CVE-2023-36314

There is a Cross Site Scripting XSS vulnerability in the value-text-osmsemailrequestmessage parameters of index.php in PHPJabbers Callback Widget v1.0...

PT-2023-25528 · Phpjabbers · Phpjabbers Callback Widget

Name of the Vulnerable Software and Affected Versions: PHPJabbers Callback Widget version 1.0 Description: There is a Cross Site Scripting XSS issue in the value-enum-o bf include timezone parameter of index.php. This allows for potential malicious script execution. Recommendations: For PHPJabber...

CVE-2023-36315

The CVE CVE-2023-36315 affects PHPJabbers Callback Widget v1.0, specifically an XSS in the action parameter of index.php. Root cause: improper handling of input in the action parameter leading to cross-site scripting. Impact is described as XSS; exploitation status is not provided in the document...

PT-2023-25531 · Phpjabbers · Phpjabbers Callback Widget

Name of the Vulnerable Software and Affected Versions: PHPJabbers Callback Widget version 1.0 Description: There is a Cross Site Scripting XSS issue in the action parameter of the "index.php" file. This allows for potential malicious script execution. Recommendations: For PHPJabbers Callback Widg...

PHPJabbers Callback Widget Cross-Site Scripting Vulnerability

PHPJabbers Callback Widget is a simple PHP script that places a discreet callback button on a website. A cross-site scripting vulnerability exists in PHPJabbers Callback Widget version v1.0, which stems from cross-site scripting XSS in the action parameter of ndex.php...

CVE-2023-36314

CVE-2023-36314 describes a Cross Site Scripting (XSS) vulnerability in PHPJabbers Callback Widget v1.0, specifically in the value-text-o_sms_email_request_message parameter of index.php. Connected documents confirm the affected product and vulnerable parameter. No exploitation details are provide...

CVE-2023-36312

There is a Cross Site Scripting XSS vulnerability in the value-enum-obfincludetimezone parameter of index.php in PHPJabbers Callback Widget v1.0...

CVE-2023-36314

There is a Cross Site Scripting XSS vulnerability in the value-text-osmsemailrequestmessage parameters of index.php in PHPJabbers Callback Widget v1.0...

CVE-2023-36312

PHPJabbers Callback Widget v1.0 contains a Cross-Site Scripting (XSS) vulnerability in the value-enum-o_bf_include_timezone parameter of index.php. The root cause is improper handling of user-controlled input in this parameter, enabling script execution in the browser. The issue is identified acr...

CVE-2023-36315

There is a Cross Site Scripting XSS vulnerability in the "action" parameter of index.php in PHPJabbers Callback Widget v1.0...

EulerOS 2.0 SP9 : curl (EulerOS-SA-2023-2608)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An improper certificate validation vulnerability exists in curl v8.1.0 in the way it supports matching of wildcard patterns when listed as 'Subjec...

CLSA-2023-1691083401 Fix CVE(s): CVE-2022-3697

SECURITY UPDATE: improper handling of towercallback parameter in amazon.aws collection - debian/patches/CVE-2022-3697.patch: ec2instance - validate options on towercallback - CVE-2022-3697 Enable unit testing...

Exploit for Command Injection in Tp-Link Archer_Ax21_Firmware

Description CVE-2023–1389 is an Unauthenticated Command Inject...

TokenManager.sendToken/callContractWithInterchainToken/transmitInterchainTransfer require re-entry protection

Lines of code Vulnerability details Impact Anyone can deploy a TokenManagerLockUnlock for the existing ERC20 via registerCanonicalToken, and deploy the corresponding token on a target chain via deployRemoteCanonicalToken. After the TokenManagers of the two chains are created, users can transfer...

USN-6237-2 curl regression

USN-6237-1 fixed vulnerabilities in curl. The update caused a certificate wildcard handling regression on Ubuntu 22.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Hiroki Kurosawa discovered that curl incorrectly handled validating certain...

USN-6237-1: curl vulnerabilities

Hiroki Kurosawa discovered that curl incorrectly handled validating certain certificate wildcards. A remote attacker could possibly use this issue to spoof certain website certificates using IDN hosts. CVE-2023-28321 Hiroki Kurosawa discovered that curl incorrectly handled callbacks when certain...

curl: POST following PUT confusion

A vulnerability was found in curl. The issue occurs when doing HTTPS transfers, where curl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set if it previously used the same handle to issue a PUT request which us...

Ateme TITAN File 3.9 - SSRF File Enumeration Vulnerability

Exploit Title: Ateme TITAN File 3.9 - SSRF File Enumeration Exploit Author: LiquidWorm Vendor: Ateme Product web page: https://www.ateme.com Affected version: 3.9.12.4 3.9.11.0 3.9.9.2 3.9.8.0 Summary: TITAN File is a multi-codec/format video transcoding software, for mezzanine, STB and ABR VOD,...

ERC721 onERC721Received() reentrancy

Lines of code Vulnerability details Impact Reentrancy is an attack that can occur when a bug in a contract may allow a malicious contract to reenter the contract unexpectedly during execution of the original function. This can be used to drain funds from a smart contract if used maliciously...

Milesight UR32L 操作系统命令注入漏洞

The Milesight UR32L is a 4G industrial router from China's Milesight. A command injection vulnerability exists in the Milesight UR32L vtyshubus tcpdumpstartcb function, which can be exploited by an attacker to execute arbitrary commands on the system...