11902 matches found
GHSA-FC75-58R8-RM3H Wagtail vulnerable to disclosure of user names via admin bulk action views
Impact A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user...
PT-2023-29482 · Yamcs · Yamcs
Name of the Vulnerable Software and Affected Versions: Yamcs version 5.8.6 Description: The issue allows for Cross-Site Scripting XSS attacks. It comes with a Bucket as its primary storage mechanism, which allows for the upload of any file. There's a way to upload a display referencing a maliciou...
Torchbox Wagtail Log Information Disclosure Vulnerability
Torchbox Wagtail is an open source content management system CMS from Torchbox UK. A security vulnerability exists in Wagtail that originates from a user with a Wagtail Administrator Limited Privilege Editor account that can retrieve any user's display name...
PT-2023-29699 · Wagtail · Wagtail
Name of the Vulnerable Software and Affected Versions: Wagtail versions prior to 4.1.8 Wagtail versions prior to 5.0.5 Wagtail versions prior to 5.1.3 Description: A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bu...
CVE-2023-45279
Yamcs 5.8.6 allows XSS issue 1 of 2. It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from...
CVE-2023-30154
Multiple improper neutralization of SQL parameters in module AfterMail aftermailpresta for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via idcustomer, idconf, idproduct and token parameters in aftermailajax.php via the 'idproduct' parameter in hooks...
PT-2023-22562 · Unknown +1 · Prestashop +1
Name of the Vulnerable Software and Affected Versions: AfterMail aftermailpresta for PrestaShop versions prior to 2.2.1 Description: The issue is related to multiple improper neutralization of SQL parameters, allowing remote attackers to perform SQL injection attacks. This can be done via...
CVE-2023-44106
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may cause features to perform abnormally...
CVE-2023-44106
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may cause features to perform abnormally...
Design/Logic Flaw
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may cause features to perform abnormally...
CVE-2023-44106
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may cause features to perform abnormally...
CVE-2023-44106
CVE-2023-44106 describes an API permission management vulnerability in the Fwk-Display module. The NVD entry states a API permission issue could cause features to perform abnormally with a CVSS v3.1 base score of 9.8 (CRITICAL, network attack, no user interaction). Connected docs corroborate the ...
CVE-2023-44106
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may cause features to perform abnormally...
PT-2023-29102 · Unknown · Fwk-Display
Name of the Vulnerable Software and Affected Versions: Fwk-Display module affected versions not specified Description: The issue concerns an API permission management vulnerability in the Fwk-Display module. Successful exploitation of this vulnerability may cause features to perform abnormally...
lg-informationdisplay.com Cross Site Scripting vulnerability OBB-3727502
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-33039
Memory corruption in Automotive Display while destroying the image handle created using connected display driver...
Memory corruption
Memory corruption in Automotive Display while destroying the image handle created using connected display driver...
CVE-2023-33039 Use After Free in Automotive Display
Memory corruption in Automotive Display while destroying the image handle created using connected display driver...
CVE-2023-33039
CVE-2023-33039 concerns Memory corruption in the Automotive Display when destroying the image handle created using the connected display driver. From connected docs, the affected component is Automotive Display in Qualcomm-derived tooling, with root cause described as memory corruption during ima...