CVE-2023-37428

CVE-2023-37428 affects the EdgeConnect SD-WAN Orchestrator Web-Based Management Interface. The connected sources describe an authenticated remote-code-execution path-traversal vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands on the underlying host with...

CVE-2023-23565

An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to retrieve PHP files from the server via Local File Inclusion...

CVE-2023-23564

Geomatika IsiGeo Web 6.0 is the affected software. The CVE-2023-23564 entry describes a vulnerability allowing remote authenticated users to execute commands, i.e., a command-injection type issue (PRION and CNNVD references label it as such). CVSSv3.1 base score is 8.8 (High) with Network attack ...

CVE-2023-23564

An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to execute commands...

Geomatika IsiGeo Web 命令注入漏洞

Geomatika IsiGeo Web is Geomatika's geographic information system GIS software for the collection, management, analysis, and visualization of geospatial data. A security vulnerability exists in Geomatika IsiGeo Web version 6.0 that originates from allowing remote authenticated users to execute...

CVE-2023-23565: Improper Control of Filename for Include/Require Statement in PHP Program

An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to retrieve PHP files from the server via Local File Inclusion...

CVE-2023-23563

An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to obtain sensitive database content via SQL Injection...

USN-6293-1 heat vulnerability

It was discovered that OpenStack Heat incorrectly handled certain hidden parameter values. A remote authenticated user could possibly use this issue to obtain sensitive data...

Liferay Portal 7.4.3.81 < 7.4.3.86 Information Disclosure

The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported versio...

GHSA-XPH3-VJCQ-G488 Liferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions

The organization selector before 4.0.14 from Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations...

CVE-2023-3426

The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations...

Design/Logic Flaw

The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations...

Moxa Industrial Managed Switch Client-Side Enforcement of Server-Side Security (CVE-2015-6464)

The administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to bypass a read-only protection mechanism by using Firefox with a web- developer plugin. This plugin only works with Tenable.ot. Please visit...

Cisco Nexus 9000 Series Denial of Service (CVE-2015-0686)

The SNMP implementation in Cisco NX-OS 6.12I23 on Nexus 9000 devices, when a Reset High Availability HA policy is configured, allows remote authenticated users to cause a denial of service device reload via unspecified vectors, aka Bug ID CSCuq92240. This plugin only works with Tenable.ot. Please...

Cisco Multiple Vulnerabilities in NX-OS-Based Products (CVE-2013-1191)

Cisco NX-OS 6.1 before 6.15 on Nexus 7000 devices, when local authentication and multiple VDCs are enabled, allows remote authenticated users to gain privileges within an unintended VDC via crafted SSH key data in an SSH session to a management interface, aka Bug ID CSCud88400. This plugin only...

CVE-2023-29998

A Cross-site scripting XSS vulnerability in the content editor in Gis3W g3w-suite 3.5 allows remote authenticated users to inject arbitrary web script or HTML and gain privileges via the description parameter...

CVE-2023-29998

A Cross-site scripting XSS vulnerability in the content editor in Gis3W g3w-suite 3.5 allows remote authenticated users to inject arbitrary web script or HTML and gain privileges via the description parameter...

CVE-2023-29998

A Cross-site scripting XSS vulnerability in the content editor in Gis3W g3w-suite 3.5 allows remote authenticated users to inject arbitrary web script or HTML and gain privileges via the description parameter...

CVE-2023-29998

A Cross-site scripting XSS vulnerability in the content editor in Gis3W g3w-suite 3.5 allows remote authenticated users to inject arbitrary web script or HTML and gain privileges via the description parameter...

Cross site scripting

A stored cross-site scripting Stored XSS vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Any user can obtain the privilege to rename within their own board where they have BoardAdmin access,...