CVE-2023-34673

Elenos ETG150 FM transmitter running on version 3.12 was discovered to be leaking SMTP credentials and other sensitive information by exploiting the publicly accessible Memcached service. The attack can occur over the public Internet in some cases...

Elenos ETG150 FM transmitter 安全漏洞

Elenos ETG150 is an FM transmitter from Elenos. A security vulnerability exists in the Elenos ETG150 FM transmitter version 3.12 that stems from incorrect access control. An attacker can exploit the vulnerability to escalate user role privileges using a user profile...

HongCMS 跨站请求伪造漏洞

HongCMS is an open source lightweight content management system CMS. A cross-site request forgery CSRF vulnerability exists in HongCMS version 3.0.0. An attacker can exploit this vulnerability to execute arbitrary code and elevate privileges via the updateusers parameter...

Moodle 跨站脚本漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle that stems from the presence of a cross-site scripting XSS vulnerability. Affected products a...

jjeecg-boot 代码问题漏洞

JEECG jjeecg-boot is a low-code development platform based on a code generator from JEECG. A security vulnerability exists in jjeecg-boot version V3.5.0, which originates from an unauthorized arbitrary file upload issue in the /jeecg-boot/jmreport/upload interface...

CVE-2023-34845

Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content. This vulnerability allows attackers to execute arbitrary web scripts or HTML via uploading a crafted SVG file. NOTE: the product's security model is that users are trusted by the...

CVE-2023-25972

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in IKSWEB WordPress Старт plugin = 3.7 versions...

WordPress Plugin MStore API 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

JerryScript 安全漏洞

JerryScript is a lightweight JavaScript engine from the Jerryscript project. A security vulnerability exists in JerryScript version 3.0, which stems from the presence of an assertion failure issue...

CVE-2023-33620

GL.iNET GL-AR750S-Ext firmware v3.215 uses an insecure protocol in its communications which allows attackers to eavesdrop via a man-in-the-middle attack...

Adslr VEC40G 命令注入漏洞

The Adslr VEC40G is a high performance security gateway from Flying Fish Star Technology Adslr, Chengdu, China. A security vulnerability exists in the Adslr VEC40G version 3.0, which stems from an incorrect operation of the parameter restart that can lead to a denial of service...

PrestaShop SQL注入漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image scaling. A security vulnerability exists in PrestaShop jmspagebuilder version 3.x. The vulnerability stems from a SQL...

CVE-2023-28399

Incorrect permission assignment for critical resource exists in CONPROSYS HMI System CHS versions prior to 3.5.3. ACL Access Control List is not appropriately set to the local folder where the affected product is installed, therefore a wide range of privileges is permitted to a user of the PC whe...

CVE-2022-46361

An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along with a backup configuration, which could result in the execution of unwanted commands. This issue affects OneWireless all versions up to...

ALPINE-CVE-2023-2650

Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJobj2txt directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience...

PT-2023-22146 · Artistscope · Artistscope Copysafe Web Protection

Name of the Vulnerable Software and Affected Versions: ArtistScope CopySafe Web Protection plugin versions = 3.13 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...

PT-2023-24262 · Unknown +1 · Prestashop +1

Name of the Vulnerable Software and Affected Versions: PrestaShop versions through 3.6.1 Description: The issue allows sensitive SQL calls to be executed with a trivial HTTP request, which can be exploited to forge a blind SQL injection. This can occur in the Store Commander scexportcustomers...

CVE-2023-33791

A stored cross-site scripting XSS vulnerability in the Create Provider Accounts /circuits/provider-accounts/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

CVE-2023-33795

A stored cross-site scripting XSS vulnerability in the Create Contact Roles /tenancy/contact-roles/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

CVE-2023-1508

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Adam Retail Automation Systems Mobilmen Terminal Software allows SQL Injection.This issue affects Mobilmen Terminal Software: before 3...