CVE-2023-42472 Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)

Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface - version 420, allows a report creator to upload files from local system into the report over the network. When uploading the image file, an authenticated attacker could...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in QMS Automotive, Parasolid, WIBU, TeamCenter, JT2GO, SIMATIC, SIPLUS and Ruggedcom products. The vulnerabilities potentially enable a malicious party to launch attacks execute attacks that could result in the following categories of damage: Denial-of-Service Do...

CVE-2021-40699

ColdFusion version 2021 update 1 and earlier and versions 2018.10 and earlier are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environmen...

Improper access control

ColdFusion version 2021 update 1 and earlier and versions 2018.10 and earlier are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environmen...

CVE-2021-40698

CVE-2021-40698 affects Adobe ColdFusion 2021 update 1 and earlier, and 2018.10 and earlier. Root cause: use of an inherently dangerous function leading to a security feature bypass. Impact: an authenticated attacker could access and manipulate arbitrary data in the environment. Mitigation: apply ...

CVE-2021-40699: Improper Access Control

ColdFusion version 2021 update 1 and earlier and versions 2018.10 and earlier are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environmen...

Vulnerabilities fixed in GitLab Enterprise Edition and Community Edition

GitLab has fixed vulnerabilities in GitLab Enterprise Edition EE and Community Edition CE. A malicious party could vulnerabilities to exploit attacks that can result in the following categories of damage: Denial-of-Service DoS. Manipulation of data Circumvention of security measure Access to syst...

CVE-2023-4420

A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security TLS in the SICK LMS5xx. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attacker can...

CVE-2023-4420

A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security TLS in the SICK LMS5xx. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attacker can...

Vulnerabilities fixed in Sonicwall

SonicWall has fixed vulnerabilities in Global Management System GMS and Analytics. A malicious party could exploit them to launch attacks that could result in the following categories of damage: Manipulation of data. Bypassing authentication Circumvention of security measure Remote code execution...

Sql injection

Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling...

Exploit for SQL Injection in Phpgurukul Online_Shopping_Portal

CVE-2023-38890 Description Online Shopping Portal Project...

CVE-2023-27576

An issue was discovered in phpList before 3.6.14. Due to an access error, it was possible to manipulate and edit data of the system's super admin, allowing one to perform an account takeover of the user with super-admin permission. Specifically, for a request with updatepassword=1, a modified...

Design/Logic Flaw

An issue was discovered in phpList before 3.6.14. Due to an access error, it was possible to manipulate and edit data of the system's super admin, allowing one to perform an account takeover of the user with super-admin permission. Specifically, for a request with updatepassword=1, a modified...

CVE-2023-38890

Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling...

CVE-2023-27576

An issue was discovered in phpList before 3.6.14. Due to an access error, it was possible to manipulate and edit data of the system's super admin, allowing one to perform an account takeover of the user with super-admin permission. Specifically, for a request with updatepassword=1, a modified...

CVE-2023-38890

CVE-2023-38890 affects Online Shopping Portal Project 3.1, where the login form’s username input allows SQL Injection due to insufficient input validation. This is a remote code execution/unauthorized-access risk via crafted queries, with public references to exploits (e.g., ExploitDB 50029) and ...

CVE-2023-27576

phpList before 3.6.14 contains an access validation flaw that lets an attacker manipulate the super admin’s data (by tampering updatepassword=1 requests and altering both the ID and username) to perform a password reset and take over the super admin account. The impact is account takeover with su...

PT-2023-26671

Name of the Vulnerable Software and Affected Versions Online Shopping Portal Project version 3.1 Description The issue allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This arises due to...

CVE-2023-38890: Improper Neutralization of Special Elements used in an SQL Command

Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling...