CVE-2023-38574

Open redirect vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL...

CVE-2023-38574

Open redirect vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL...

CVE-2023-38574

CVE-2023-38574 affects the VI Web Client (i-PRO VI Web Client) prior to 7.9.6, where an open redirect (CWE-601) can be triggered by a specially crafted URL. The vulnerability could allow a remote unauthenticated attacker to redirect users to arbitrary websites, enabling phishing risk. Affected ve...

PT-2023-27603 · Unknown · Vi Web Client

Name of the Vulnerable Software and Affected Versions: VI Web Client versions prior to 7.9.6 Description: A stored cross-site scripting issue in the Map setting page allows a remote authenticated attacker to inject an arbitrary script. Recommendations: For versions prior to 7.9.6, update to versi...

PT-2023-27501 · Unknown · Vi Web Client

Name of the Vulnerable Software and Affected Versions: VI Web Client versions prior to 7.9.6 Description: A stored cross-site scripting issue in the View setting page of VI Web Client allows a remote authenticated attacker to inject an arbitrary script. Recommendations: For versions prior to 7.9....

Multiple vulnerabilities in i-PRO VI Web Client

Overview VI Web Client provided by i-PRO Co., Ltd. is Video Insight's video management software. VI Web Client contains multiple vulnerabilities listed below. Open Redirect CWE-601 - CVE-2023-38574 Reflected Cross-site Scripting CWE-79 - CVE-2023-39938 View Stored Cross-site Scripting in View...

JVN#60140221: Multiple vulnerabilities in i-PRO VI Web Client

VI Web Client provided by i-PRO Co., Ltd. is Video Insight’s video management software. VI Web Client contains multiple vulnerabilities listed below. Open Redirect CWE-601 - CVE-2023-38574 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N| Base Score: 4.7...

The vulnerability of the WebClient component of the Oracle Agile PLM application, which allows a hacker to gain access to and modify data.

The vulnerability of the WebClient component of the Oracle Agile PLM application is related to errors in processing input data. Exploiting this vulnerability may allow an attacker to gain read, modify, add, or delete access to data...

Cross site scripting

Zimbra Collaboration ZCS 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client...

CVE-2023-37580

Zimbra Collaboration ZCS 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client...

CVE-2023-37580

Zimbra Collaboration ZCS 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client...

CVE-2023-37580

Zimbra Collaboration ZCS 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client...

OpenJDK: HTTP client insufficient file name validation (8302475)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle...

PT-2023-4007

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions 8 through 8.8.15 Patch 40 Description Cross-Site Scripting XSS exists in the Zimbra Classic Web Client due to the failure of the autoSaveDraft function to properly neutralize special elements. A remote attacke...

AZL-28831 CVE-2023-29406 affecting package msft-golang for versions less than 1.20.7-1

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

OESA-2023-1389 perl-HTTP-Tiny security update

A small, simple, correct HTTP/1.1 client. Security Fixes: HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.CVE-2023-31486...

CVE-2023-36474 Interactsh server settings make users vulnerable to Subdomain Takeover

Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e app. Interactsh server used to create cname entries for app pointing to...

CVE-2023-36474 Interactsh server settings make users vulnerable to Subdomain Takeover

Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e app. Interactsh server used to create cname entries for app pointing to...

The vulnerability of the user interface of the SAP CRM WebClient UI, which allows an attacker to perform XSS attacks.

The vulnerability of the SAP CRM WebClient UI user interface lies in the lack of security measures taken to protect the web page structure. Exploiting this vulnerability allows an attacker to execute XSS attacks remotely...

F5 BIG-IP Edge Client Windows Component Installer < 7.2.4.1 Improper Certificate Validation (K000132539)

The version of the Big-IP Edge Client Windows Component Installer installed on the remote Windows host is before 7.2.4.1. An improper certificate validation vulnerability exists in BIG-IP Edge Client for Windows and macOS and may allow an attacker to impersonate a BIG-IP APM system. CVE-2023-2446...