PT-2023-11867 · Unknown · Ti Woocommerce Wishlist

Name of the Vulnerable Software and Affected Versions: TI WooCommerce Wishlist versions up to 1.21.11 TI WooCommerce Wishlist Pro versions up to 1.21.4 Description: The issue allows authenticated attackers to gain restricted access to the vulnerable blog and update any settings due to an Options...

PT-2023-11369 · Unknown +1 · Materialis +1

Name of the Vulnerable Software and Affected Versions: Mesmerize versions up to, and including, 1.6.89 Materialis versions up to, and including, 1.0.172 Description: The issue allows authenticated attackers to change restricted options due to the companion disable popup function only checking the...

CVE-2023-33653

Sitecore Experience Platform XP v9.3 was discovered to contain an authenticated remote code execution RCE vulnerability via the component /Applications/Content%20Manager/Execute.aspx?cmd=convert&mode=HTML...

PT-2023-16619 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.3 through 15.10.7 GitLab CE/EE versions 15.11 through 15.11.6 GitLab CE/EE versions 16.0 through 16.0.1 Description: A lack of length validation in GitLab CE/EE allows an authenticated attacker to create a large Issue...

CVE-2023-33477

Summary: CVE-2023-33477 concerns Harmonic NSG 9000-6G devices, where an authenticated remote user can obtain source code by directly requesting a crafted path. Multiple connected sources label the issue as a path traversal vulnerability, but the technical details are inconsistent across entries a...

Wade Graphic Design FANTSY 代码问题漏洞

Wade Graphic Design FANTSY is a digital art application from Wade Graphic Design. A code issue vulnerability exists in Wade Graphic Design FANTSY v2.1.8, which stems from an insufficient file type filtering vulnerability that can be exploited by an authenticated, remote attacker with normal user...

PT-2023-20069 · WordPress · Feather Login Page

Name of the Vulnerable Software and Affected Versions: Feather Login Page plugin for WordPress versions 1.0.7 through 1.1.1 Description: The issue allows authenticated attackers with subscriber-level permissions and above to access login links, potentially leading to privilege escalation, due to ...

CVE-2023-33722

EDIMAX BR-6288ACL v1.12 was discovered to contain an authenticated remote code execution RCE vulnerability via the pppUserName parameter...

PT-2023-19041 · Stormshield · Stormshield Endpoint Security

Name of the Vulnerable Software and Affected Versions: Stormshield Endpoint Security versions 2.3.0 through 2.3.2 Description: The issue allows authenticated users to read sensitive information due to incorrect access control. Recommendations: For versions 2.3.0 through 2.3.2, update to a version...

CVE-2023-28382

Directory traversal vulnerability in ESS REC Agent Server Edition series allows an authenticated attacker to view or alter an arbitrary file on the server. Affected products and versions are as follows: ESS REC Agent Server Edition for Linux V1.0.0 to V1.4.3, ESS REC Agent Server Edition for...

CVE-2023-30615 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-web

Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting XSS vulnerability has been identified in iris-web, affecting multiple locations . The vulnerability in allows an attacker to inject malicious...

CVE-2022-41221

The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client Versions 16.2.3, 21.2, and older versions could upload XML files to the application that it did not sufficiently validate. As a result,...

CVE-2023-25028

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in chuyencode CC Custom Taxonomy plugin = 1.0.1 versions...

CVE-2023-26595

Denial-of-service DoS vulnerability in Message of Cybozu Garoon 4.10.0 to 5.9.2 allows a remote authenticated attacker to cause a denial of service condition...

WordPress plugin VK Blocks 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2023-27066

Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle...

CVE-2023-30780

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in TheGuideX User IP and Location plugin = 2.2 versions...

CVE-2023-20182

Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container, enumerate user information, or execute arbitrary commands in a restricted container as the root user. For more information about these...

CVE-2023-20171

Multiple vulnerabilities in Cisco Identity Services Engine ISE could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about...

CVE-2023-20106

Multiple vulnerabilities in Cisco Identity Services Engine ISE could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about...