CVE-2023-46614

Cross-Site Request Forgery CSRF vulnerability in Mat Bao Corp WP Helper Premium plugin = 4.5.1 versions...

kernel: NFSD: fix use-after-free in nfsd4_ssc_setup_dul()

An expired pointer dereference flaw was found in the NFSv4 implementation in the Linux kernel, which may negatively affect system availability when the kernel thread is signaled during a mount/unmount operation. If signalpending returns true, scheduletimeout will not be executed, causing the...

PT-2023-15300 · Online Ada · Accessibility Suite

Name of the Vulnerable Software and Affected Versions: Accessibility Suite by Online ADA versions 4.11 through 4.12 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

BigTree CMS Cross-Site Scripting Vulnerability (CNVD-2023-93329)

BigTree CMS is a content management system. A cross-site scripting vulnerability exists in BigTree CMS version v4.5.7, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can be exploited by a remote attacker to execute arbitrary code via ID...

BigTree CMS 安全漏洞

BigTree CMS is a content management system. A cross-site scripting vulnerability exists in BigTree CMS version v4.5.7, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can be exploited by a remote attacker to execute arbitrary code via ID...

CVE-2023-24410

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Contact Form - WPManageNinja LLC Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms fluentform allows SQL Injection.This issue affects Contact Form Plugin –...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, SMS alerts and product image scaling. PrestaShop themevolty v.4.0.8 version before the security vulnerability , the vulnerability stems from through...

PT-2023-6733 · Best Practical +2 · Request Tracker +2

Name of the Vulnerable Software and Affected Versions: Best Practical Request Tracker RT versions 4.4.6 and earlier Best Practical Request Tracker RT versions 5.0.4 and earlier Description: The issue allows Information Disclosure via fake or spoofed RT email headers in an email message or a...

Moodle Cross-Site Scripting Vulnerability

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. A cross-site scripting vulnerability exists in Moodle version 4.3 that stems from allowing payload injection via the searchvalue field...

CVE-2023-44219

A local privilege escalation vulnerability in SonicWall Directory Services Connector Windows MSI client 4.1.21 and earlier versions allows a local low-privileged user to gain system privileges through running the recovery feature...

CVE-2023-46375

ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery CSRF...

CVE-2023-33559

A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1 allows attackers to execute arbitrary code by supplying a crafted PHP file...

CVE-2023-46346

In the module "Product Catalog CSV, Excel, XML Export PRO" exportproducts in versions up to 4.1.1 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in...

Zscaler Client Connector Backlink Vulnerability

Zscaler Client Connector is an application from zscaler. An application that is installed on a device to ensure that Internet traffic and access to an organization's internal applications are secure and in compliance with the organization's policies, even when not on the corporate network. A...

CVE-2023-46306

The web administration interface in NetModule Router Software NRSW 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command constructed with unsanitized user input: shell metacharacters in the /admin/gnssAutoAlign.php deviceid parameter. This occurs because another thread can be start...

NetModule Router Software Operating System Command Injection Vulnerability

NetModule Router Software is a router from NetModule. A security vulnerability exists in NetModule Router Software NRSW versions 4.6.x prior to 4.6.0.106 and 4.8.x prior to 4.8.0.101, which originates from the construction of operating system commands using unpurified user input, and which can be...

IBM Cognos Dashboards on Cloud Pak for Data Authorization Issues Vulnerability

IBM Cognos Dashboards on Cloud Pak for Data is a business intelligence tool from International Business Machines IBM. A security vulnerability exists in IBM Cognos Dashboards on Cloud Pak for Data version 4.7.0, which stems from a vulnerability that could allow a remote attacker to bypass securit...

PT-2023-32236 · Undefined · Undefined

‼ CVE-2023-5647 ‼ The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in version 4.9.2. This makes it possible for authenticated attackers with subscriber privileges to delete arbitrary files on the server, which makes it possible to take over affected sites as well as...

secudos qiata fta security breach

secudos qiata fta is a secure file transfer software from Secudos Germany. The software is suitable for file operations between teams and complies with the GDPR protocol for data security. A security vulnerability exists in SECUDOS Qiata version 4.13, which stems from the presence of insecure...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the AuthenticationService. A cached token persists after the lifetime of the request due to an improper implementation of relations between ITokens and IUsers. An attacker can cau...