SUSE CVE-2023-37543

Cacti before 1.2.6 allows IDOR Insecure Direct Object Reference for accessing any graph via a modified localgraphid parameter to graphxport.php. This is a different vulnerability than CVE-2019-16723...

CVE-2023-4106 A guest user can perform various actions on public playbooks

Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks...

Mattermost Security Vulnerabilities

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from not properly checking if the requesting user is a guest guest user, which allows guest users to perform different operations on public...

CVE-2023-36313

PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting XSS via all post parameters of "Export Requests" aside from "requestfeed"...

CVE-2023-36313

PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting XSS via all post parameters of "Export Requests" aside from "requestfeed"...

CVE-2023-36313

PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting XSS via all post parameters of "Export Requests" aside from "requestfeed"...

Cross site scripting

PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting XSS via all post parameters of "Export Requests" aside from "requestfeed"...

DEBIAN-CVE-2023-37543

Cacti before 1.2.6 allows IDOR Insecure Direct Object Reference for accessing any graph via a modified localgraphid parameter to graphxport.php. This is a different vulnerability than CVE-2019-16723...

CVE-2023-37543

Cacti before 1.2.6 allows IDOR Insecure Direct Object Reference for accessing any graph via a modified localgraphid parameter to graphxport.php. This is a different vulnerability than CVE-2019-16723...

UBUNTU-CVE-2023-37543

Cacti before 1.2.6 allows IDOR Insecure Direct Object Reference for accessing any graph via a modified localgraphid parameter to graphxport.php. This is a different vulnerability than CVE-2019-16723...

CVE-2023-36313

PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting XSS via all post parameters of "Export Requests" aside from "requestfeed"...

CVE-2023-36313

PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting XSS via all post parameters of "Export Requests" aside from "requestfeed"...

PT-2023-5432 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.6 Description: The issue is related to an Insecure Direct Object Reference IDOR in the graph xport.php component, allowing unauthorized access to any graph via a modified local graph id parameter. This can enable a...

CVE-2022-48604

A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database...

CVE-2022-48604

A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database...

Sql injection

A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized user-controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database...

CVE-2022-48604

CVE-2022-48604 affects ScienceLogic SL1, with a SQL injection in the “logging export” feature where unsanitized user input is passed into a SQL query. Multiple sources (including CNNVD and Red Hat) indicate vulnerable versions include SL1 up to at least 11.1.2 (and prior); PT-Security notes no ex...

CVE-2022-48604

A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database...

CVE-2022-48604

A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database...

CVE-2022-48581

A command injection vulnerability exists in the “dash export” feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system...