CVE-2022-44757 HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to weak cryptography

BigFix Insights for Vulnerability Remediation IVR uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive information, modify data in unexpected ways, etc...

CVE-2023-26220

CVE-2023-26220 describes a Stored Cross-Site Scripting (XSS) vulnerability in the Spotfire Library component of TIBCO Spotfire Analyst and Spotfire Server. A low-privileged attacker who can access the network can exploit this to trigger XSS, with exploitation requiring human interaction from a th...

CVE-2020-27631

creationtimestamp| type| source ---|---|--- 2023-10-10 20:16:59+00:00| seen| https://t.me/cibsecurity/71977...

CVE-2023-5490

CVE-2023-5490 affects the Beijing Baichuo/Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform (up to 20230928). The vulnerability resides in the /useratte/userattestation.php file, where manipulating the web_img argument enables unrestricted file upload, with remote exp...

CVE-2023-41964

The CVE-2023-41964 issue affects BIG-IP and BIG-IQ where two DB variables store sensitive values in plaintext (a proxy server password and a RADIUS/TACACS+ shared secret). The root cause is unencrypted storage of these values, enabling an authenticated attacker to access privileged information. R...

prdl.org Cross Site Scripting vulnerability OBB-3738909

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Windows Deployment Services Information Disclosure Vulnerability

...

CVE-2023-42475

The CVE-2023-42475 entry concerns a vulnerable file storage location in the Statutory Reporting application that could allow a low-privileged attacker to read server files, leading to information disclosure with low confidentiality impact. The available sources identify the affected software as t...

CVE-2023-44826

CVE-2023-44826 affects ZenTaoPMS v18.6 with a Cross Site Scripting vulnerability that could allow a local attacker to obtain sensitive information via a crafted script. The available connected sources identify ZenTaoPMS 18.6 as vulnerable and recommend upgrading to a version that includes a fix. ...

CVE-2023-38546

creationtimestamp| type| source ---|---|--- 2023-10-09 12:36:14+00:00| seen| https://t.me/thehackernews/3979 2023-10-09 13:49:46+00:00| seen| https://t.me/KomunitiSiber/902 2023-10-09 14:40:30+00:00| seen| Telegram/Kx47TlCntu1490zorZUl0W9pF3CSXUWayw0MQ5q-BW4Q 2023-10-09 19:38:29+00:00| seen|...

CVE-2023-5103

The CVE-2023-5103 issue affects SICK APU’s RDT400, where improper restriction of rendered UI layers or frames can allow an unprivileged remote attacker to disclose sensitive information by tricking a user into clicking an actionable item in an iframe. Documents consistently identify the affected ...

CVE-2023-5100

CVE-2023-5100 describes cleartext transmission of sensitive information in the SICK APU RDT400, enabling an unprivileged remote attacker to retrieve data by intercepting unencrypted network traffic. The vulnerability affects the SICK APU RDT400 component; the root cause is plaintext communication...

CVE-2023-45247

CVE-2023-45247 affects Acronis Cyber Protect Cloud Agent (Linux/macOS/Windows) before build 36497 and Acronis Cyber Protect 16 before build 39169 (also Acronis Agent variants before 36497 per PT-2023-5801). The vulnerability stems from missing authorization, enabling sensitive information disclos...

CVE-2023-5331 File Information Leak via IDOR in file_id in Draft Posts

Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information...

CVE-2023-39195

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority for the following reason: CVE-2023-39195 was found to be a duplicate of CVE-2023-42755. Please see https://access.redhat.com/security/cve/CVE-2023-42755 for more information...

Online Pizza Ordering System SQL Injection Vulnerability

Online Pizza Ordering System is an online pizza ordering system. Online Pizza Ordering System suffers from a SQL injection vulnerability that can be exploited by an attacker to view, add, modify, or delete information in the back-end database via scripting...

Wordpress Plugin Masterstudy LMS - 3.0.17 - Unauthenticated Instructor Account Creation

Exploit Title: Wordpress Plugin Masterstudy LMS - 3.0.17 - Unauthenticated Instructor Account Creation Google Dork: inurl:/user-public-account Date: 2023-09-04 Exploit Author: Revan Arifio Vendor Homepage: https:/.org/plugins/masterstudy-lms-learning-management-system/ Version: | | \ / | | / /| |...

CVE-2023-45369

The CVE-2023-45369 issue affects the PageTriage extension in MediaWiki. It exposes usernames of hidden users for affected releases: PageTriage with MediaWiki before 1.35.12; 1.36.x through 1.39.x before 1.39.5; and 1.40.x before 1.40.1. Red Hat and OSV entries corroborate the same affected ranges...

CVE-2023-45364

An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is leaked due to incorrect permissions being checked. This reveals that a given revision ID belonged to the given page title, and its timestam...

Information disclosure

In jpg driver, there is a possible use after free due to a logic error. This could lead to remote information disclosure no additional execution privileges needed...