Bumsys Business Management System 1.0.3-beta Shell Upload

Exploit Title: - unilogies/bumsys v1.0.3-beta - Unrestricted File Upload Google Dork : NA Date: 19-01-2023 Exploit Author: AFFAN AHMED Vendor Homepage: https://github.com/unilogies/bumsys Software Link: https://github.com/unilogies/bumsys/archive/refs/tags/v1.0.3-beta.zip Version: 1.0.3-beta Test...

Dcat Admin 跨站脚本漏洞

Dcat Admin is a backend system builder based on the secondary development of laravel-admin by Jiang Qinghua, an individual developer. A security vulnerability exists in Dcat Admin v2.1.3-beta that could allow an attacker to execute arbitrary web script or HTML via URL parameter injection with a...

CVE-2023-33736

A stored cross-site scripting XSS vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter...

PT-2023-24463 · Unknown · Dcat-Admin

Name of the Vulnerable Software and Affected Versions: Dcat-Admin version 2.1.3-beta Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter. This enables attackers to potentially manipula...

CVE-2023-33193 Emby Server Proxy Header Spoofing Vulnerability

Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system,...

Zulip 跨站脚本漏洞

Zulip is a powerful open source group chat application from Zulip, Inc. for combining the immediacy of real-time chat with the productivity benefits of threaded conversations. A security vulnerability exists in Zulip version 7.0-beta1, 7.0-beta2, which stems from a problem with the tooltip of the...

PT-2023-24203 · Unknown · Zulip Server

Name of the Vulnerable Software and Affected Versions: Zulip Server versions 7.0-beta1 through 7.0-beta2 and the main development branch from May 2, 2023 and later Description: The issue is related to a cross-site scripting vulnerability in tooltips on the message feed. An attacker who can send...

kubernetes-client: Insecure deserialization in unmarshalYaml method

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML...

GHSA-VPPQ-6FF8-2M8W phpMyFAQ vulnerable to stored Cross-site Scripting

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta...

CVE-2023-2752

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta...

phpMyFAQ 跨站脚本漏洞

phpMyFAQ is a multi-language, fully database-driven FAQ system. A cross-site scripting vulnerability exists in versions prior to phpMyFAQ 3.2.0-beta. The vulnerability stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacke...

CVE-2023-2752 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta...

CVE-2023-2753 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta...

CVE-2023-31576

An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript file...

CVE-2023-29961

D-Link DIR-605L firmware version 1.17B01 BETA is vulnerable to stack overflow via /goform/formTcpipSetup,...

Serendipity 代码问题漏洞

Serendipity is a PHP-based blogging system from the Serendipity team. The system supports the creation of online journals, blogs, web pages and more. A security vulnerability exists in Serendipity version 2.4-beta1. An attacker can exploit the vulnerability to execute arbitrary code via specially...

CVE-2023-29961

The CVE-2023-29961 entry concerns D-Link DIR-605L firmware 1.17B01 BETA, where a stack overflow is caused by incorrect boundary checking in the /goform/formTcpipSetup endpoint. Multiple connected sources confirm the vulnerable component and impact, with potential for arbitrary code execution or d...

PT-2023-23393 · Unknown · Serendipity

Name of the Vulnerable Software and Affected Versions: Serendipity version 2.4-beta1 Description: An arbitrary file upload issue allows attackers to execute arbitrary code via a crafted HTML or Javascript file. Recommendations: For Serendipity version 2.4-beta1, consider restricting file uploads ...

git-lfs security and bug fix update

3.2.0-1 - Update to 3.2.0 - Resolves: 2139383 2.13.3-4 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz1991688 2.13.3-3 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz1971065 2.13.3-2 - Fixed name of source tarball - Fixed date in the latest changelog entry - Related: 19525...

Intel oneAPI Toolkits 安全漏洞

Intel oneAPI Toolkits is an application from Intel Corporation USA. A security vulnerability exists in Intel oneAPI Toolkits prior to version 2021.1 Beta 10, which stems from Improper Access ControlAn attacker could exploit this vulnerability to enable privilege escalation via local access...