be exposed in certain...
Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2
The Mozilla Foundation Security Advisory describes this flaw as: Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run...
PT-2023-27223 · Argo Cd · Argo Cd
Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.6.15 Argo CD versions prior to 2.7.14 Argo CD versions prior to 2.8.3 Description: Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD...
Design/Logic Flaw
Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer C50 firmware versions prior to 'Archer C50JPV3230505', Archer C55 firmware versions prior to 'Archer C55JPV1230506', and Archer C20 firmwar...
PT-2023-27499 · Tp Link · Archer Ax6000
Name of the Vulnerable Software and Affected Versions: Archer AX6000 versions prior to Archer AX6000JP V1 1.3.0 Build 20221208 Description: The issue allows a network-adjacent authenticated attacker to execute arbitrary OS commands. Recommendations: For versions prior to Archer AX6000JP V1 1.3.0...
PT-2023-27762
Name of the Vulnerable Software and Affected Versions AccessControl versions prior to 4.4 AccessControl versions prior to 5.8 AccessControl versions prior to 6.2 Description The issue arises from Python's "format" functionality, which allows someone controlling the format string to access objects...
PT-2023-31704
Name of the Vulnerable Software and Affected Versions Defender Security WordPress plugin versions prior to 4.1.0 Description The issue allows an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled, due to the plugin not preventing...
CVE-2023-4781
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873...
CVE-2023-4531
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Mestav Software E-commerce Software allows SQL Injection.This issue affects E-commerce Software: before 20230901...
