CVE-2023-3181

CVE-2023-3181 affects Splashtop Software Updater (uninst.exe). The uninstaller creates a temporary folder at C:\Windows\Temp~nsu.tmp, copies itself as Au_.exe into that folder, and then Au_.exe is launched as SYSTEM on reboot or during an MSI repair via Splashtop Streamer’s Windows Installer. The...

U.S. Dept Of Defense: Improper Authentication (Login without Registration with any user) at ████

The ████ system was vulnerable to an improper authentication issue. Attackers could log in as any user without registration by exploiting the signin parameter in the ██████████ endpoint. This allowed them to authenticate and change the session of a victim to any other user...

CVE-2023-6282

IceHrm 23.0.0.OS does not sufficiently encode user-controlled input, which creates a Cross-Site Scripting XSS vulnerability via /icehrm/app/fileuploadpage.php, in multiple parameters. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload and partially...

Cross site scripting

IceHrm 23.0.0.OS does not sufficiently encode user-controlled input, which creates a Cross-Site Scripting XSS vulnerability via /icehrm/app/fileuploadpage.php, in multiple parameters. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload and partially...

CVE-2023-6282 Cross-Site Scripting vulnerability in IceHrm

IceHrm 23.0.0.OS does not sufficiently encode user-controlled input, which creates a Cross-Site Scripting XSS vulnerability via /icehrm/app/fileuploadpage.php, in multiple parameters. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload and partially...

CVE-2023-6282 Cross-Site Scripting vulnerability in IceHrm

IceHrm 23.0.0.OS does not sufficiently encode user-controlled input, which creates a Cross-Site Scripting XSS vulnerability via /icehrm/app/fileuploadpage.php, in multiple parameters. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload and partially...

CVE-2023-6282 Cross-Site Scripting vulnerability in IceHrm

IceHrm 23.0.0.OS does not sufficiently encode user-controlled input, which creates a Cross-Site Scripting XSS vulnerability via /icehrm/app/fileuploadpage.php, in multiple parameters. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload and partially...

FreeBSD : jenkins -- multiple vulnerabilities (8b03d274-56ca-489e-821a-cf32f07643f0)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 8b03d274-56ca-489e-821a-cf32f07643f0 advisory. - Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI...

PT-2024-12288 · Splashtop · Splashtop Streamer +1

Name of the Vulnerable Software and Affected Versions: Splashtop Software Updater affected versions not specified Description: The issue concerns the creation of a folder at C:WindowsTempnsu.tmp by the C:Program Files x86SplashtopSplashtop Software Updateruninst.exe process, which copies itself t...

GHSA-53PH-2R2X-VQW8 Cross-site WebSocket hijacking vulnerability in the Jenkins CLI

Jenkins has a built-in command line interface CLI to access Jenkins from a script or shell environment. Since Jenkins 2.217 and LTS 2.222.1, one of the ways to communicate with the CLI is through a WebSocket endpoint. This endpoint relies on the default Jenkins web request authentication...

CVE-2024-23898

Jenkins 2.217 through 2.441 both inclusive, LTS 2.222.1 through 2.426.2 both inclusive does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking CSWSH vulnerability, allowing attackers to execute CLI commands on the Jenki...

Cross site scripting

Jenkins 2.217 through 2.441 both inclusive, LTS 2.222.1 through 2.426.2 both inclusive does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking CSWSH vulnerability, allowing attackers to execute CLI commands on the Jenki...

CVE-2024-23898

Jenkins 2.217 through 2.441 both inclusive, LTS 2.222.1 through 2.426.2 both inclusive does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking CSWSH vulnerability, allowing attackers to execute CLI commands on the Jenki...

CVE-2024-23898

Jenkins 2.217 through 2.441 both inclusive, LTS 2.222.1 through 2.426.2 both inclusive does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking CSWSH vulnerability, allowing attackers to execute CLI commands on the Jenki...

CVE-2023-51711

An issue was discovered in Regify Regipay Client for Windows version 4.5.1.0 allows DLL hijacking: a user can trigger the execution of arbitrary code every time the product is executed...

CVE-2023-51711

An issue was discovered in Regify Regipay Client for Windows version 4.5.1.0 allows DLL hijacking: a user can trigger the execution of arbitrary code every time the product is executed...

Design/Logic Flaw

An issue was discovered in Regify Regipay Client for Windows version 4.5.1.0 allows DLL hijacking: a user can trigger the execution of arbitrary code every time the product is executed...

CVE-2023-51711

CVE-2023-51711 affects Regify Regipay Client for Windows, version 4.5.1.0. The issue is a DLL hijacking vulnerability that permits the execution of arbitrary code when the product runs. The Red Hat/CNNVD entries corroborate the DLL hijack description and the target is Regipay Client for Windows 4...

REGIFY Regipay Security Breach

REGIFY Regipay is an application about payroll from REGIFY Germany. A security vulnerability exists in REGIFY Regipay version 4.5.1.0, which stems from allowing DLL hijacking and can be exploited by attackers to execute arbitrary code...

PT-2024-14255 · Regify · Regify Regipay Client For Windows

Name of the Vulnerable Software and Affected Versions: Regify Regipay Client for Windows version 4.5.1.0 Description: An issue was discovered in Regify Regipay Client for Windows that allows DLL hijacking, enabling a user to trigger the execution of arbitrary code every time the product is...