GHSA-7R35-CHV4-XR3R Pimcore vulnerable to Reflected XSS in Predefined Properties module in Settings

Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.5.20 or apply this patch manually...

GHSA-6MMF-QM37-PMGG Duplicate Advisory: Pimcore vulnerable to Reflected XSS in Predefined Properties module in Settings

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7r35-chv4-xr3r. This link is maintained ot preserve external references. Original Description Cross-site Scripting XSS - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20...

Duplicate Advisory: Pimcore vulnerable to Reflected XSS in Predefined Properties module in Settings

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7r35-chv4-xr3r. This link is maintained ot preserve external references. Original Description Cross-site Scripting XSS - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20...

avalonproperties.com Cross Site Scripting vulnerability OBB-3233300

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Guidance for investigating attacks using CVE-2023-23397

This guide provides steps organizations can take to assess whether users have been targeted or compromised by threat actors exploiting CVE-2023-23397. A successful exploit of this vulnerability can result in unauthorized access to an organization’s environment by triggering a Net-NTLMv2 hash leak...

Stored XSS via name parameter of "Predefined Properties"

Description It's observed that the name parameter of the "Predefined Properties" functionality is vulnerable to stored XSS. Proof of Concept 1.Login to https://demo.pimcore.fun/admin/. 2.Now go to Settings - Predefined Properties - Add and Enter the payload: " inside the name input field. 3.Then...

Multiple Stored XSS in name parameter of "Pricing Rules", "Predefined Properties", "Customers Reports" & "Static Routes"

Description The name parameter of the "Pricing Rules", "Predefined Properties", "Customers Reports" & "Static Routes" functionality is vulnerable to Stored XSS. Proof of Concept 1.Login to https://demo.pimcore.fun/admin/. 2.Now go to Online Shop - Pricing Rules - Add and Enter the name of the new...

Fedora 36 : pypy3.7 (2023-930077c742)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-930077c742 advisory. CVE-2022-37454: Fix buffer overflows in sha3 module Tenable has extracted the preceding description block directly from the Fedora security advisory. Note th...

palominoproperties.com Cross Site Scripting vulnerability OBB-3222611

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Reflected XSS in Predefined Properties module in Settings

Description During testing the pimcore application, I found that it is vulnerable to XSS vulnerability in Predefined Properties module in Settings, specifically at Name field. Proof of Concept 1.Go to https://11.x-dev.pimcore.fun/admin/ then login. 2.Go to Settings - Predefined Properties and add...

CVE-2022-44574

Avalanche up to version 6.3.x is affected by an improper authentication vulnerability that allows an unauthenticated attacker to modify properties on a specific port. The CVE (CVE-2022-44574) is corroborated by multiple sources (NVD, Red Hat, CNNVD, CVE list, ZDI advisory) indicating the issue ar...

EulerOS 2.0 SP9 : python3 (EulerOS-SA-2023-1480)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to...

EulerOS 2.0 SP9 : python3 (EulerOS-SA-2023-1455)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to...

DoS vulnerability in bundled Apache Commons FileUpload library

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier is affected by the Apache Commons FileUpload library's vulnerability https://nvd.nist.gov/vuln/detail/CVE-2023-24998CVE-2023-24998. This library is used to process uploaded files via the Stapler web framework usually through StaplerRequestgetFile...

Debian: Security Advisory (DLA-729-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 18.04 ESM : Python vulnerability (USN-5931-1)

The remote Ubuntu 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5931-1 advisory. It was discovered that Python incorrectly handled certain inputs. If a user or an automated system were tricked into running a specially crafted input, a remote...

Ubuntu 18.04 ESM : Python vulnerability (USN-5930-1)

The remote Ubuntu 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5930-1 advisory. It was discovered that Python incorrectly handled certain inputs. If a user or an automated system were tricked into running a specially crafted input, a remote...

Ubuntu 18.04 LTS : Python vulnerability (USN-5767-3)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5767-3 advisory. USN-5767-1 fixed vulnerabilities in Python. This update fixes the problem for Ubuntu 18.04 LTS. Tenable has extracted the preceding description block directly fro...

Information Disclosure

api-platform/core is vulnerable to Information Disclosure. Resource properties secured with the security option in the ApiPlatform\Metadata\ApiProperty attribute could be disclosed to unauthorized users when the option depends on the value of a property of the item. This bug can also hide...

CVE-2023-26055

XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places...