Joplin Cross-site Scripting vulnerability

Joplin before 2.11.5 allows XSS via an AREA element of an image map...

CVE-2023-37299

Joplin before 2.11.5 allows XSS via an AREA element of an image map...

PT-2023-4625 · Joplin · Joplin

Name of the Vulnerable Software and Affected Versions: Joplin versions prior to 2.11.5 Description: The issue is related to an AREA element of an image map, which allows for a cross-site scripting XSS attack. This can be exploited by a remote attacker to conduct an XSS attack. The vulnerability i...

SUSE SLES15 Security Update : kernel (Live Patch 23 for SLE 15 SP3) (SUSE-SU-2023:2423)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2423 advisory. This update for the Linux Kernel 5.3.18-1503005990 fixes several issues. The following security issues were fixed: - CVE-2023-28464: Fixed...

PT-2023-18291 · Qualcomm · Snapdragon +244

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption in the WLAN HAL when processing certain commands, specifically the WMI-UTF command or the FTM TLV1 command...

CVE-2023-25780

It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM. A LAN attacker with normal user privilege can exploit this vulnerability to modify substitute agent to arbitrary users, resulting in serious consequence...

CVE-2023-28700

OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator privileges can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt servic...

ITPison OMICARD EDM 代码问题漏洞

ITPison OMICARD EDM is a high-speed newsletter EDM marketing and distribution system from the Chinese company ITPison. ITPison OMICARD EDM suffers from a code issue vulnerability that originates from an unrestricted dangerous type file upload vulnerability, which can be exploited by an attacker...

CVE-2023-28700 ITPison OMICARD EDM - Arbitrary File Upload

OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator privileges can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt servic...

Status PowerBPM 访问控制错误漏洞

Status PowerBPM is a BPM system from Status. An Access Control Error vulnerability exists in Status PowerBPM v2.0, which stems from insufficient authentication, and can be exploited by an attacker on a local area network with normal user privileges to modify an alternate agent to an arbitrary use...

CVE-2023-28700 ITPison OMICARD EDM - Arbitrary File Upload

OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator privileges can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt servic...

Legislation alone isn’t enough to stop spyware

Welcome to this weeks edition of the Threat Source newsletter. The use of spyware continues to make headlines across the globe. While primarily used by authoritarian regimes to track potentially sensitive subjects like political opponents or activists, governments from all over the world are guil...

CVE-2023-3028

Insufficient authentication in the MQTT backend broker allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerabilities were identified: - The MQTT...

kernel: use-after-free related to leaf anon_vma double reuse

A memory leak flaw with use-after-free capability was found in the Linux kernel. The VMA mm/rmap.c functionality in the ismergeableanonvma function continuously forks, using memory operations to trigger an incorrect reuse of leaf anonvma. This issue allows a local attacker to crash the system...

CVE-2023-3005 SourceCodester Local Service Search Engine Management System POST Parameter cross site scripting

A vulnerability, which was classified as problematic, was found in SourceCodester Local Service Search Engine Management System 1.0. This affects an unknown part of the file /admin/ajax.php?action=savearea of the component POST Parameter Handler. The manipulation of the argument area with the inp...

PT-2023-3686 · Zyxel · Zyxel Usg Flex Series +6

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2 Zyxel USG FLEX series firmware versions 5.00 through 5.36 Patch 2 Zyxel USG FLEX 50W series firmware versions 5.00 through 5.36 Patch 2 Zyxel USG20W-VPN series firmware versions 5.0...

PT-2023-3608 · Zyxel · Zyxel Usg Flex Series +6

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions 4.32 through 5.36 Patch 2 Zyxel USG FLEX series versions 4.50 through 5.36 Patch 2 Zyxel USG FLEX 50W series versions 4.16 through 5.36 Patch 2 Zyxel USG20W-VPN series versions 4.16 through 5.36 Patch 2 Zyxel VPN...

PT-2023-3607 · Zyxel · Zyxel Vpn +1

Name of the Vulnerable Software and Affected Versions: Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 Zyxel VPN series firmware versions 4.20 through 5.36 Patch 2 Description: A command injection vulnerability in the Free Time WiFi hotspot feature could allow an unauthenticated...

PT-2023-3691 · Zyxel · Zyxel Usg Flex Series +4

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2 Zyxel USG FLEX series firmware versions 4.60 through 5.36 Patch 2 Zyxel USG FLEX 50W series firmware versions 4.60 through 5.36 Patch 2 Zyxel USG20W-VPN series firmware versions 4.6...

The vulnerability of the Codesys industrial automation software suite, related to the disclosure of information in the erroneous data area, allows a intruder to gain unauthorized access or cause service failures.

The vulnerability of the Codesys industrial automation software suite is related to the disclosure of information in the erroneous data area. Exploiting this vulnerability can allow an intruder to gain unauthorized access or cause service failures...