CVE-2023-5010

CVE-2023-5010 affects Student Information System v1.0. The vulnerability is a set of multiple authenticated SQL Injection flaws in marks.php where the coursecode parameter is not validated, sending unfiltered input to the database. The CVSS v3.1 base metrics indicate a HIGH impact (8.8) with NETW...

CVE-2023-6975

CVE-2023-6975 is described in the connected data as a path traversal vulnerability related to MLflow (BIT-MLFLOW-2023-6975 / GHSA ...), potentially allowing command execution and access to data and models. The supplied documents do not provide explicit affected versions or remediation details; no...

CVE-2023-50639

CVE-2023-50639 : A cross-site scripting (XSS) vulnerability exists in CuteHttpFileServer (CHFS) versions 1.0 and 2.0, originating from the file upload feature on the homepage. Exploitation could allow an attacker to obtain sensitive information via the uploaded file handling. Public sources consi...

CVE-2023-44991

CVE-2023-44991 affects the WordPress plugin Media File Renamer: Rename Files (Manual, Auto & AI) up to version 5.6.9. The vulnerability is an information disclosure via the plugin’s debug/log logging functionality, allowing an unauthenticated actor to access sensitive data. Multiple sources confi...

CVE-2023-44983

CVE-2023-44983 corresponds to Aruba HiSpeed Cache (WordPress plugin) with vulnerable versions

CVE-2023-6280

CVE-2023-6280 describes an XXE (XML External Entity) vulnerability in the 52North Web Processing Service (WPS). The issue affects 52North WPS versions prior to 4.0.0-beta.11, where the WebProcessingService servlet may process external entities, allowing an attacker to retrieve files by issuing HT...

CVE-2023-44982

CVE-2023-44982 affects the WordPress WP Retina 2x plugin (Jordy Meow Perfect Images) up to version 6.4.5. The issue is a sensitive information exposure vulnerability that allows an unauthenticated attacker to access confidential data. Affected versions:

CVE-2023-50466

The CVE-2023-50466 issue affects Weintek cMT2078X EasyWeb Web, Version v2.1.3, OS v20220215. The vulnerability is an authenticated command injection in the HMI Name parameter, allowing an attacker with valid credentials to execute arbitrary code or access sensitive information. Affected component...

CVE-2023-41967

Affected product and versions: Gallagher Controller 6000, versions 8.60 or earlier, and 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 MR5). Root cause / description: Sensitive information is not cleared after a debug or power state transition, allowing an attacker with knowledge of the ...

CVE-2023-23584

CVE-2023-23584 concerns Gallagher Command Centre. A bug in the REST API creates an observable response discrepancy that lets an insufficiently privileged user infer the presence of items that would normally be hidden. Affected versions include Gallagher Command Centre 8.50 and earlier, 8.60 prior...

CVE-2023-5056

CVE-2023-5056 involves the Skupper operator. A misconfiguration can enable creation of a service account that lets an authenticated attacker in a neighboring cluster view deployments across all namespaces, i.e., unauthorized access to information outside the user’s purview. The issue is tied to p...

CVE-2022-41677

CVE-2022-41677 affects Bosch IP camera devices. Concrete affected models/versions surfaced in external sources: Bosch CPP14 (firmware ≤ 8.80), CPP13 (≤ 8.48), CPP7.3 (≤ 7.86), and others. The issue is an information-disclosure vulnerability allowing an unauthenticated attacker to retrieve device ...

CVE-2017-17689

creationtimestamp| type| source ---|---|--- 2023-12-18 11:51:32+00:00| seen| https://t.me/arpsyndicate/1976...

GHSA-QJ86-P74R-7WP5 Remote code execution/programming rights with configuration section from any user account

Impact Anyone who can edit an arbitrary wiki page in an XWiki installation can gain programming right through several cases of missing escaping in the code for displaying sections in the administration interface. This impacts the confidentiality, integrity and availability of the whole XWiki...

GHSA-QQHQ-8R2C-C3F5 nvdApiKey is logged in debug mode

Summary The value of nvdApiKey configuration parameter is logged in clear text in debug mode. Details The NVD API key is a kind of secret and should be treated like other secrets when logging in debug mode. Expecting the same behavior as for several password configurations: just print Note that...

CVE-2023-33222

CVE-2023-33222 describes a stack-based buffer overflow when reading DESFire contactless cards due to a function that does not check data boundaries. Affected context is described as a card-reader/readerStack overflow leading to potential Remote Code Execution on the targeted device. Exploitation ...

CVE-2023-48551

Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

Cross site scripting

Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting DOM-based XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...

CVE-2023-48537

Adobe Experience Manager (AEM) 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker could inject malicious scripts, which execute in a victim’s browser when visiting a page containing the vulnerable field. The CV...

CVE-2023-48595

Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privilege attacker can inject malicious scripts, which execute in a victim’s browser when visiting the page containing the vulnerable field. Root...