Bumsys Business Management System 1.0.3-beta Shell Upload

Exploit Title: - unilogies/bumsys v1.0.3-beta - Unrestricted File Upload Google Dork : NA Date: 19-01-2023 Exploit Author: AFFAN AHMED Vendor Homepage: https://github.com/unilogies/bumsys Software Link: https://github.com/unilogies/bumsys/archive/refs/tags/v1.0.3-beta.zip Version: 1.0.3-beta Test...

CVE-2023-33736

A stored cross-site scripting XSS vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter...

Dcat Admin 跨站脚本漏洞

Dcat Admin is a backend system builder based on the secondary development of laravel-admin by Jiang Qinghua, an individual developer. A security vulnerability exists in Dcat Admin v2.1.3-beta that could allow an attacker to execute arbitrary web script or HTML via URL parameter injection with a...

PT-2023-24463 · Unknown · Dcat-Admin

Name of the Vulnerable Software and Affected Versions: Dcat-Admin version 2.1.3-beta Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter. This enables attackers to potentially manipula...

CVE-2023-33193 Emby Server Proxy Header Spoofing Vulnerability

Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system,...

PT-2023-24203 · Unknown · Zulip Server

Name of the Vulnerable Software and Affected Versions: Zulip Server versions 7.0-beta1 through 7.0-beta2 and the main development branch from May 2, 2023 and later Description: The issue is related to a cross-site scripting vulnerability in tooltips on the message feed. An attacker who can send...

Zulip 跨站脚本漏洞

Zulip is a powerful open source group chat application from Zulip, Inc. for combining the immediacy of real-time chat with the productivity benefits of threaded conversations. A security vulnerability exists in Zulip version 7.0-beta1, 7.0-beta2, which stems from a problem with the tooltip of the...

kubernetes-client: Insecure deserialization in unmarshalYaml method

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML...

cloud.piranha.extension:piranha-extension-hazelcast (=23.5.0), com.github.ben-manes.caffeine:simulator (=3.1.6) +31 more potentially affected by CVE-2023-33264 via com.hazelcast:hazelcast (>=5.3.0-BETA-1 <=5.3.0-BETA-2)

com.hazelcast:hazelcast MAVEN version =5.3.0-BETA-1, =5.3.0-BETA-1, =5.3.0-BETA-1, =5.3.0-BETA-1, =5.3.0-BETA-1, =5.3.0-BETA-1, =5.3.0-BETA-1, =5.3.0-BETA-1, =5.3.0-BETA-1, =5.3.0-BETA-1, =5.3.0-BETA-1, =5.3.0-BETA-1, =5.3.0-BETA-1, =5.3.0-BETA-2 and more Source cves: CVE-2023-33264 Source...

GHSA-VPPQ-6FF8-2M8W phpMyFAQ vulnerable to stored Cross-site Scripting

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta...

CVE-2023-2752

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta...

phpMyFAQ 跨站脚本漏洞

phpMyFAQ is a multi-language, fully database-driven FAQ system. A cross-site scripting vulnerability exists in versions prior to phpMyFAQ 3.2.0-beta. The vulnerability stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacke...

CVE-2023-2752 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta...

CVE-2023-2753 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta...

CVE-2023-31576

An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript file...

CVE-2023-29961

D-Link DIR-605L firmware version 1.17B01 BETA is vulnerable to stack overflow via /goform/formTcpipSetup,...

Serendipity 代码问题漏洞

Serendipity is a PHP-based blogging system from the Serendipity team. The system supports the creation of online journals, blogs, web pages and more. A security vulnerability exists in Serendipity version 2.4-beta1. An attacker can exploit the vulnerability to execute arbitrary code via specially...

CVE-2023-29961

The CVE-2023-29961 entry concerns D-Link DIR-605L firmware 1.17B01 BETA, where a stack overflow is caused by incorrect boundary checking in the /goform/formTcpipSetup endpoint. Multiple connected sources confirm the vulnerable component and impact, with potential for arbitrary code execution or d...

PT-2023-23393 · Unknown · Serendipity

Name of the Vulnerable Software and Affected Versions: Serendipity version 2.4-beta1 Description: An arbitrary file upload issue allows attackers to execute arbitrary code via a crafted HTML or Javascript file. Recommendations: For Serendipity version 2.4-beta1, consider restricting file uploads ...

git-lfs security and bug fix update

3.2.0-1 - Update to 3.2.0 - Resolves: 2139383 2.13.3-4 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz1991688 2.13.3-3 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz1971065 2.13.3-2 - Fixed name of source tarball - Fixed date in the latest changelog entry - Related: 19525...