PT-2023-20550 · Tibco Software · Tibco Ebx +1

Name of the Vulnerable Software and Affected Versions: TIBCO EBX versions 5.9.22 and below TIBCO EBX versions 6.0.13 and below TIBCO Product and Service Catalog powered by TIBCO EBX versions 5.0.0 and below Description: The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO...

CVE-2023-6097 SQL Injection on ICSSolution ICS Business Manager

A SQL injection vulnerability has been found in ICS Business Manager, affecting version 7.06.0028.7089. This vulnerability could allow a remote user to send a specially crafted SQL query and retrieve all the information stored in the database. The data could also be modified or deleted, causing t...

Saad Irfan RemoteClinic Security Vulnerability

Saad Irfan RemoteClinic is a Saad Irfan open source application. It provides the ability to remotely manage your clinic via the Web. A security vulnerability exists in RemoteClinic version 2.0, which stems from a SQL injection vulnerability in the parameter ID of the file /medices/stocks.php...

CVE-2023-5516

Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical detai...

PT-2023-18103 · Unknown · Permission Manager

Name of the Vulnerable Software and Affected Versions: Permission Manager affected versions not specified Description: The issue allows an attacker to determine whether an app is installed without query permissions, due to side channel information disclosure. This could lead to local information...

CVE-2023-45228

The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by sending a single HTTP POST request with modified parameters...

PT-2023-21033 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue is related to an unauthenticated SQL injection in the GetRoomChanges method, allowing unauthenticated attackers to extract or modify all data. Recommendations: For versions...

Weintek cMT Buffer Error Vulnerability

Weintek cMT is a human machine interface application from Weintek. A security vulnerability exists in the Weintek cMT3000 HMI Web CGI, which stems from the fact that cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypa...

CVE-2023-5391

A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a specifically crafted packet to the application...

Citadel WebCit vulnerable to cross-site scripting on Instant Messaging facility

Overview Citadel WebCit provided by Citadel contains a cross-site scripting vulnerability CWE-79. Tomoro Taniguchi of FiveDrive, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact When a malicious user sen...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Column Management component. An attacker can inject malicious scripts that are executed when users interact with the web application by exploiting the lack of proper input sanitisation. Details Cross-sit...

PT-2023-27727 · Idm Sistemas Qsige +1 · Qsige

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The web application does not correctly filter input parameters, allowing for SQL injections, Denial of Service DoS, or information disclosure. It is...

Medium: openssl

Issue Overview: Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being...

Engineers Online Portal SQL Injection Vulnerability

Engineers Online Portal is open source an online portal . It is developed using PHP, MySQL database, HTML, CSS, Javascript, jQuery, Ajax, Bootstrap and some other libraries. Engineers Online Portal has a SQL injection vulnerability that stems from manipulation of the teacherid parameter that can...

CBL Mariner 2.0 Security Update: gcc (CVE-2023-4039)

The version of gcc installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-4039 advisory. - DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacke...

Apple macOS Security Breach

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS Sonoma version 14, which stems from an application that may cause a denial of service...

Apple macOS Competitive Conditions Issue Vulnerability

Apple macOS is a proprietary operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS Sonoma version 14, which stems from an application that may be able to modify protected portions of the file system...

Design/Logic Flaw

User enumeration vulnerability in Arconte Áurea 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to obtain a list of registered users in the application, obtaining the necessary information to perform more complex attacks on the platform...

The vulnerability of the Redmine project and task management web application, related to improper handling of exceptional states, allows a hacker to upload and execute any file they desire.

The vulnerability of the Redmine project and task management web application lies in the improper handling of exceptional states. Exploiting this vulnerability allows a malicious actor to remotely upload and execute any file they desire...

The vulnerability of the host.php script in the Cacti network monitoring software allows a hacker to perform cross-site scripting attacks.

The vulnerability in the host.php script of the Cacti network monitoring software exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...