PT-2023-26104 · Emqx · Emqx +1

Name of the Vulnerable Software and Affected Versions: EMQX version 4.3.8 Description: An issue in the emqx sn plugin allows attackers to execute a directory traversal via uploading a crafted .txt file. Recommendations: For EMQX version 4.3.8, consider restricting access to the emqx sn plugin unt...

EMQ X 路径遍历漏洞

EMQ X is a fully open source, highly scalable and highly available distributed MQTT message broker. Ideal for IoT, M2M and mobile applications, it can handle tens of millions of concurrent clients. A security vulnerability exists in EMQ X v4.3.8. An attacker exploited the vulnerability to perform...

CVE-2023-37468

Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the...

Design/Logic Flaw

Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the...

CVE-2023-37468

The CVE-2023-37468 issue affects Feedbacksystem where LDAP usernames’ passwords are stored in clear text in the database and the LDAP password is passed unencrypted in LoginController.scala during first login. This affects only LDAP-authenticated users (local/cas login not impacted). The vulnerab...

CVE-2023-37743

A cross-site scripting XSS vulnerability in Teacher Subject Allocation System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search text box...

CVE-2023-29452

Currently, geomap configuration Administration - General - Geographical maps allows using HTML in the field “Attribution text” when selected “Other” Tile provider...

CVE-2023-29452

Currently, geomap configuration Administration - General - Geographical maps allows using HTML in the field “Attribution text” when selected “Other” Tile provider...

DEBIAN-CVE-2023-29452

Currently, geomap configuration Administration - General - Geographical maps allows using HTML in the field “Attribution text” when selected “Other” Tile provider...

Hardcoded credentials

Currently, geomap configuration Administration - General - Geographical maps allows using HTML in the field “Attribution text” when selected “Other” Tile provider...

CVE-2023-29452 Remove possibility to add html into Geomap attribution field

Currently, geomap configuration Administration - General - Geographical maps allows using HTML in the field “Attribution text” when selected “Other” Tile provider...

PT-2023-25980 · Unknown · Feedbacksystem

Name of the Vulnerable Software and Affected Versions: Feedbacksystem versions prior to 1.19.2 Description: The issue concerns the storage of passwords in clear text for users utilizing LDAP login. Specifically, the LDAP user's password is passed unencrypted in the LoginController.scala and store...

PT-2023-25900 · Kofax · Kofax Power Pdf

Name of the Vulnerable Software and Affected Versions: Kofax Power PDF affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a maliciou...

CVE-2023-20207

A vulnerability in the logging component of Cisco Duo Authentication Proxy could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability exists because certain unencrypted credentials are stored. An attacker could exploit this...

Design/Logic Flaw

A vulnerability in the logging component of Cisco Duo Authentication Proxy could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability exists because certain unencrypted credentials are stored. An attacker could exploit this...

CVE-2023-20207

A vulnerability in the logging component of Cisco Duo Authentication Proxy could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability exists because certain unencrypted credentials are stored. An attacker could exploit this...

CVE-2023-20207

CVE-2023-20207 affects Cisco Duo Authentication Proxy. The issue is in the logging component, where certain unencrypted credentials are stored, allowing an authenticated, remote attacker to view sensitive information in clear text by accessing logs. Impact is sensitive data disclosure (credential...

Keeper Security Keeper Password Manager 安全漏洞

Keeper Security Keeper Password Manager is a password management system from Keeper Security. A security vulnerability exists in Keeper Security Keeper Password Manager version 16.10.2, which originates from a vulnerability that allows a local attacker to gain access to sensitive information via...

WordPress Twittee Text Tweet Plugin <= 1.0.8 is vulnerable to Cross Site Scripting (XSS)

Software Twittee Text Tweet Type Plugin Vulnerable versions = 1.0.8 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0602 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID aa28f842b39a Credits Shreya Pohekar...

CVE-2022-22302

A clear text storage of sensitive information CWE-312 vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet privat...