Jenkins ElasticBox CI Plugin vulnerable to cross-site request forgery

Jenkins ElasticBox CI Plugin 5.0.1 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials...

Jenkins mabl Plugin missing permission check

Jenkins mabl Plugin 0.0.46 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

CVE-2023-29298

Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier and 2023.0.0.330468 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC...

CVE-2023-29298

Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier and 2023.0.0.330468 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC...

Improper access control

Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier and 2023.0.0.330468 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC...

CVE-2023-29298 Adobe ColdFusion Improper Access Control Security feature bypass

Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier and 2023.0.0.330468 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC...

CVE-2023-37196

Schneider Electric StruxureWare Data Center Expert (DCE) pre‑7.9.3 is affected by a CWE-89 SQL Injection due to improper neutralization of special elements. An authenticated DCE user could access, modify, or delete content and tamper with endpoint alert settings. The CVE notes high impact (C/H/I/...

CWA iOS - Center mouse wheel button clicks not working inside ICA sessions

When Citrix ICA sessions launched from iOS endpoints, the center mouse button clicks are not effective anymore It is only the center button clicks that are not effective inside Citrix sessions. It is still possible to scroll up & down using the center wheel inside a Citrix session...

PT-2023-3494 · Schneider Electric · Struxureware Data Center Expert

Name of the Vulnerable Software and Affected Versions: StruxureWare Data Center Expert affected versions not specified Description: A SQL Injection vulnerability exists due to improper neutralization of special elements in SQL commands, allowing an authenticated user to access, change, or delete...

PT-2023-3962

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 2018u16 and earlier Adobe ColdFusion versions 2021u6 and earlier Adobe ColdFusion versions 2023.0.0.330468 and earlier Description The issue is related to an Improper Access Control vulnerability that could result in ...

CVE-2023-3271

Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing unauthenticated endpoints...

CVE-2023-35696

Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests...

CVE-2023-35696

Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests...

Information disclosure

Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests...

CVE-2023-35696

CVE-2023-35696 affects the SICK ICR890-4 through unauthenticated HTTP endpoints that can disclose sensitive device information to an unauthenticated remote attacker. The vulnerability is documented across multiple sources (NVD, Red Hat, CVE list, SICK PSIRT) with CVSSv3.1 metrics indicating Netwo...

CVE-2023-35696

Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests...

CVE-2023-35696

Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the device via HTTP requests...

GHSA-2Q4P-F6GF-MQR5 Graylog server has partial path traversal vulnerability in Support Bundle feature

A partial path traversal vulnerability exists in Graylog's Support Bundle feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource. Thanks to weiweiwei9811 for reporting this vulnerability and providing detailed information. Impact Graylog's Support Bundle...

TravianZ 跨站脚本漏洞

TravianZ is a free-to-play in-browser web strategy game from Travian, a German company. A security vulnerability exists in TravianZ version 8.3.4 and earlier, which stems from a cross-site scripting XSS vulnerability in multiple endpoints...

PT-2023-22235 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions 8.8.15 through 9.0 Description: An issue in Zimbra Collaboration allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters. Recommendations: For...