Huawei EulerOS: Security Advisory for procps-ng (EulerOS-SA-2023-3366)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Vulnerabilities fixed in Adobe InDesign

Adobe has fixed vulnerabilities in InDesign. A malicious person could exploit the vulnerabilities to cause a denial-of-service cause or to gain access to sensitive data. The malicious party does not need prior authorizations to do so. Adobe has released updates to fix the vulnerabilities in versi...

Design/Logic Flaw

A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3. An app may be able to access sensitive user data...

CVE-2023-5711

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sdphpinfo function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level acces...

PT-2023-9064 · Oracle · Oracle E-Business Suite

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.9 through 12.2.13 Description: The issue is related to insufficient input validation in the REST Services component of the Oracle Applications Framework. This can allow a remote attacker to gain...

PT-2024-18848 · Oracle · Peoplesoft Enterprise Cc Common Application Objects

Name of the Vulnerable Software and Affected Versions: PeopleSoft Enterprise CC Common Application Objects version 9.2 Description: The issue allows a low-privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks can...

PT-2023-9316 · Oracle · Oracle Enterprise Asset Management

Name of the Vulnerable Software and Affected Versions: Oracle Enterprise Asset Management versions 12.2.11 through 12.2.13 Description: The issue is related to insufficient input validation in the Work Definition Issues component of Oracle Enterprise Asset Management. This allows a low-privileged...

PT-2023-9575 · Oracle · Oracle E-Business Suite +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.13 Description: The issue is related to a vulnerability in the Award Processes component of Oracle Contract Lifecycle Management for Public Sector, which is part of Oracle E-Business Suite...

PT-2023-9830 · Oracle · Oracle Financial Services Revenue Management/Billing

Name of the Vulnerable Software and Affected Versions: Oracle Financial Services Revenue Management and Billing versions 6.0.0.0.0 through 6.1.0.0.0 Description: The issue is related to insufficient input validation in the Chatbot component of Oracle Financial Services Revenue Management and...

PT-2023-9322 · Oracle · Oracle E-Business Suite

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.13 Description: The issue is related to a component of Oracle E-Business Suite, specifically the Quality Management Specs in the Oracle Process Manufacturing Product Development product. It allows a...

PT-2023-9318 · Oracle · Oracle E-Business Suite

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.12 through 12.2.13 Description: The issue is related to insufficient protection of service data in the Allocation Rules component of Oracle Process Manufacturing Financials. It allows a low-privileged...

SQL Injection

hoteldruid is vulnerable to SQL injection. The vulnerability is due to there is no sanitization of user inputs in numcaselle POST parameter. This allows an attacker to inject malicious SQL commands, and potentially leads to unauthorized data access...

SQL Injection

hoteldruid is vulnerable to SQL injection. The vulnerability is due to there is no sanitization of user inputs in various parameters of the creaprezzi.php page in HotelDruid. This allows an attacker to inject malicious SQL commands, and potentially leads to unauthorized data access...

CVE-2023-5417

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfupdatecategory function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above,...

CVE-2023-5415

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfaddcategory function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

CVE-2023-5416

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfdeletecategory function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above,...

CVE-2023-5386

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfdeleteposts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

Design/Logic Flaw

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfaf2savepost function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

CVE-2023-5387 Funnelforms Free <= 3.4 - Missing Authorization to Enable/Disable Dark Mode

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfaf2triggerdarkmode function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and...

CVE-2023-5411

CVE-2023-5411 affects Funnelforms Free for WordPress (versions up to 3.4). Root cause: missing capability check in fnsf_af2_save_post, enabling authenticated users with subscriber-level permissions or higher to modify certain post values. Impact is constrained by fixed values passed to wp_update_...