799 matches found
PT-2023-29761 · Unknown · Dreamer Cms
Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A Cross-Site Request Forgery CSRF issue was discovered in Dreamer CMS via the component /admin/variable/delete. This allows for unauthorized actions to be performed on the application. Recommendations: F...
1E Platform SQL Injection Vulnerability
1E Platform is a terminal endpoint management and automation solution from 1E. A security vulnerability exists in 1E Platform versions prior to v8.1.2, prior to v8.4.1, prior to v9.0.1, and prior to v23.7.1 SaaS, which stems from the incorrect neutralization of special elements used in SQL...
Samba Security Vulnerabilities
Samba is the standard Windows interoperability program suite for Linux and Unix. A security vulnerability exists in Samba 4.1 and earlier versions that can be exploited by a client to truncate files with read-only permissions...
QDocs Smart School SQL Injection Vulnerability
QDocs Smart School is a Smart School application from QDocs, Inc. QDocs Smart School version 6.4.1 has a SQL injection vulnerability that originates from the parameter searchdata0title/searchdata0searchfield/searchdata0 searchvalue can cause sql injection...
PT-2023-26262 · Unknown · Revive Adserver
Name of the Vulnerable Software and Affected Versions: Revive Adserver versions 5.4.1 and earlier Description: A reflected XSS vulnerability exists. This issue may allow attackers to inject malicious scripts into websites, potentially leading to unauthorized access or control of user sessions...
CVE-2022-28834
Adobe InCopy versions 17.1 and earlier and 16.4.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
CVE-2023-4475
An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master ADM allows an attacker to exploit the file renaming feature to move files to unintended directories. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below...
CVE-2023-28711
Insufficient control flow management in the Hyperscan Library maintained by IntelR before version 5.4.1 may allow an authenticated user to potentially enable denial of service via local access...
CVE-2023-32564
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution...
CVE-2023-32562
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. Fixed in version 6.4.1...
CVE-2023-32566
An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1...
PT-2023-21920 · Unknown · Hyperscan Library
Name of the Vulnerable Software and Affected Versions: Hyperscan Library versions prior to 5.4.1 Description: Insufficient control flow management in the Hyperscan Library may allow an authenticated user to potentially enable denial of service via local access. Recommendations: For versions prior...
Moodle 跨站脚本漏洞
Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle that stems from the presence of a cross-site scripting XSS vulnerability. Affected products a...
GHSA-X3CC-X39P-42QX fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name
Impact As a part of this vulnerability, user was able to se code using proto as a tag or attribute name. js const XMLParser, XMLBuilder, XMLValidator = require"fast-xml-parser"; let XMLdata = "hacked" const parser = new XMLParser; let jObj = parser.parseXMLdata; console.logjObj.polluted // should...
CVE-2023-2484
The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
WordPress Plugin Active Directory Integration SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability exist...
CVE-2023-2909
EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below...
PT-2023-6485 · Iniparser +4 · Iniparser +4
Name of the Vulnerable Software and Affected Versions: iniparser version 4.1 Description: The issue is related to a NULL Pointer Dereference in the iniparser getlongint function, which fails to check for NULL returns from the iniparser getstring function. This can lead to a denial of service...
ASUSTOR Data Master 路径遍历漏洞
ASUSTOR Data Master is an operating system exclusively on the ASUSTOR NAS from China's ASUS, featuring a tablet-like graphical interface comparable to a zero-learning curve, making it easy to get started right away. A security vulnerability exists in ASUSTOR Data Master ADM that stems from an...