SUSE-SU-2023:3338-1 Security update for openssl-1_0_0

This update for openssl-100 fixes the following issues: - CVE-2023-3817: Fixed a potential DoS due to excessive time spent checking DH q parameter value. bsc1213853...

PT-2023-28069 · Unknown · Moosocial Moostore

Name of the Vulnerable Software and Affected Versions: mooSocial mooStore version 3.1.6 Description: A problematic issue was found in the software, affecting an unknown function of the file /search/index. The manipulation of the argument q leads to cross-site scripting. It is possible to launch t...

SUSE CVE-2023-3817

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been...

FreeBSD : OpenSSL -- Excessive time spent checking DH q parameter value (bad6588e-2fe0-11ee-a0d1-84a93843eb75)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bad6588e-2fe0-11ee-a0d1-84a93843eb75 advisory. - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary:...

Exploit for Path Traversal in Gibbonedu Gibbon

Gibbon v25.0.0 - Local File Inclusion - CVE-2023-34598 Gibbon...

PT-2023-21711 · Soko · Soko

Name of the Vulnerable Software and Affected Versions: Soko versions prior to 1.0.2 Description: The issue affects the package search handlers, Search and SearchFeed, implemented in pkg/app/handler/packages/search.go, allowing unauthenticated attackers to execute arbitrary SQL queries on...

Online Doctor Appointment Booking System SQL注入漏洞

Online Doctor Appointment Booking System is an open source online doctor appointment booking system. The Online Doctor Appointment Booking System suffers from a SQL injection vulnerability that originates from allowing an attacker to obtain sensitive information via the q parameter of the...

PT-2023-15095 · Nexusphp · Nexusphp

Name of the Vulnerable Software and Affected Versions: NexusPHP versions prior to 1.7.33 Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to reflective cross-site scripting XSS attacks. This can be achieved by injecting malicious input int...

PT-2023-16181 · Unknown · Theradsystem

Name of the Vulnerable Software and Affected Versions: saemorris TheRadSystem affected versions not specified Description: A problematic issue has been identified, affecting an unknown function of the file users.php. The manipulation of the q argument leads to cross-site scripting. This issue can...

Enhancesoft osTicket 跨站脚本漏洞

Enhancesoft osTicket is an open source ticketing system from Enhancesoft, Inc. in the United States. A security vulnerability exists in Enhancesoft osTicket versions prior to 1.16.4. The vulnerability stems from setting an ordinary user's username as the XSS payload, and then placing the same XSS...

PT-2022-25072 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe affected versions not specified Description: A problematic issue was found in Frappe, affecting some unknown functionality of the file frappe/templates/includes/navbar/navbar search.html of the component Search. The manipulation of the...

GHSA-CX2V-JRJC-G54W OpenTSDB vulnerable to OS Command Injection

An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input...

Apache Jackrabbit contains Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to 1 search.jsp or 2 swr.jsp...

GHSA-6FXV-38XC-H866 Apache Jackrabbit contains Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to 1 search.jsp or 2 swr.jsp...

CVE-2020-18324

Cross Site Scripting XSS vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template...

CVE-2020-22200

Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to publicgetsuggestkeyword...

SourceCodester Online Examination System Cross-Site Scripting Vulnerability (CNVD-2021-95922)

SourceCodester Online Examination System is an online examination system from SourceCodester, Inc. A cross-site scripting vulnerability exists in SourceCodester Online Examination System, which originates from the q parameter does not filter user input, which can be exploited to execute JavaScrip...

CVE-2020-29257

Cross-site scripting XSS vulnerability in Online Examination System 1.0 via the q parameter to feedback.php...

Cross site scripting

Cross-site scripting XSS vulnerability in Online Examination System 1.0 via the q parameter to feedback.php...

CVE-2020-29257

CVE-2020-29257: Cross-site scripting in Online Examination System 1.0 (SourceCodester Online Examination System) via the q parameter to feedback.php. Root cause: user input in q is not properly filtered, enabling injection of JavaScript that can execute in the victim’s browser. Documented impact:...