Moderate: Red Hat Security Advisory: fence-agents security update

An update for fence-agents is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

PT-2023-7822 · Trio J +2 · Trio J +2

Name of the Vulnerable Software and Affected Versions: Trio Q, Trio E, Trio J affected versions not specified Description: A CWE-601:URL Redirection to Untrusted Site ‘Open Redirect’ issue exists, potentially causing information disclosure through phishing attempts over HTTP. This could allow a...

RHEL 9 : fence-agents (RHSA-2023:7753)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7753 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or...

ALSA-2023:7753 Moderate: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: python-certifi: Removal of e-Tugra root certificate CVE-2023-37920...

Fedora: Security Advisory (FEDORA-2023-76db6c040e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Welcart e-Commerce Plugin <= 2.9.6 is vulnerable to Path Traversal

Software Welcart e-Commerce Type Plugin Vulnerable versions = 2.9.6 Fixed in 2.9.7 OWASP Top 10 A5: Security Misconfiguration Classification Path Traversal CVE CVE-2023-6120 Patch priority Medium CVSS severity Medium 4.1 Developer Claim ownership PSID 545792f26683 Credits Marco Wotschka Required...

CVE-2023-6655

A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /wselfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interface. The manipulation of the argument...

Sql injection

A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /wselfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interface. The manipulation of the argument...

CVE-2023-6655 Hongjing e-HR Login Interface loadhistroyorgtree sql injection

A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /wselfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interface. The manipulation of the argument...

CVE-2023-6655

CVE-2023-6655 affects Hongjing e-HR 2020. The vulnerability resides in the Login Interface, specifically the file path …/loadhistroyorgtree, where manipulating the parameter parentid leads to a SQL injection . The issue is described as exploitable remotely and publicly disclosed (VDB-247358). Som...

CVE-2023-6655 Hongjing e-HR Login Interface loadhistroyorgtree sql injection

A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /wselfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interface. The manipulation of the argument...

Directory traversal

The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the uploadcertificatefile function. This makes it possible for administrators to upload .pem or .crt files to arbitrary locations on the server...

CVE-2023-6120 Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversal

The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the uploadcertificatefile function. This makes it possible for administrators to upload .pem or .crt files to arbitrary locations on the server...

Welcart e-Commerce < 2.9.7 - Authenticated (Administrator+) Directory Traversal

Description The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the uploadcertificatefile function. This makes it possible for administrators to upload .pem or .crt files to arbitrary locations on the server...

PT-2023-32528 · WordPress · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce plugin for WordPress versions up to, and including, 2.9.6 Description: The issue allows administrators to upload .pem or .crt files to arbitrary locations on the server via the upload certificate file function, making it...

e-sat.de Cross Site Scripting vulnerability OBB-3806761

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

EverShop Security Breach

EverShop is EverShop open source a NodeJS e-commerce platform. A security vulnerability exists in EverShop versions prior to 1.0.0-rc.5 that stems from the presence of a Reflective Cross-Site Scripting XSS vulnerability, which allows attackers to inject malicious code into the application's admin...

CVE-2023-43744

CVE-2023-43744 affects Zultys MX-Series devices (MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, MX30) with firmware older than 17.0.10 patch 17161 or 16.04 patch 16109. The vulnerability is an OS command injection where the user-supplied patch file name in the Patch Manager is passed to a shell script...

EverShop Security Breach

EverShop is EverShop open source a NodeJS e-commerce platform. A security vulnerability exists in EverShop versions prior to v.1.0.0-rc.5. A remote attacker can exploit this vulnerability to obtain sensitive information from the admin panel via a specially crafted script...

CVE-2023-43742

The CVE affects Zultys MX-Series IP endpoints (MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, MX30). The flaw is an authentication bypass caused by a protection mechanism failure in the authentication function: if the administrator client ignores a login failure and keeps sending requests on port 7505...