CVE-2023-31138 DHIS2 Core vulnerable to Improper Access Control with PATCH requests

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authenticated users with write access to an obje...

CVE-2023-31138

CVE-2023-31138 affects DHIS2 Core: starting in the 2.36 branch and before 2.37.9.1, 2.38.3.1, or 2.39.1.2, authenticated users with write access to an object may modify related objects via object model traversal in a PATCH payload. Mitigation is to upgrade to a supported version: 2.37.9.1, 2.38.3...

teampass vulnerable to code injection

In nilsteampassnet/teampass prior to 3.0.7, if two users have the same folder access, malicious users can create an item where its label field is vulnerable to HTML injection. When other users see that item, it may force them to redirect to the attacker's website or capture their data using a for...

Siemens SICAM P850 and SICAM P855 Authentication Bypass By Capture-Replay (CVE-2022-29878)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. Affected devices use a limited range for challenges that are sent during the unencrypted challenge-response communication. An unauthenticated attacker could capture a valid challenge-response pair...

PT-2023-23554 · Sngrep +1 · Sngrep +1

Name of the Vulnerable Software and Affected Versions: Sngrep version 1.6.0 Description: A heap buffer overflow issue was discovered in the function capture packet reasm ip at /src/capture.c. This issue affects the specified version of Sngrep. Recommendations: For Sngrep version 1.6.0, consider...

PT-2023-23574 · Unknown · Android Capture App +1

Name of the Vulnerable Software and Affected Versions: DHIS2 Core versions 2.35 through 2.36.12 DHIS2 Core versions 2.37 through 2.37.7 DHIS2 Core versions 2.38 through 2.38.1 DHIS2 Core versions 2.39 through 2.39.0 exclusive of 2.39.0, as 2.39.0 contains a fix Description: The issue arises when...

Exploit for Improper Input Validation in Microsoft

PoC exploit for CVE-2023-23397, a vulnerability in the Apache HT...

Stored HTML Injection in Item Label

Description If two users have the same folder access, malicious users can create an item where its label field is vulnerable to HTML injection. When other users see that item, it may force them to redirect to the attacker's website or capture their data using a form. Proof of Concept...

Malicious code in api-code-capture-chrome-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f1e44f89c4e3876559f46852c9a652c510df9384be3ffd0180e36f9fd64e8cfe The OpenSSF Package Analysis project identified 'api-code-capture-chrome-extension' @ 20.0.1 npm as malicious. It is considered malicious becaus...

CVE-2023-23723

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Winwar Media WP Email Capture plugin = 3.9.3 versions...

CVE-2023-23723

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Winwar Media WP Email Capture plugin = 3.9.3 versions...

CVE-2023-23723

CVE-2023-23723 describes a stored XSS vulnerability in the WordPress plugin “WP Email Capture” by Winwar Media, affecting versions up to 3.9.3. The underlying issue is insufficient sanitization/escaping of certain settings, enabling an attacker with administrator privileges to trigger stored cros...

The vulnerability of the Forms component in the Oracle Clinical Remote Data Capture system allows a intruder to disclose protected information.

The vulnerability of the Forms component in the Oracle Clinical Remote Data Capture system exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to disclose protected information remotely...

WordPress plugin WP Email Capture 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Debian dla-3402 : libwireshark-data - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3402 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3402-1 [email protected]...

Fedora 37 : wireshark (2023-7af3ad9ffe)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-7af3ad9ffe advisory. New version 4.0.5. Fixes Bug 2159392, CVE-2023-1992, CVE-2023-1993 and CVE-2023-1994. Tenable has extracted the preceding description block directly...

Fedora 36 : wireshark (2023-203eff67e0)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-203eff67e0 advisory. New version 3.6.13. Fix for CVE-2023-1992, CVE-2023-1993 and CVE-2023-1994. Tenable has extracted the preceding description block directly from the...

Fedora 38 : wireshark (2023-f70fbf64cb)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-f70fbf64cb advisory. New version 4.0.5. Fixes Bug 2159392, CVE-2023-1992, CVE-2023-1993 and CVE-2023-1994. Tenable has extracted the preceding description block directly...

Fedora: Security Advisory for wireshark (FEDORA-2023-7af3ad9ffe)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: wireshark-3.6.13-1.fc36

Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless WiFi or Bluetooth networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. It has many powerful...