CVE-2023-28629

GoCD is an open source continuous delivery server. GoCD versions before 23.1.0 are vulnerable to a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An attacker that h...

Cross site scripting

GoCD is an open source continuous delivery server. GoCD versions before 23.1.0 are vulnerable to a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An attacker that h...

CVE-2023-28629 Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd

GoCD is an open source continuous delivery server. GoCD versions before 23.1.0 are vulnerable to a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An attacker that h...

CVE-2023-22300

An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unauthorized actions by viewing the logs. This action would also grant the attacker privilege escalation...

CVE-2023-28655

A malicious user could leverage this vulnerability to escalate privileges or perform unauthorized actions in the context of the targeted privileged users...

Privilege escalation

An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unauthorized actions by viewing the logs. This action would also grant the attacker privilege escalation...

Code injection

A malicious user could leverage this vulnerability to escalate privileges or perform unauthorized actions in the context of the targeted privileged users...

CVE-2023-28655 CVE-2023-28655

A malicious user could leverage this vulnerability to escalate privileges or perform unauthorized actions in the context of the targeted privileged users...

CVE-2023-28655

SAUTER EY-modulo 5 Building Automation Stations (notably EY-AS525F001 with moduWeb) are associated with CVE-2023-28655, classified as Cross-Site Scripting (CWE-79) per ICSA-23-082-03. The advisory indicates a malicious user could leverage this vulnerability to escalate privileges or perform unaut...

CVE-2023-28655 CVE-2023-28655

A malicious user could leverage this vulnerability to escalate privileges or perform unauthorized actions in the context of the targeted privileged users...

CVE-2023-22300 CVE-2023-22300

An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unauthorized actions by viewing the logs. This action would also grant the attacker privilege escalation...

CVE-2023-22300 CVE-2023-22300

An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unauthorized actions by viewing the logs. This action would also grant the attacker privilege escalation...

CVE-2023-22300

CVE-2023-22300 affects SAUTER EY-modulo 5 Building Automation Stations (EY-AS525F001 with moduWeb). The ICS advisory describes an unauthenticated remote attacker who can force all authenticated users (including admins) to perform unauthorized actions by viewing logs, enabling privilege escalation...

PT-2023-21878 · Sauter +1 · Ey-As525F001 With Moduweb +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A malicious user could leverage this issue to escalate privileges or perform unauthorized actions in the context of the targeted privileged users...

PT-2023-16744 · WordPress · Coupon Zen

Name of the Vulnerable Software and Affected Versions: Coupon Zen WordPress plugin versions prior to 1.0.6 Description: The issue concerns a lack of CSRF check when activating plugins, which could allow attackers to make logged-in admins activate arbitrary plugins present on the blog via a CSRF...

PT-2023-21716 · Onesignal · Onesignal

Name of the Vulnerable Software and Affected Versions: OneSignal affected versions not specified Description: The issue concerns a workflow triggered by closed issues, utilizing a GitHub repository token with full write permissions. This allows an attacker to potentially take over the GitHub...

WordPress Creative Mail Plugin < 1.6.0 Multiple CSRF Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:constantcontact:creativemail"; if description...

PT-2023-18410 · Sauter +1 · Ey-As525F001 With Moduweb +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unauthorized actions by viewing the log...

Privilege Escalation

github.com/tailscale/tailscale is vulnerable to Privilege Escalation. The vulnerability exists in the beIncubator function of incubator.go due to the differences in the FreeBSD setgroups system call, which allows an attacker to gain access and perform unauthorized actions if the host is running...

SAUTER EY-modulo 5 Building Automation Station 跨站脚本漏洞

SAUTER EY-modulo 5 Building Automation Station is a complete building management solution from SAUTER. A security vulnerability exists in SAUTER EY-modulo 5 Building Automation Station. An attacker could use this vulnerability to elevate privileges or perform unauthorized actions in the target...