Information disclosure

An indirect Object Reference IDOR in the Order and Invoice pages in Floorsight Customer Portal Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information...

PT-2024-22: (Unauth Remote Code Execution) in MyQ Print Server

The vulnerability was identified in MyQ Print Server, versions 8.2 patch 43. An Unauthenticated Remote Code Execution vulnerability can be exploited by an attacker to gain elevated privileges on the target server. Vulnerability status: Confirmed by vendor Date of vulnerability detection: 25.12.20...

Helix Core Server < 2023.2 Multiple Vulnerabilities

The version of Helix Core Server running on the remote host is prior to 2023.2. It is, therefore, affected by multiple vulnerabilities. - An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2. CVE-2023-45849 - In Helix Core version...

Nagios XI < 5.11.3 Multiple Vulnerabilities

According to the self-reported version of Nagios XI, the remote host is affected by multiple vulnerabilities, including the following: - A SQL injection vulnerability in the bulk modification tool allowing an unauthenticated remote attacker to run arbitrary code in the context of the database...

CVE-2023-48392 Kaifa Technology WebITR - Hard-coded Cryptographic Key

Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote attacker can generate valid token parameter and exploit this vulnerability to access system with arbitrary user account, including administrator’s account, ...

CVE-2023-48390

Multisuns EasyLog web+ has a code injection vulnerability. An unauthenticated remote attacker can exploit this vulnerability to inject code and access the system to perform arbitrary system operations or disrupt service...

CVE-2023-48390

Multisuns EasyLog web+ has a code injection vulnerability. An unauthenticated remote attacker can exploit this vulnerability to inject code and access the system to perform arbitrary system operations or disrupt service...

CVE-2023-48382

Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion LFI vulnerability in a mail deliver-related URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access...

CVE-2023-48376

SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service...

CVE-2023-48378

Softnext Mail SQR Expert has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files...

CVE-2023-48374 SmartStar Software CWS Web-Base - Use of Hard-coded Credentials

SmartStar Software CWS is a web-base integration platform, it has a vulnerability of using a hard-coded for a specific account with low privilege. An unauthenticated remote attacker can exploit this vulnerability to run partial processes and obtain partial information, but can't disrupt service o...

Path traversal

ITPison OMICARD EDM has a path traversal vulnerability within its parameter “FileName” in a specific function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files...

CVE-2023-48373 ITPison OMICARD EDM 's SMS - Path Traversal

ITPison OMICARD EDM has a path traversal vulnerability within its parameter “FileName” in a specific function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files...

CVE-2023-48372 ITPison OMICARD EDM 's SMS - SQL Injection

ITPison OMICARD EDM 's SMS-related function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify and delete database...

CVE-2023-46143 Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC

Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC...

PHOENIX CONTACT Automation Worx Software Suite Security Vulnerability

PHOENIX CONTACT Automation Worx Software Suite is an automation Worx software suite from PHOENIX CONTACT, Germany. A security vulnerability exists in PHOENIX CONTACT Automation Worx Software Suite, which originated from a vulnerability in the incorrect assignment of critical resource privileges,...

Exploit for Missing Authorization in Zoneminder

CVE-2023-26035 Unauthenticated RCE in ZoneMinder Snapshots - P...

Atlassian Jira Service Management Assets Discovery < 6.2.0 (JSDSERVER-14925)

The version of the Atlassian Jira Service Management Assets Discovery formerly Insight Discovery app running on the remote host is prior to 6.2.0. It is, therefore, affected by a remote code execution vulnerability as referenced in the JSDSERVER-14925 advisory. The vulnerability exists between th...

CVE-2023-39167 SENEC: Storage Box V1,V2 and V3 affected by improper access control vulnerability

In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data...

Wago RTU Input Validation Error Vulnerability

The WAGO RTU is a remote terminal unit from WAGO Germany for remotely monitored and controlled devices. An input validation error vulnerability exists in Wago RTU versions prior to 1.4.6.0. The vulnerability stems from the susceptibility of the WagoAppRTU MMS interpreter to incorrectly formatted...