48 matches found
CVE-2023-31298
CVE-2023-31298 is an XSS vulnerability in Sesami CPTO 6.3.8.6 (#718). The User ID field used when creating a new system user can be exploited by remote attackers to execute arbitrary code and access sensitive information. Documented details include affected software (CPTO 6.3.8.6) and the root ca...
CVE-2023-31294
The CVE-2023-31294 issue affects Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6, where a CSV Injection flaw in the Delivery Name field can cause information disclosure. Root cause: improper handling of the Delivery Name in CSV output enables crafted input to be interpreted as CSV, reveali...
CVE-2023-31294
CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer CPTO version 6.3.8.6 718, allows remote attackers to obtain sensitive information via the Delivery Name field...
CVE-2023-31299
CVE-2023-31299 : Cross Site Scripting (XSS) in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718) , via the container’s Barcode field . The cited sources describe remote attackers potentially executing arbitrary code due to this XSS, but the provided documents do not specify af...
CVE-2023-31293
CVE-2023-31293 concerns Sesami CPTO 6.3.8.6. Multiple sources describe an improper access control in the Reader system user’s web browser that lets remote attackers obtain sensitive information and bypass profile restrictions, enabling the journal to be displayed even when the option is disabled....
CVE-2023-31300
CVE-2023-31300 affects Sesami CPTO v6.3.8.6, enabling remote attackers to obtain sensitive information via unencrypted credentials transmitted during Password Reset. Root cause: transmission of plaintext credentials. Impact: potential confidentiality breach (HIGH). No exploit specifics provided i...
CVE-2023-31296
Affected software/product: Sesami CPTO (Cash Point & Transport Optimizer) — version 6.3.8.6 (#718). Vulnerability type / vector: CSV Injection via the User Name field. Root cause / impact: The issue enables an attacker to obtain sensitive information; documentation notes a CSV injection risk with...
CVE-2023-31296
CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer CPTO version 6.3.8.6 718, allows attackers to obtain sensitive information via the User Name field...
CVE-2023-31302
The CVE-2023-31302 entry describes a Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718). The issue affects the Teller field and could allow remote attackers to execute arbitrary code through crafted input. Impact details are limited to XSS an...
CVE-2023-31293
An issue was discovered in Sesami Cash Point & Transport Optimizer CPTO 6.3.8.6 718, allows remote attackers to obtain sensitive information and bypass profile restriction via improper access control in the Reader system user's web browser, allowing the journal to be displayed, despite the option...
CVE-2023-31295
CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer CPTO version 6.3.8.6 718, allows remote attackers to obtain sensitive information via the User Profile field...
CVE-2023-31295
CVE-2023-31295 affects Sesami CPTO (Cash Point & Transport Optimizer) version 6.3.8.6. The issue is a CSV Injection in the User Profile field that allows a remote attacker to obtain sensitive information. Public sources available in the connected documents consistently describe the vulnerability ...
CVE-2023-31297
An issue was discovered in SESAMI planfocus CPTO Cash Point & Transport Optimizer 6.3.8.6 718. There is XSS via the Name field when modifying a client...
Code injection
An issue was discovered in SESAMI planfocus CPTO Cash Point & Transport Optimizer 6.3.8.6 718. There is XSS via the Name field when modifying a client...
CVE-2023-31297
SESAMI planfocus CPTO (Cash Point & Transport Optimizer) version 6.3.8.6 718 has a cross‑site scripting (XSS) flaw in the Name field when modifying a client. The root cause is unvalidated input in the Name field that can be used to inject JavaScript. Impact details are limited to XSS; the provide...
Debian DSA-4491-1 : proftpd-dfsg - security update
Tobias Maedel discovered that the modcopy module of ProFTPD, a FTP/SFTP/FTPS server, performed incomplete permission validation for the CPFR/CPTO commands. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4491...
[SECURITY] [DSA 4491-1] proftpd-dfsg security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4491-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 04, 2019 https://www.debian.org/security/faq -...
ProFTPD <= 1.3.5b Remote Code Execution
Binary data 701079.prm...
ProFTPD 1.3.5 Mod_Copy Command Execution
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ProFTPD 1.3.5 ModCopy Command Execution', 'Description' = %q This module exploits the SITE CPFR/CPTO commands in ProFTPD version...
ProFTPD mod_copy command execution
Added: 05/29/2015 CVE: CVE-2015-3306 BID: 74238 OSVDB: 120834 Background ProFTPD is free FTP Server software for Unix and Linux platforms. Problem The modcopy extension, if enabled in ProFTPD, allows unauthenticated attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO...