PT-2023-2442 · Ftp Admin · Ftp Admin

Name of the Vulnerable Software and Affected Versions: tpAdmin version 1.3.12 Description: A critical vulnerability was found in the function remote of the file applicationadmincontrollerUpload.php. The manipulation of the argument url leads to server-side request forgery. It is possible to launc...

PT-2023-20909 · Unknown +1 · Prestashop +1

Name of the Vulnerable Software and Affected Versions: Prestashop cdesigner versions 3.1.3 through 3.1.8 Description: A code injection issue was found in the component CdesignerSaverotateModuleFrontController::initContent. This allows for code injection, potentially leading to unauthorized access...

PT-2023-2447

Name of the Vulnerable Software and Affected Versions Novi Survey versions prior to 8.9.43676 Description The issue is related to insecure deserialization, allowing remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stor...

PT-2023-20900 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version US AC10V4.0si V16.03.10.13 cn Description: The issue is related to a stack overflow via the sub 45DC58 function, allowing attackers to cause a Denial of Service DoS or execute arbitrary code via a crafted payload...

PT-2023-19981 · Tenda · Tenda Ac5

Name of the Vulnerable Software and Affected Versions: Tenda AC5 version US AC5V1.0RTL V15.03.06.28 Description: The issue is related to a stack overflow via the fromSetSysTime function, allowing attackers to cause a Denial of Service DoS or execute arbitrary code via a crafted payload...

PT-2023-19992 · Tenda · Tenda Ac5

Name of the Vulnerable Software and Affected Versions: Tenda AC5 version US AC5V1.0RTL V15.03.06.28 Description: The issue is related to a stack overflow via the add white node function, which can be exploited by attackers to cause a Denial of Service DoS or execute arbitrary code using a crafted...

PT-2023-19989 · Tenda · Tenda Ac5

Name of the Vulnerable Software and Affected Versions: Tenda AC5 version US AC5V1.0RTL V15.03.06.28 Description: The issue is related to a stack overflow via the form fast setting wifi set function, which can be exploited to cause a Denial of Service DoS or execute arbitrary code using a crafted...

PT-2023-20899 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version US AC10V4.0si V16.03.10.13 cn Description: The issue is related to a stack overflow via the R7WebsSecurityHandler function, allowing attackers to cause a Denial of Service DoS or execute arbitrary code via a crafted payload...

PT-2023-20896 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 US AC10V4.0si V16.03.10.13 cn Description: The issue is related to a stack overflow via the get parentControl list Info function, allowing attackers to cause a Denial of Service DoS or execute arbitrary code via a crafted payload...

PT-2023-20897 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version US AC10V4.0si V16.03.10.13 cn Description: The issue is related to a stack overflow via the sub 46AC38 function, which can be exploited by attackers to cause a Denial of Service DoS or execute arbitrary code using a crafted...

CVE-2023-28849

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.7, GLPI inventory endpoint can be used to drive a SQL injection attack. It can also be used to store malicious code that could be used to perform XSS attack. By default, GLPI inventory...

CVE-2023-29006

The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated user that has access to standard interface can craft an URL that can be used to execute a system command. Versions 2.7.7 and 2.10.1 conta...

CVE-2023-28838

GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection vulnerability allow users with access rights to statistics or reports to extract all data from database and, in some cases, write a webshell on the server...

Sql injection

GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection vulnerability allow users with access rights to statistics or reports to extract all data from database and, in some cases, write a webshell on the server...

Design/Logic Flaw

The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated user that has access to standard interface can craft an URL that can be used to execute a system command. Versions 2.7.7 and 2.10.1 conta...

CVE-2023-28838

GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection vulnerability allow users with access rights to statistics or reports to extract all data from database and, in some cases, write a webshell on the server...

Sql injection

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.7, GLPI inventory endpoint can be used to drive a SQL injection attack. It can also be used to store malicious code that could be used to perform XSS attack. By default, GLPI inventory...

CVE-2023-29006 Order GLPI plugin vulnerable to remote code execution from authenticated user

The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated user that has access to standard interface can craft an URL that can be used to execute a system command. Versions 2.7.7 and 2.10.1 conta...

CVE-2023-28849 GLPI vulnerable to SQL injection and Stored XSS via inventory agent request

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.7, GLPI inventory endpoint can be used to drive a SQL injection attack. It can also be used to store malicious code that could be used to perform XSS attack. By default, GLPI inventory...

CVE-2023-28849 GLPI vulnerable to SQL injection and Stored XSS via inventory agent request

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.7, GLPI inventory endpoint can be used to drive a SQL injection attack. It can also be used to store malicious code that could be used to perform XSS attack. By default, GLPI inventory...