CVE-2023-46317

Knot Resolver before 5.7.0 performs many TCP reconnections upon receiving certain nonsensical responses from servers...

CVE-2022-4943

The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin settings in versions up to, and including, 5.6.5. This makes it possible for unauthenticated attackers to change the plugin's settings...

Yamcs Cross-Site Scripting Vulnerability

Yamcs is an open source software framework from Yamcs Open Source. It is used to command and control spacecraft, satellites, payloads, ground stations and ground equipment. A security vulnerability exists in Yamcs version 5.8.6, which originates from a method that allows you to upload an HTML fil...

CVE-2023-45057

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Hitsteps Web Analytics plugin = 5.86 versions...

CVE-2023-22087

Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications component: Opera. The supported version that is affected is 5.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hospitality OPERA 5...

CVE-2023-22085

Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications component: Opera. The supported version that is affected is 5.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hospitality OPERA 5...

CVE-2023-36953

TOTOLINK CP300+ V5.2cu.7594B20200910 and before is vulnerable to command injection...

CVE-2023-44037

An issue in ZPE Systems, Inc Nodegrid OS v.5.8.10 thru v.5.8.13 and v.5.10.3 thru v.5.10.5 allows a remote attacker to obtain sensitive information via the TACACS+ server component...

CVE-2023-34977

A cross-site scripting XSS vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.0 2023/07/27 and later...

Vulnerabilities fixed in Kofax Power PDF

Kofax has fixed vulnerabilities in Power PDF. A malicious person could exploit the vulnerabilities to execute arbitrary code with privileges of the victim, or to gain access to sensitive data. To do this, the malicious party must trick the victim into opening a malicious file to open, or follow a...

Nokelock Security Vulnerability

Nokelock is an application from Nokelock Inc. A security vulnerability exists in Nokelock Smart padlock O1 version 5.3.0 that stems from improper privilege management...

SUSE CVE-2023-3592

In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property types...

NXLog Cross-Site Scripting Vulnerability

Nxlog is a log collection and centralization software from Nxlog, Inc. that supports multiple operating systems. A cross-site scripting vulnerability exists in NXLog Manager version 5.6.5633, which arises from improper cleaning of input parameters and allows an attacker to inject a malicious...

ALPINE-CVE-2023-3592

In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property types...

DEBIAN-CVE-2023-3592

In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property types...

PT-2023-31962 · WordPress · Font Awesome Integration

Name of the Vulnerable Software and Affected Versions: Font Awesome Integration plugin for WordPress versions up to, and including, 5.0 Description: The issue is related to Stored Cross-Site Scripting via the 'fawesome' shortcode due to insufficient input sanitization and output escaping on...

PT-2023-31778 · WordPress · The Contact Form By Formget

Name of the Vulnerable Software and Affected Versions: The Contact Form by FormGet plugin for WordPress versions up to, and including, 5.5.5 Description: The issue is related to Stored Cross-Site Scripting via the formget shortcode due to insufficient input sanitization and output escaping on...

PT-2023-27992 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: An issue in the component /common/DownController.java of JFinalCMS allows attackers to execute a directory traversal. Recommendations: For JFinalCMS version 5.0.0, consider restricting access to the...

SUNNET WMPro SQL Injection Vulnerability

SUNNET SUNNET WMPro is a set of online learning platform from Taiwan-based SUNNET. A SQL injection vulnerability exists in SUNNET WMPro V5, which is caused by insufficient filtering of user input in the FAQ function, resulting in a SQL injection vulnerability...

SUNNET WMPro Operating System Command Injection Vulnerability

SUNNET SUNNET WMPro is an online learning platform from Taiwan-based SUNNET. An OS command injection vulnerability exists in SUNNET WMPro V5, which is caused by insufficient filtering of user input in the file management function, resulting in an OS command injection vulnerability...