Cross Site Scripting

Basercms is vulnerable to Cross Site Scripting. The vulnerability is due to insufficient sanitization of user input, particularly in file upload and management features. This allows an attacker to inject malicious scripts into these variables and that can potentially lead to Cross Site Scripting...

PT-2023-12353 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fix for this issue Description: In NFC, there is a possible way to setup a default contactless payment app without user consent due to a missing permission check. This could lead to local escalation of privilege...

PT-2023-18147 · Unknown · Libdexfile

Name of the Vulnerable Software and Affected Versions: libdexfile affected versions not specified Description: The issue is related to a possible out of bounds read in libdexfile due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privilege...

Race condition

Rockwell Automation FactoryTalk View Site Edition insufficiently validates user input, which could potentially allow threat actors to send malicious data bringing the product offline. If exploited, the product would become unavailable and require a restart to recover resulting in a...

CVE-2023-46289

Rockwell Automation FactoryTalk View Site Edition (V11.0 affected) suffers from improper input validation (CVE-2023-46289). Insufficient validation could allow a remote attacker to submit malicious data, potentially rendering the product unavailable and requiring a restart to recover, i.e., a den...

WordPress Plugin VK Filter Search Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

VMware Tools Security Vulnerability

VMware Tools is an enhancement tool that comes with VMware's VMWare virtual machines, and is a driver provided by VMware to enhance the performance of virtual graphics cards and hard disks, as well as to synchronize the clocks of the virtual machine with the host computer. A security vulnerabilit...

CVE-2023-46664

Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources behind protected pages...

CVE-2023-46664 Improper Access Control in Sielco PolyEco1000

Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources behind protected pages...

UBUNTU-CVE-2023-46234

browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in dsaVerify function allows an attacker to construct signatures that can be successfully verified by any...

CVE-2023-46234

browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in dsaVerify function allows an attacker to construct signatures that can be successfully verified by any...

Sielco PolyEco1000 Security Vulnerability

Sielco PolyEco1000 is an environmental monitoring and control system from Sielco designed to monitor and control data on water quality, meteorology, gas concentrations, energy management, and environmental parameters. A security vulnerability exists in Sielco PolyEco1000 that stems from a...

Stable Diffusion WebUI Remote Command Execution Vulnerability

Stable Diffusion WebUI is an AI image processing tool developed by AUTOMATIC1111 based on the Stable Diffusion AI model, which supports file creation and image creation. A remote command execution vulnerability in Stable Diffusion WebUI, which is caused by not filtering user input when installing...

Apache ShenYu Server-Side Request Forgery Vulnerability

Apache ShenYu is an asynchronous , high-performance , cross-language , responsive API gateway of the United States Apache Apache Foundation . A server-side request forgery vulnerability exists in Apache ShenYu version 2.5.1, which stems from a failure of the sandbox/proxyGateway endpoint to...

CVE-2023-46306

The web administration interface in NetModule Router Software NRSW 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command constructed with unsanitized user input: shell metacharacters in the /admin/gnssAutoAlign.php deviceid parameter. This occurs because another thread can be start...

CVE-2023-46306

The web administration interface in NetModule Router Software NRSW 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command constructed with unsanitized user input: shell metacharacters in the /admin/gnssAutoAlign.php deviceid parameter. This occurs because another thread can be start...

CVE-2023-5618

The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 1.4.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...

CVE-2023-5618

The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 1.4.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...

CVE-2023-4999 Horizontal scrolling announcement <= 9.2 - Authenticated (Subscriber+) SQL Injection via Shortcode

The Horizontal scrolling announcement plugin for WordPress is vulnerable to SQL Injection via the plugin's horizontal-scrolling shortcode in versions up to, and including, 9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2023-4968 WPLegalPages <= 2.9.2 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode

The WPLegalPages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wplegalpage' shortcode in versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...