PT-2023-29775 · Unknown · Thirty Bees Core

Name of the Vulnerable Software and Affected Versions: Thirty Bees Core version 1.4.0 Description: The issue is a reflected cross-site scripting XSS vulnerability. It allows attackers to execute arbitrary JavaScript in a user's web browser via a crafted payload. The vulnerability is exploited...

Thirty Bees Core Cross-Site Scripting Vulnerability

Thirty Bees Core is an open source e-commerce application with cutting edge features from Thirty Bees. A security vulnerability exists in Thirty Bees Core v1.4.0. An attacker could exploit this vulnerability to execute arbitrary JavaScript in a user's web browser via a specially crafted payload...

CVE-2023-45958: Improper Neutralization of Input During Web Page Generation

Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the backuppagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload...

CVE-2023-45958

Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the backuppagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload...

CVE-2023-45958

Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the backuppagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload...

CVE-2023-45958

Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the backuppagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload...

CVE-2023-45958

CVE-2023-45958 affects Thirty Bees Core v1.4.0 with a reflected XSS via the backup_pagination parameter to /controller/AdminController.php, allowing arbitrary JavaScript execution in a user’s browser. Concrete details from multiple sources confirm the affected product/version and the vector; the ...

CVE-2023-45958

Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the backuppagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload...

UBUNTU-CVE-2023-34324

Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by remova...

October 10, 2023-KB5031009 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Microsoft server operating system, version 23H2

None None...

CVE-2023-43260

Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting XSS vulnerability via the admin panel...

Milesight Cross-Site Scripting Vulnerability

Milesight is a complete Artificial Intelligence Video Surveillance solution from China's StarZone IOT Milesight. A cross-site scripting vulnerability exists in Ursalink Milesight UR5X, UR32L, UR32, UR35, UR41 , Industrial Cellular Routers prior to v35.3.0.7, which stems from the admin panel being...

Milesight Log Information Disclosure Vulnerability

Milesight is a complete Artificial Intelligence Video Surveillance solution from China's StarZone IOT Milesight. A log information disclosure vulnerability exists in Milesight UR5X, UR32L, UR32, UR35, UR41, and Industrial Cellular Routers prior to v35.3.0.7, which stems from a vulnerability that...

PT-2024-2762

Name of the Vulnerable Software and Affected Versions Shim versions for 32-bit systems Description The issue is related to a buffer overflow in the UEFI boot loader shim for 32-bit systems. This overflow occurs due to an addition operation involving a user-controlled value parsed from the PE bina...

PostCSS Injection Vulnerability

Andrey Sitnik postcss is an application by the individual developer Andrey Sitnik in Spain. A tool for converting styles using JS plugins. An injection vulnerability exists in versions of PostCSS prior to 8.4.31. No information about this vulnerability is available at this time, please stay tuned...

Important: python38

Issue Overview: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface. CVE-2022-37454 Affected...

Medium: python38

Issue Overview: The CryptProtectMemory function in cng.sys aka the Cryptography Next Generation driver in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, an...

CVE-2023-40725

A vulnerability has been identified in QMS Automotive All versions V12.39. The affected application returns inconsistent error messages in response to invalid user credentials during login session. This allows an attacker to enumerate usernames, and identify valid usernames...

CVE-2023-40622

SAP BusinessObjects Business Intelligence Platform Promotion Management - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application...

PT-2023-5182 · Unknown · Qms Automotive

Name of the Vulnerable Software and Affected Versions: QMS Automotive versions prior to V12.39 Description: A vulnerability has been identified in QMS Automotive that allows an attacker to enumerate usernames and identify valid usernames due to the application returning inconsistent error message...