3148 matches found
Certain HP LaserJet Pro Print Products - Potential Remote Code Execution, Information Disclosure
Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forgery SSRF using the Web Service Eventing model. Update the printer firmware...
Certain HP LaserJet Pro Print Products – Potential Buffer Overflow and/or Denial of Service
Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Denial of Service when using the backup & restore feature through the embedded web service on the device. Update the printer firmware...
The vulnerability of the Administrative XML Web Service (AXL) interface in Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) systems allows a attacker to cause service failures.
The vulnerability of the Administrative XML Web Service AXL interface in Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition systems is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious...
CVE-2023-35811
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the REST API. By using crafted requests, custom SQL code can be injected through the REST API because of missing input validation. Regular user privileges can use...
SugarCRM Enterprise SQL注入漏洞
SugarCRM Enterprise is an enterprise version of an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing for different customer needs, managing and distributing sales leads, and enabling information sharing and tracking of sales...
PT-2023-25326 · Sugarcrm · Sugarcrm Enterprise
Name of the Vulnerable Software and Affected Versions: SugarCRM Enterprise versions prior to 11.0.6 SugarCRM Enterprise versions 12.x prior to 12.0.3 Description: An issue has been identified in the REST API of SugarCRM, allowing for a Bean Manipulation vulnerability. This vulnerability can be...
SugarCRM Enterprise 安全漏洞
SugarCRM Enterprise is an enterprise version of an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing for different customer needs, managing and distributing sales leads, and enabling information sharing and tracking of sales...
PT-2023-25076 · Chamilo · Chamilo
Name of the Vulnerable Software and Affected Versions: Chamilo versions 1.11. through 1.11.18 Description: A command injection issue in the wsConvertPpt component allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name. Recommendations: For Chamilo versio...
CVE-2023-34345
AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can access arbitrary files, which may lead to information disclosure...
CVE-2021-4339
The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file on the /1/api/ulisting-user/search REST-API route in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to...
GHSA-5CR9-5JX3-2G39 avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields
Summary Some avo fields are vulnerable to XSS when rendering html based content. Details During the analysis of the web application, a rendered field was discovered that did not filter JS / HTML tags in a safe way and can be abused to execute js code on a client side. The trix field uses the trix...
golang: net/http, mime/multipart: denial of service from excessive resource consumption
A flaw was found in Go, where it is vulnerable to a denial of service caused by an excessive resource consumption flaw in the net/http and mime/multipart packages. By sending a specially-crafted request, a remote attacker can cause a denial of service...
CVE-2023-2299
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.2.10 due to a missing capability check on the processAction...
GHSA-QJ8W-RV5X-2V9H Duplicate Advisory: Starlette vulnerable to directory traversal
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v5gw-mw7f-84px. This link is maintained to preserve external references. Original Description Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote...
CVE-2023-29159
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette...
CVE-2023-29159
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette...
DEBIAN-CVE-2023-29159
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette...
PYSEC-2023-83
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette...
CVE-2023-29159
CVE-2023-29159 covers a directory traversal vulnerability in Starlette. Affected are Starlette versions 0.13.5 and later and prior to 0.27.0, where improper validation of requests to StaticFiles can allow a remote, unauthenticated attacker to view arbitrary files in a Starlette-based web service....