14169 matches found
CVE-2023-48925
The CVE-2023-48925 entry concerns a SQL injection in Buy Addons bavideotab (PrestaShop addon) before version 1.0.6, exploitable via BaVideoTabSaveVideoModuleFrontController::run(). The vulnerability can escalate privileges and disclose sensitive information. Affected version: prior to 1.0.6. Reme...
PT-2023-17328 · Unknown · Octopus Server
Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: The issue allows the OpenID client secret to be logged in clear text during the configuration of the server. Recommendations: At the moment, there is no information about a newer...
PT-2023-31456 · Unknown · Dreamer Cms
Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: The issue is related to a Cross-Site Request Forgery CSRF in the /admin/database/backup component. This allows for unauthorized actions to be performed on the system. Recommendations: For Dreamer CMS...
info-tours.net Cross Site Scripting vulnerability OBB-3811360
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2023-20988 · Undefined · Undefined
Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: A vulnerability alert has been issued, but details about the issue are not provided. The estimated number of potentially affected devices and...
PT-2023-9212 · R7-Office · R7-Office
Name of the Vulnerable Software and Affected Versions: R7-Office affected versions not specified Description: The issue is related to the lack of protection for the web page structure, which can be exploited by a remote attacker to conduct a cross-site scripting XSS attack. Recommendations: At th...
CVE-2023-49923
An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the App Search logs. Elastic has released...
CVE-2023-35630
Internet Connection Sharing ICS Remote Code Execution Vulnerability...
Information disclosure
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability...
CVE-2023-49923
An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the App Search logs. Elastic has released...
Design/Logic Flaw
In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality...
Improper access control
An improper access control vulnerability exists in a Huawei datacom product. Attackers can exploit this vulnerability to obtain partial device information...
Microsoft Word Information Disclosure Vulnerability
...
CVE-2023-49923: Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the App Search logs. Elastic has released...
Elastic Enterprise Search Log Information Disclosure Vulnerability
Elastic Enterprise Search is an enterprise search tool from Dutch company Elastic. A security vulnerability exists in Elastic Enterprise Search versions 7.0.0 through 7.17.16 and 8.0.0 through 8.11.2, which stems from App Search's Documents API recording the original content of indexed documents ...
Linux sec_attest_info() Heap Buffer Overflow Info Disclosure
The vulnerability of the secattestinfo function drivers/accel/habanalabs/common/habanalabsioctl.c in the Linux kernel is related to insufficient protection of service data when processing the Pad0 field. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected...
CVE-2023-6538
CVE-2023-6538 is an Insecure Direct Object Reference in Hitachi NAS System Management Unit (SMU). Affects SMU versions prior to 14.8.7825.01; authenticated Storage/Server/Storage+Server administrators can access SMU configuration backup data via URL manipulation (IDOR), leading to unintended info...
Tenda AX9 setDeviceInfo() Arbitrary Command Execution
The vulnerability of the setDeviceInfo function in Tenda AX9 Wi-Fi routers’ microprogramming software is related to the lack of measures taken to protect the SQL query structure when processing the mac parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
PT-2023-31555 · Jfinalcms · Jfinalcms
Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: The issue allows a remote attacker to read files via ../ Directory Traversal in the "/common/down/file" fileKey parameter. This could potentially lead to unauthorized access to sensitive information...
