GHSA-V845-JXX5-VC9F `Cookie` HTTP header isn't stripped on cross-origin redirects

urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak information via HTTP redirects to a different origin if that user...

CVE-2023-43980

Presto Changeo testsitecreator up to v1.1.1 was discovered to contain a SQL injection vulnerability via the component disablejson.php...

GHSA-56FM-HFP3-X3W3 Wallabag user can disable 2FA unintentionally

Impact wallabag was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily disable 2FA through /config/otp/app/disable and /config/otp/email/disable. This vulnerability has a CVSSv3.1 score of 4.3. You should upgrade your instance to version 2.6.7 or higher...

PT-2023-5729 · D Link · D-Link Dir-823G

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823G version A1V1.0.2B05 Description: The issue is related to a buffer overflow in the SetWLanRadioSettings function when handling the GuardInt parameter. This allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2023-5732 · D Link · D-Link Dir-823G

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823G version A1V1.0.2B05 Description: The issue is related to a buffer overflow in the SetParentsControlInfo function when handling the Mac parameter. This allows attackers to cause a Denial of Service DoS via crafted input. The...

PT-2023-10301 · WordPress · Most Popular Posts Widget Plugin

Name of the Vulnerable Software and Affected Versions: Most Popular Posts Widget Plugin versions up to 0.8 Description: A critical issue has been found in the Most Popular Posts Widget Plugin, affecting the add views/show views function of the functions.php file. This issue leads to sql injection...

PT-2023-29055 · Presto Changeo · Testsitecreator

Name of the Vulnerable Software and Affected Versions: Presto Changeo testsitecreator versions up to 1.1.1 Description: The issue is related to a SQL injection vulnerability. This vulnerability is present in the component disable json.php. Recommendations: For Presto Changeo testsitecreator...

PrestaShop SQL Injection Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, SMS alerts and product image scaling. PrestaShop suffers from a SQL injection vulnerability that originates from the disablejson.php component of the Change...

PT-2023-35512 · Unknown · Roundcubemail

Name of the Vulnerable Software and Affected Versions: roundcubemail versions prior to 1.6.3 Description: The issue is related to a cross-site scripting XSS vulnerability in the handling of linkrefs in plain text messages. This vulnerability can be exploited by an attacker to inject malicious cod...

PT-2023-29063 · Unknown · Mojoportal

Name of the Vulnerable Software and Affected Versions: mojoPortal version 2.7.0.0 Description: The issue allows a remote attacker to execute arbitrary code via the File Manager function. This is a result of a File Upload vulnerability. Recommendations: For mojoPortal version 2.7.0.0, consider...

PT-2023-32979 · Wallabag · Wallabag

Name of the Vulnerable Software and Affected Versions: wallabag versions prior to 2.6.7 Description: The issue allows attackers to arbitrarily disable 2FA through "config/otp/app/disable" and "config/otp/email/disable" API endpoints. Recommendations: For versions prior to 2.6.7, upgrade your...

DEBIAN-CVE-2023-43655

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has registerargcargv enabled in php.ini. Versions 2.6.4, 2.2.22 an...

UBUNTU-CVE-2023-43655

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has registerargcargv enabled in php.ini. Versions 2.6.4, 2.2.22 an...

PT-2023-31999 · Unknown · Sourcecodester Engineers Online Portal

Name of the Vulnerable Software and Affected Versions: SourceCodester Engineers Online Portal version 1.0 Description: A critical issue was found in the login functionality, specifically in the file login.php. The manipulation of the username and password arguments leads to SQL injection. This...

PT-2023-32008 · Beescms · Beescms

Name of the Vulnerable Software and Affected Versions: BEECMS version 4.0 Description: A vulnerability was found in BEECMS, affecting an unknown part of the file /admin/admin content tag.php?action=save content. The manipulation of the tag argument leads to cross-site scripting. It is possible to...

PT-2023-32000 · Unknown · Sourcecodester Engineers Online Portal

Name of the Vulnerable Software and Affected Versions: SourceCodester Engineers Online Portal version 1.0 Description: A critical issue has been found in the software, affecting an unknown functionality of the file my classmates.php. The manipulation of the teacher class student id argument leads...

PT-2023-31991 · Sourcecodester · Sourcecodester Best Courier Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Courier Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown functionality of the file view parcel.php. The manipulation of the id argument leads to sql injection...

PT-2023-20545 · Tibco Software · Tibco Nimbus

Name of the Vulnerable Software and Affected Versions: TIBCO Nimbus versions 10.6.0 and below Description: The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Reflected Cross Site Scripting XSS vulnerabilities. These vulnerabilities allow a low privileged...

CVE-2023-43663

PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionality. Commit ce1f6708 addresses this issue and is included i...

PT-2023-28665 · Unknown · Asset Management System

Name of the Vulnerable Software and Affected Versions: Asset Management System version 1.0 Description: The issue is an Authenticated SQL Injection vulnerability that affects the first name and last name parameters of the user.php page. This allows an authenticated attacker to dump all the conten...