PT-2023-32000 · Unknown · Sourcecodester Engineers Online Portal

Name of the Vulnerable Software and Affected Versions: SourceCodester Engineers Online Portal version 1.0 Description: A critical issue has been found in the software, affecting an unknown functionality of the file my classmates.php. The manipulation of the teacher class student id argument leads...

PT-2023-20545 · Tibco Software · Tibco Nimbus

Name of the Vulnerable Software and Affected Versions: TIBCO Nimbus versions 10.6.0 and below Description: The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Reflected Cross Site Scripting XSS vulnerabilities. These vulnerabilities allow a low privileged...

PT-2023-31991 · Sourcecodester · Sourcecodester Best Courier Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Courier Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown functionality of the file view parcel.php. The manipulation of the id argument leads to sql injection...

CVE-2023-43663

PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionality. Commit ce1f6708 addresses this issue and is included i...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts, and product image scaling. A security vulnerability exists in PrestaShop that stems from allowing low privileged users to disable some...

PT-2023-28665 · Unknown · Asset Management System

Name of the Vulnerable Software and Affected Versions: Asset Management System version 1.0 Description: The issue is an Authenticated SQL Injection vulnerability that affects the first name and last name parameters of the user.php page. This allows an authenticated attacker to dump all the conten...

PT-2023-29246

Name of the Vulnerable Software and Affected Versions pretix versions prior to 2023.7.2 Description The issue allows Pillow to parse EPS files. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this...

PT-2023-28908 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 8.1.2 Description: PrestaShop is an Open Source e-commerce web application. In affected versions, any module can be disabled or uninstalled from the back office, even with low user rights. This allows low privileg...

CVE-2023-43656

matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions those that have generic.allowJsTransformationFunctions in their config, may be vulnerable to an attack where it is possible to break out of...

CVE-2023-43656 Sandbox escape for instances that have enabled transformation functions in matrix-hookshot

matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions those that have generic.allowJsTransformationFunctions in their config, may be vulnerable to an attack where it is possible to break out of...

CVE-2023-41306

Vulnerability of mutex management in the bone voice ID trusted application TA module. Successful exploitation of this vulnerability may cause the bone voice ID feature to be unavailable...

CVE-2023-39376

SiberianCMS - CWE-284 Improper Access Control Authorized user may disable a security feature over the network...

Improper access control

SiberianCMS - CWE-284 Improper Access Control Authorized user may disable a security feature over the network...

Incorrect Authorization in User role

Description Incorrect Authorization in User role Proof of Concept 1 .Default, administrator User ID =1 cannot add user roles 2 .Remove the "disable" class at Inspect 3 .After that, add the user role success Video Poc https://drive.google.com/file/d/1vQPHZwaghByHsqEgQI9p3EiGeVCTbLK7/view?usp=shari...

PT-2023-5691

Name of the Vulnerable Software and Affected Versions: Cisco IOS and IOS XE Software affected versions not specified Description: A vulnerability in the Cisco Group Encrypted Transport VPN GET VPN feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacke...

PT-2023-27950 · Unknown · Phpkobo Ajaxnewticker

Name of the Vulnerable Software and Affected Versions: phpkobo AjaxNewTicker version 1.0.5 Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via a crafted payload to the subcmd parameter in the "index.php" component. Recommendations: For phpkobo...

PT-2023-23673 · Red Hat · Openshift Container Platform For Ibm Linuxone +4

Name of the Vulnerable Software and Affected Versions: undertow affected versions not specified jboss enterprise application platform affected versions not specified jboss enterprise application platform text-only advisories affected versions not specified openshift container platform affected...

PT-2023-28739 · Yzncms · Yzncms

Name of the Vulnerable Software and Affected Versions: YZNCMS version 1.3.0 Description: A stored cross-site scripting XSS issue in the cms/content/edit component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter. This enables...

PT-2023-26650 · Unknown · Gugoan Economizzer

Name of the Vulnerable Software and Affected Versions: gugoan Economizzer version 0.9-beta1 Description: The issue concerns a user enumeration vulnerability in the login and forgot password functionalities. The application reacts differently when a user or email address is valid, and when it's no...

PT-2023-29004 · Subrion · Subrion

Name of the Vulnerable Software and Affected Versions: Subrion version 4.2.1 Description: A Cross-site scripting XSS issue exists in the /panel/languages/ endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Title parameter. This enables...