CVE-2023-3049

Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection.This issue affects Lockcell: before 15...

PT-2023-21263

Name of the Vulnerable Software and Affected Versions Marcelotorres Redirect After Login plugin versions 0.1.9 and earlier Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations For Marcelotorres...

PT-2023-22736

Name of the Vulnerable Software and Affected Versions TMT Lockcell versions prior to 15 Description The issue is related to the reliance on cookies without validation and integrity checking in a security decision, which allows for privilege abuse and authentication bypass. Recommendations For...

CVE-2023-35054

In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible...

CVE-2023-3140 KNIME Hub Web Application is vulnerable to clickjacking

Missing HTTP headers X-Frame-Options, Content-Security-Policy in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a...

PT-2023-11851 · WordPress · Kingcomposer

Name of the Vulnerable Software and Affected Versions: The Page Builder: KingComposer plugin for WordPress versions prior to 2.9.4 Description: The issue is related to Stored Cross-Site Scripting via shortcode due to insufficient input sanitization and output escaping. This allows authenticated...

DEBIAN-CVE-2023-32215

Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presu...

CVE-2023-29537

Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnerability affects Firefox for Android 112, Firefox 112, and Focus for Android 112...

CVE-2023-29540

Using a redirect embedded into sourceMappingUrls could allow for navigation to external protocol links in sandboxed iframes without allow-top-navigation-to-custom-protocols. This vulnerability affects Firefox for Android 112, Firefox 112, and Focus for Android 112...

UBUNTU-CVE-2023-25748

By displaying a prompt with a long description, the fullscreen notification could have been hidden, resulting in potential user confusion or spoofing attacks. This bug only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox 111...

Mobatime 代码问题漏洞

Mobatime is a time and frequency synchronization solution from Mobatime, Inc. A security vulnerability exists in versions prior to Mobatime 06.7.2022 that originates from allowing a malicious user to upload a Web Shell to a Web server...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 110, which originates after downloading a Windows. url shortcut from the local file system, an attacker could provide a remote path...

UBUNTU-CVE-2023-22652

A Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in openSUSE libeconf leads to DoS via malformed config files. This issue affects libeconf: before 0.5.2...

JetBrains Ktor framework 安全漏洞

JetBrains Ktor framework is a web application framework from the Czech company JetBrains. A security vulnerability exists in JetBrains Ktor framework versions prior to 2.3.1, which stems from a header for authentication data that can be added to an exception message...

SUSE CVE-2023-26130

Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehaviors. Note: This issue is present due...

phpMyFAQ 跨站脚本漏洞

phpMyFAQ is a multi-language, fully database-driven FAQ system by the individual developer Thorsten Rinne. A cross-site scripting vulnerability exists in phpMyFAQ versions prior to 3.1.14, which stems from the presence of a stored cross-site scripting XSS vulnerability...

PT-2023-24752 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2023.05 Description: The issue concerns a specific endpoint that was vulnerable to brute force attacks. Recommendations: For versions prior to 2023.05, update to version 2023.05 or later to resolve the iss...

PT-2023-3153 · Yhirose · Cpp-Httplib

Name of the Vulnerable Software and Affected Versions: yhirose/cpp-httplib versions prior to 0.12.4 Description: The issue is related to the incomplete fix for a previous problem, which allows an attacker to inject arbitrary HTTP headers when untrusted user input is used to set the content-type...

CVE-2023-2946

Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1...

PT-2023-24595 · Minio · Minio Console

Name of the Vulnerable Software and Affected Versions: Minio Console versions prior to 0.28.0 Description: The issue allows Unicode RIGHT-TO-LEFT OVERRIDE characters to be used to mask the original filename. This can potentially lead to misleading or hidden file information. Recommendations: For...