CVE-2023-50466

The CVE-2023-50466 issue affects Weintek cMT2078X EasyWeb Web, Version v2.1.3, OS v20220215. The vulnerability is an authenticated command injection in the HMI Name parameter, allowing an attacker with valid credentials to execute arbitrary code or access sensitive information. Affected component...

CVE-2023-41967

Affected product and versions: Gallagher Controller 6000, versions 8.60 or earlier, and 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 MR5). Root cause / description: Sensitive information is not cleared after a debug or power state transition, allowing an attacker with knowledge of the ...

CVE-2023-23584

CVE-2023-23584 concerns Gallagher Command Centre. A bug in the REST API creates an observable response discrepancy that lets an insufficiently privileged user infer the presence of items that would normally be hidden. Affected versions include Gallagher Command Centre 8.50 and earlier, 8.60 prior...

CVE-2023-5056

CVE-2023-5056 involves the Skupper operator. A misconfiguration can enable creation of a service account that lets an authenticated attacker in a neighboring cluster view deployments across all namespaces, i.e., unauthorized access to information outside the user’s purview. The issue is tied to p...

CVE-2022-41677

CVE-2022-41677 affects Bosch IP camera devices. Concrete affected models/versions surfaced in external sources: Bosch CPP14 (firmware ≤ 8.80), CPP13 (≤ 8.48), CPP7.3 (≤ 7.86), and others. The issue is an information-disclosure vulnerability allowing an unauthenticated attacker to retrieve device ...

CVE-2017-17689

creationtimestamp| type| source ---|---|--- 2023-12-18 11:51:32+00:00| seen| https://t.me/arpsyndicate/1976...

GHSA-QJ86-P74R-7WP5 Remote code execution/programming rights with configuration section from any user account

Impact Anyone who can edit an arbitrary wiki page in an XWiki installation can gain programming right through several cases of missing escaping in the code for displaying sections in the administration interface. This impacts the confidentiality, integrity and availability of the whole XWiki...

GHSA-QQHQ-8R2C-C3F5 nvdApiKey is logged in debug mode

Summary The value of nvdApiKey configuration parameter is logged in clear text in debug mode. Details The NVD API key is a kind of secret and should be treated like other secrets when logging in debug mode. Expecting the same behavior as for several password configurations: just print Note that...

CVE-2023-33222

CVE-2023-33222 describes a stack-based buffer overflow when reading DESFire contactless cards due to a function that does not check data boundaries. Affected context is described as a card-reader/readerStack overflow leading to potential Remote Code Execution on the targeted device. Exploitation ...

CVE-2023-48551

Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

Cross site scripting

Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting DOM-based XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...

CVE-2023-48537

Adobe Experience Manager (AEM) 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker could inject malicious scripts, which execute in a victim’s browser when visiting a page containing the vulnerable field. The CV...

CVE-2023-48595

Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privilege attacker can inject malicious scripts, which execute in a victim’s browser when visiting the page containing the vulnerable field. Root...

CVE-2023-48445

CVE-2023-48445 affects Adobe Experience Manager 6.5.18 and earlier via a DOM-based XSS flaw: if a user visits a crafted URL on a vulnerable page, malicious JavaScript can execute in the victim’s browser. Consequence is typically user‑context script execution with low confidentiality/integrity imp...

CVE-2023-48539

Adobe Experience Manager 6.5.18 and earlier are affected by a DOM-based XSS vulnerability. A low-privileged attacker can lure a user to a crafted URL, causing malicious JavaScript to execute in the user’s browser. Remediation: apply the APSB23-72 updates to 6.5.19.0+ (6.5.19.0). CVSSv3.1 base sco...

CVE-2023-48556

CVE-2023-48556 affects Adobe Experience Manager 6.5.18 and earlier. A DOM-based XSS could be triggered when a user is induced to visit a vulnerable page URL, allowing malicious JavaScript to execute in the victim’s browser. The advisory and related sources indicate remediation via updates to a fi...

CVE-2023-48554

Adobe Experience Manager (AEM) up to version 6.5.18 is affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. Low-privilege attackers could inject malicious scripts, with JavaScript executing when a victim visits the page containing the field. Public technical de...

CVE-2023-48615

CVE-2023-48615 affects Adobe Experience Manager (AEM) 6.5.18 and earlier. The vulnerability is a stored XSS in vulnerable form fields that low-privilege attackers can abuse to execute malicious JavaScript in the victim’s browser when visiting the affected page. The issue is confirmed in multiple ...

CVE-2023-48393

CVE-2023-48393 affects Kaifa Technology WebITR (online attendance system). The vulnerability allows a remote attacker with regular user privileges to obtain partial sensitive information via error messages. The CVSSv3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates a low impact on confid...

CVE-2023-48381

Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion LFI vulnerability in a special URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify...