CVE-2023-6051

CVE-2023-6051 (GitLab CE/EE) affects GitLab releases prior to 16.4.4, all 16.5 releases before 16.5.4, and all 16.6 releases before 16.6.2, with file integrity potentially compromised when pulling source code or installation packages from a specific tag. The connected sources consistently describ...

CVE-2023-6051

Removed by vendor...

CVE-2023-48123

An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packetcapture.php file...

CVE-2023-48123

An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packetcapture.php file...

CVE-2023-6033

Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser...

CVE-2023-6033

Removed by vendor...

CVE-2023-6033 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser...

CVE-2023-6033 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser...

CVE-2023-6033

CVE-2023-6033 affects GitLab CE/EE: improper neutralization of input in Jira integration configuration enables cross-site scripting (XSS) by an attacker. Impact spans GitLab versions 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3. Documented impact is attacker-executed Java...

PT-2023-32486 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.10 through 16.4.2 GitLab CE/EE versions 16.5 through 16.5.2 GitLab CE/EE versions 16.6 through 16.6.0 Description: The issue is related to improper neutralization of input in Jira integration configuration, allowing a...

CE Phoenix 1.0.8.20 Remote Code Execution

Exploit Title: CE Phoenix v1.0.8.20 - Remote Code Execution RCE Authenticated Date: 2023-11-25 Exploit Author: tmrswrr Category: Webapps Vendor Homepage: CE Phoenix Version: v1.0.8.20 Tested on: Softaculous Demo - CE Phoenix EXPLOIT : import requests from bs4 import BeautifulSoup import sys impor...

CE Phoenix 1.0.8.20 Remote Code Execution Exploit

Exploit Title: CE Phoenix v1.0.8.20 - Remote Code Execution RCE Authenticated Date: 2023-11-25 Exploit Author: tmrswrr Category: Webapps Vendor Homepage: CE Phoenix Version: v1.0.8.20 Tested on: Softaculous Demo - CE Phoenix EXPLOIT : import requests from bs4 import BeautifulSoup import sys impor...

CE Phoenix 1.0.8.20 Remote Command Execution Vulnerability

Exploit Title: CE Phoenix v1.0.8.20 - Remote Code Execution RCE Authenticated Date: 2023-11-25 Exploit Author: tmrswrr Category: Webapps Vendor Homepage: CE Phoenix Version: v1.0.8.20 Tested on: Softaculous Demo - CE Phoenix POC: 1. Login to admin panel: - Visit:...

CE Phoenix 1.0.8.20 Remote Command Execution

Exploit Title: CE Phoenix v1.0.8.20 - Remote Code Execution RCE Authenticated Date: 2023-11-25 Exploit Author: tmrswrr Category: Webapps Vendor Homepage: CE Phoenix Version: v1.0.8.20 Tested on: Softaculous Demo - CE Phoenix POC: 1. Login to admin panel: - Visit:...

PT-2023-8870 · Unknown · Ce Phoenix

Name of the Vulnerable Software and Affected Versions: CE Phoenix versions 1.0.8.20 and earlier Description: The issue is related to insufficient neutralization of special symbols in the english.php component, allowing a remote attacker to execute arbitrary code, escalate privileges, and obtain...

PT-2023-8978 · Unknown · Ce Phoenix

Name of the Vulnerable Software and Affected Versions: CE Phoenix versions 1.0.8.20 Description: The issue is related to incorrect code generation management in the /admin/define language.php script of the CE Phoenix e-commerce software. This allows a remote attacker to execute arbitrary code by...

CE Phoenix 1.0.8.20 Cross Site Scripting

Exploit Title: CE Phoenix Version 1.0.8.20 - Stored XSS Date: 2023-11-25 Exploit Author: tmrswrr Category : Webapps Vendor Homepage: https://phoenixcart.org/ Version: v3.0.1 Tested on: https://www.softaculous.com/apps/ecommerce/CEPhoenix POC: 1-Login admin panel , go to this url :...

Netgate pfSense CE Cross-Site Scripting Vulnerability

Netgate pfSense CE is a free and open source FreeBSD-based firewall and router software. A cross-site scripting vulnerability exists in Netgate pfSense CE version v.2.7.0, which originates from a vulnerability that allows remote attackers to gain privileges by accessing the getserviceproviders.ph...

Default credentials

An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification...

CVE-2023-29975

CVE-2023-29975 affects pfSense CE 2.6.0. The publicly documented description states that an attacker can change the password of any user without verification, indicating a credential-management flaw in the auth flow. No explicit root-cause, affected components, or versions beyond 2.6.0 are provid...