PT-2023-13967 · Opentext · Opentext Archive Center Administration

Name of the Vulnerable Software and Affected Versions: OpenText Archive Center Administration versions prior to 21.3 Description: The issue allows XXE attacks, where authenticated users could upload XML files that are not sufficiently validated, potentially leading to data exfiltration or localiz...

CVE-2023-23302

The Toybox.GenericChannel.setDeviceConfig API method in CIQ API version 1.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the executi...

CVE-2023-23302

The Toybox.GenericChannel.setDeviceConfig API method in CIQ API version 1.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the executi...

Connect IQ 安全漏洞

Connect IQ CIQ is a technology platform and ecosystem from Garmin Switzerland designed to extend and customize the functionality of its smartwatches and health trackers. Connect IQ suffers from a security vulnerability that stems from an unvalidated API function parameter that results in a buffer...

Connect IQ 安全漏洞

Connect IQ CIQ is a technology platform and ecosystem from Garmin Switzerland designed to extend and customize the functionality of its smartwatches and health trackers. Connect IQ suffers from a security vulnerability that stems from not validating the parameters of an API function, which result...

Connect IQ 安全漏洞

Connect IQ CIQ is a technology platform and ecosystem from Garmin Switzerland designed to extend and customize the functionality of its smartwatches and health trackers. Connect IQ suffers from a security vulnerability that stems from an unvalidated API function parameter that results in a buffer...

Connect IQ 输入验证错误漏洞

Connect IQ CIQ is a technology platform and ecosystem from Garmin Switzerland designed to extend and customize the functionality of its smartwatches and health trackers. Connect IQ suffers from a security vulnerability that stems from an unvalidated parameter in an API function that results in an...

IBM InfoSphere Information Server SQL注入漏洞

IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. An SQL injection vulnerability exists in IBM InfoSphere Information Server version 11.7, which...

Online Exam System SQL注入漏洞

Online Exam System is an online exam system. Online Exam System v1.0 suffers from a SQL injection vulnerability, which originates from the lack of validation of the parameters columns, data of /classes/Master.php?f=deleteservice/kelasdosen/data for external input SQL statements. An attacker can...

Jenkins Plugin Sidebar Link 路径遍历漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

The vulnerability of the udmabuf_vm_fault() function in the drivers/dma-buf/udmabuf.c module of Linux kernel allows a attacker to escalate their privileges and execute arbitrary code.

The vulnerability of the udmabufvmfault function in the drivers/dma-buf/udmabuf.c module of Linux operating systems is related to unvalidated array indexing due to incorrect data validation. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary code...

Veritas Technologies Infoscale Operations Manager 操作系统命令注入漏洞

Veritas Technologies Infoscale Operations Manager is a suite of software from Veritas Technologies, Inc. that is used to manage the entire InfoScale deployment. The software provides multi-cluster management, customized interfaces, and centralized audit logging. A security vulnerability exists in...

CVE-2023-25829

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks...

Open redirect

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and 10.9.1 that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks...

CVE-2023-25829

The CVE-2023-25829 issue affects Esri Portal for ArcGIS ≤11.0, where an unvalidated redirect allows a remote, unauthenticated attacker to craft a URL that redirects victims to arbitrary sites, facilitating phishing. The NVD and related sources rate it at CVSS v3.1 Base Score 6.1 (Medium) with net...

CVE-2023-25829 BUG-000155001 - Unvalidated redirect in Portal for ArcGIS.

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks...

CVE-2023-25829 BUG-000155001 - Unvalidated redirect in Portal for ArcGIS.

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks...

PT-2023-16342 · WordPress · Wp-D3

Name of the Vulnerable Software and Affected Versions: Wp-D3 WordPress plugin versions prior to 2.4.2 Description: The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the lack of validation and escaping of some shortcode attributes...

Ghost 信息泄露漏洞

Ghost CMS is an open source headless content management system CMS written in JavaScript from the Ghost Foundation in Singapore. An information disclosure vulnerability exists in Ghost versions prior to 5.46.1 that stems from a lack of validation when filtering on public API endpoints , which can...

Companymaps 8.0 Cross Site Scripting Vulnerability

Exploit Title: Reflected Cross Site Scripting - Exploit Author: Lucas Noki 0xPrototype - Vendor Homepage: https://github.com/vogtmh - Software Link: https://github.com/vogtmh/cmaps - Version: 8.0 - Tested on: Mac, Windows, Linux - CVE : CVE-2023-29808 Description: The vulnerability found is...