CVE-2023-43275

Cross-Site Request Forgery CSRF vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalogadd.php, allows attackers to create crafted web pages due to a lack of verification of the token value of the submitted form...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, SMS alerts and product image scaling. A security vulnerability exists in PrestaShop Orders CSV, Excel Export PRO before v5.0, which originates from an SQL...

PT-2023-21928 · Intel · Intel(R) Aptio* V Uefi Firmware Integrator Tools

Name of the Vulnerable Software and Affected Versions: IntelR Aptio V UEFI Firmware Integrator Tools affected versions not specified Description: The issue is related to improper initialization in IntelR Aptio V UEFI Firmware Integrator Tools, which may allow an authenticated user to potentially...

Zoom Rooms Backlink Vulnerability

Zoom Rooms is a software-based conferencing system from Zoom USA. system that allows web conferencing on fixed endpoints, similar to traditional video conferencing systems. A backlink vulnerability previously existed in Zoom Rooms version 5.16.0, which stemmed from improper link hopping. could...

CVE-2023-40215

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Demonisblack demon image annotation allows SQL Injection.This issue affects demon image annotation: from n/a through 5.1...

CVE-2023-45024

Best Practical Request Tracker RT 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder...

Vulnerabilities fixed in Nagios XI

Nagios has fixed vulnerabilities in Nagios XI. A malicious party could exploit the vulnerabilities to circumvent a circumvention of a security measure, to perform an SQL injection execute or for a cross-site scripting attack. Such attacks can lead to execution of arbitrary code and access to syst...

Eclipse Glassfish Security Vulnerability

Eclipse GlassFish is an open source application server from the Eclipse Foundation. A security vulnerability exists in Eclipse Glassfish versions 5 and 6, which stems from the use of older versions of the JDK versions prior to 6u211, prior to 7u201, and prior to 8u191, and can be exploited by an...

Mattermost Security Vulnerabilities

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost Desktop version 5.5.0 and prior versions that stems from improper privilege management...

SUSE CVE-2021-2226

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Information Schema. Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromis...

UCS@school Security Breach

UCS@school is a comprehensive solution that provides access to school infrastructure and applications as well as a complete toolset for operating them. A security vulnerability exists in UCS@school version v.5.0. An attacker can exploit this vulnerability to execute arbitrary code and gain...

PT-2023-6733 · Best Practical +2 · Request Tracker +2

Name of the Vulnerable Software and Affected Versions: Best Practical Request Tracker RT versions 4.4.6 and earlier Best Practical Request Tracker RT versions 5.0.4 and earlier Description: The issue allows Information Disclosure via fake or spoofed RT email headers in an email message or a...

OESA-2023-1774 mosquitto security update

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

OESA-2023-1772 mosquitto security update

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

Vinchin Backup and Recovery Security Vulnerabilities

Vinchin Backup and Recovery is an easy-to-use, safe and reliable virtual machine data protection software from China Yunqi Technology Vinchin. It is used for backup and recovery. A security vulnerability exists in Vinchin Backup and Recovery that stems from the presence of hard-coded credentials...

Shaanxi Chanming Education Technology Score Query System SQL Injection Vulnerability

Shaanxi Chanming Education Technology Score Query System is a score query system from Shaanxi Chanming Education Technology. A security vulnerability exists in Shaanxi Chanming Education Technology Score Query System version 5.0, which originates from the presence of an unknown function that caus...

PT-2023-32326 · Unknown · Shaanxi Chanming Education Technology Score Query System

Name of the Vulnerable Software and Affected Versions: Shaanxi Chanming Education Technology Score Query System version 5.0 Description: A critical issue affects the system's unknown processing, allowing for SQL injection through the manipulation of the stuIdCard argument. The attack can be...

PT-2023-8528 · Vinchin · Vinchin Backup & Recovery

Name of the Vulnerable Software and Affected Versions: Vinchin Backup & Recovery versions 5.0. through 7.0. Description: The issue is related to a lack of input data sanitization, which can allow a remote attacker to execute arbitrary commands. This is a command injection vulnerability. The...

PT-2023-29676 · WordPress · Joovii Sendle Shipping Plugin

Name of the Vulnerable Software and Affected Versions: Joovii Sendle Shipping Plugin plugin versions = 5.13 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...

PT-2023-28939 · WordPress · Litespeed Cache

Name of the Vulnerable Software and Affected Versions: LiteSpeed Cache plugin for WordPress versions up to, and including, 5.6 Description: The issue is related to Stored Cross-Site Scripting via the esi shortcode due to insufficient input sanitization and output escaping on user-supplied...