CVE-2023-40877

DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting XSS vulnerability at /dede/freelistedit.php via the title parameter...

“The Access Policy has externally been modified and cannot be changed by Studio” warning message

After setting access policy rule, “Access Policy” option in “Edit Delivery Group” dialog cannot display. ------------------------ Add-PSSnapin -Name Citrix. Set-BrokerAccessPolicyRule 'AG' -IncludedClientIPFilterEnabled $True Set-BrokerAccessPolicyRule 'AG' -IncludedClientIPs xxx.xxx.xxx.xxx...

PT-2023-27684 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS versions up to and including 5.7.110 Description: A cross-site scripting XSS issue was found in DedeCMS. The issue is located at the "/dede/freelist edit.php" API endpoint via the title parameter. Recommendations: For DedeCMS versions...

PT-2023-27682 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS versions up to and including 5.7.110 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities are located at the "/dede/vote edit.php" API endpoint via the votename and votenote...

GHSA-X2MH-8FMC-RQGH Apache Airflow denial of service vulnerability

Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests,...

Apache Airflow denial of service vulnerability

Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests,...

DRUPAL-CONTRIB-2023-040

The Data Field module provides a way of building field types that are made up of other fields, a simpler alternative to e.g. the Paragraphs system. Access to these forms isn't properly validated, allowing a user with the "access content" permission to view and edit fields on entities...

CVE-2023-37379

Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests,...

Improper access control

Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests,...

PYSEC-2023-152

Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests,...

CVE-2023-37379

CVE-2023-37379 affects Apache Airflow versions prior to 2.7.0. An authenticated user with Connection edit privileges can access connection information and abuse the test connection feature by sending many requests, causing a DoS condition on the server and enabling potentially harmful connections...

CVE-2023-41098

An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard edit...

PT-2023-27784 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP version 2.4.174 Description: An issue exists in the DashboardsController.php file, specifically a reflected XSS issue via the id parameter when editing a dashboard. Recommendations: For MISP version 2.4.174, consider disabling the id...

CVE-2023-4443

A vulnerability classified as critical has been found in SourceCodester Free Hospital Management System for Small Practices 1.0/5.0.12. Affected is an unknown function of the file vm\doctor\edit-doc.php. The manipulation of the argument id00/nic/oldemail/email/spec/Tele leads to sql injection. It...

CVE-2023-4444

A vulnerability classified as critical was found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this vulnerability is an unknown functionality of the file vm\patient\edit-user.php. The manipulation of the argument id00/nic/oldemail/email/spec/Tele leads to...

Sql injection

A vulnerability classified as critical was found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this vulnerability is an unknown functionality of the file vm\patient\edit-user.php. The manipulation of the argument id00/nic/oldemail/email/spec/Tele leads to...

Herd Effects < 5.2.3 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup In the plugin settings, add a new item...

PT-2023-29240 · Sourcecodester · Sourcecodester Free Hospital Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Free Hospital Management System for Small Practices version 1.0 Description: A critical issue was found in the system, affecting an unknown functionality of the file vmpatientedit-user.php. The manipulation of the argument...

PT-2023-29210 · Sourcecodester · Sourcecodester Inventory Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Inventory Management System version 1.0 Description: A critical issue has been found in the processing of the file app/action/edit update.php, where the manipulation of the user id argument leads to sql injection. The attack ca...

Inventory Management System SQL注入漏洞

Inventory Management System is an inventory management system by stemword individual developers. Inventory Management System version 1.0 suffers from a SQL injection vulnerability that originates from the parameter userid in the file app/action/editupdate.php, which can lead to sql injection...