CVE-2023-48445

CVE-2023-48445 affects Adobe Experience Manager 6.5.18 and earlier via a DOM-based XSS flaw: if a user visits a crafted URL on a vulnerable page, malicious JavaScript can execute in the victim’s browser. Consequence is typically user‑context script execution with low confidentiality/integrity imp...

CVE-2023-48539

Adobe Experience Manager 6.5.18 and earlier are affected by a DOM-based XSS vulnerability. A low-privileged attacker can lure a user to a crafted URL, causing malicious JavaScript to execute in the user’s browser. Remediation: apply the APSB23-72 updates to 6.5.19.0+ (6.5.19.0). CVSSv3.1 base sco...

CVE-2023-48556

CVE-2023-48556 affects Adobe Experience Manager 6.5.18 and earlier. A DOM-based XSS could be triggered when a user is induced to visit a vulnerable page URL, allowing malicious JavaScript to execute in the victim’s browser. The advisory and related sources indicate remediation via updates to a fi...

CVE-2023-48554

Adobe Experience Manager (AEM) up to version 6.5.18 is affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. Low-privilege attackers could inject malicious scripts, with JavaScript executing when a victim visits the page containing the field. Public technical de...

CVE-2023-48615

CVE-2023-48615 affects Adobe Experience Manager (AEM) 6.5.18 and earlier. The vulnerability is a stored XSS in vulnerable form fields that low-privilege attackers can abuse to execute malicious JavaScript in the victim’s browser when visiting the affected page. The issue is confirmed in multiple ...

CVE-2023-48393

CVE-2023-48393 affects Kaifa Technology WebITR (online attendance system). The vulnerability allows a remote attacker with regular user privileges to obtain partial sensitive information via error messages. The CVSSv3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates a low impact on confid...

CVE-2023-48381

Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion LFI vulnerability in a special URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify...

Design/Logic Flaw

Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion LFI vulnerability in a special URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify...

CVE-2023-48382

The CVE-2023-48382 entry concerns Softnext Mail SQR Expert with a Local File Inclusion (LFI) vulnerability in a mail delivery URL. An unauthenticated attacker can exploit this to execute arbitrary PHP files with a .asp extension in certain system paths and access/modify partial system information...

CVE-2023-49347

Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may read private information from windows, present false...

CVE-2023-49343

Concrete details exist: CVE-2023-49343 affects Budgie Extras components (notably the budgie-app-launcher-applet/Dropby applet). It describes temporary data passed between application components stored in a location accessible to local users, enabling a local attacker to view or manipulate the dat...

CVE-2023-49342

Temporary data passed between application components by Budgie Extras Clockworks applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false...

Liberapay: Avatar URL is exposed in patron export for secret donations

The avatar URL was exposed in the patron export for secret donations, which could potentially identify donors who wished to remain anonymous...

tcshare.com Improper Access Control vulnerability OBB-3813691

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-49152

CVE-2023-49152 affects Labs64 WordPress Credit Tracker (Credit Tracker plugin) up to version 1.1.17. Root cause: improper neutralization of input during web page generation, enabling Stored XSS. Impact: stored cross-site scripting could affect users accessing injected content; CVSS v3.1 base scor...

CVE-2023-6595

CVE-2023-6595 affects Progress WhatsUp Gold versions released before 2023.1. The issue is an API endpoint that lacks authentication, allowing an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold. Red Hat and Nessus/NASL reports corroborate the core ...

CVE-2023-6569 External Control of File Name or Path in h2oai/h2o-3

External Control of File Name or Path in h2oai/h2o-3...

CVE-2023-25650

CVE-2023-25650 affects ZTE ZXCLOUD iRAI, where the backend fails to escape special strings or restrict paths in the download interface, enabling an attacker with user permissions to modify a request parameter and trigger arbitrary file downloads. The vulnerability is rooted in improper input hand...

CVE-2023-43585

CVE-2023-43585 corresponds to Zoom components on iOS: Zoom Mobile App for iOS and Zoom SDKs for iOS prior to version 5.16.5. The root cause is improper access control that may allow an authenticated user to disclose information via network access. Affected products include Zoom Mobile App for iOS...

CVE-2023-6789

CVE-2023-6789 is a stored XSS vulnerability in Palo Alto Networks PAN-OS web interface. An authenticated read‑write administrator can store a JavaScript payload, which executes in the context of another authenticated administrator, disguising actions as those of the unsuspecting user. The issue i...