1268 matches found
bboss 代码注入漏洞
bboss is a J2EE framework in the bboss open source. A security vulnerability exists in bboss bboss-persistent v6.0.9 and earlier versions, which stems from a code injection vulnerability in the component com.frameworkset.common.poolman.util.SQLManager.createPool...
PT-2023-12350 · Seeddms · Seeddms
Name of the Vulnerable Software and Affected Versions: SeedDMS version 6.0.15 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations: For SeedDMS version 6.0.15, update to a version that includes a fix for thi...
CVE-2023-37164
Diafan CMS v6.0 was discovered to contain a reflected cross-site scripting via the catid parameter at /shop/?module=shop&action=search...
Spring Security 安全漏洞
VMware Spring Security is a security framework from VMware that provides illustrative security protection for Spring-based applications. A security vulnerability exists in Spring Security that stems from an authorization rule misconfiguration when using multiple servlets. Affected Products and...
WordPress Plugin Ultimate Member 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
Access Restriction Bypass
Overview Microsoft.AspNetCore.App.Runtime.linux-musl-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Access Restriction Bypass. A vulnerability exist...
Access Restriction Bypass
Overview Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Access Restriction Bypass. A vulnerability exi...
VulnCheck KEV: CVE-2023-3105
The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for...
.NET 6.0 Update - June 22, 2023 (KB5028613)
None None...
UJCMS 代码问题漏洞
UJCMS is a Java open source content management system from UJCMS Open Source. A security vulnerability exists in UJCMS version 6.0.2 that stems from allowing arbitrary file uploads...
Zhongbang CRMEB 代码问题漏洞
Zhongbang CRMEB is an open source e-commerce management system from Zhongbang Networks Zhongbang in Xi'an, China. A code issue vulnerability exists in Zhongbang CRMEB versions prior to 4.6.0. An attacker could exploit this vulnerability to cause data deserialization...
Privilege Escalation
Overview Affected versions of this package are vulnerable to Privilege Escalation. A vulnerability exists in .NET when deserializing a DataSet or DataTable from XML which may result in elevation of privileges. Remediation Upgrade Microsoft.NETCore.App.Runtime.osx-x64 to version 6.0.18, 7.0.7 or...
AZL-27064 CVE-2023-2602 affecting package libcap for versions less than 2.60-2
A vulnerability was found in the pthreadcreate function in libcap. This issue may allow a malicious actor to use cause realpthreadcreate to return an error, which can exhaust the process memory...
CVE-2023-3058
A vulnerability was found in 07FLY CRM up to 1.2.0. It has been declared as problematic. This vulnerability affects unknown code of the component User Profile Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the publi...
CVE-2023-23953
Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to an Elevation of Privilege vulnerability...
AZL-36943 CVE-2023-33187 affecting package highlight 4.18-1
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs...
PT-2023-24204 · Highlight · Highlight
Name of the Vulnerable Software and Affected Versions: Highlight versions prior to 6.0.0 Description: Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This issue arises because the expected behavi...
CVE-2023-27233
Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order0dir parameter at userlistbackend.php...
H3C R160 安全漏洞
The H3C R160 is a wireless router from China's Xinhua San H3C. A security vulnerability exists in the H3C R160 V1004004 version that stems from a stack-based buffer overflow due to incorrect manipulation of the parameter go...
