CVE-2023-3697

CVE-2023-3697 affects ASUSTOR ADM printers: the printer service fails to properly validate user input, enabling remote unauthorized users to traverse directories and create files beyond the intended path. Affected products/versions include ADM 4.0.6.RIS1, 4.1.0 and earlier, and ADM 4.2.2.RI61 and...

ChurchCRM 跨站脚本漏洞

ChurchCRM is an open source CRM system for churches. A cross-site scripting vulnerability exists in ChurchCRM version 4.2.1, which stems from the lack of effective filtering and escaping of user-supplied data in the Add New Deposit field of the View All Deposit module, and can be exploited by an...

USN-6282-1 velocity-tools vulnerability

Jackson Henry discovered that Velocity Tools incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code...

CVE-2023-3522

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in a2 License Portal System allows SQL Injection. This issue affects License Portal System: before 1.48...

PT-2023-25812

Name of the Vulnerable Software and Affected Versions Oduyo Online Collection Software versions prior to 1.0.1 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-25606

Name of the Vulnerable Software and Affected Versions Digital Ant E-Commerce Software versions prior to 11 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker c...

Digital Ant E-Commerce Cross-Site Scripting Vulnerability

Digital Ant E-Commerce is an e-commerce platform from Digital Ant, Inc. A cross-site scripting vulnerability exists in versions of Digital Ant E-Commerce Software prior to version 11, which arises from improperly neutralized input during web page generation...

Free Hospital Management System for Small Practices SQL Injection Vulnerability

Hospital Management System HMS is a computerized system that helps manage healthcare-related information and helps healthcare providers do their jobs efficiently. An SQL injection vulnerability exists in Free Hospital Management System for Small Practices version 1.0, which stems from the fact th...

USN-5193-3 xorg-server-hwe-16.04 vulnerabilities

USN-5193-1 fixed several vulnerabilities in X.Org. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled certain inputs. An attacker could use this issue to cause the server to crash,...

USN-6233-1 yajl vulnerabilities

It was discovered that YAJL was not properly performing bounds checks when decoding a string with escape sequences. If a user or automated system using YAJL were tricked into processing specially crafted input, an attacker could possibly use this issue to cause a denial of service application...

PT-2023-25786

Name of the Vulnerable Software and Affected Versions DeoThemes WordPress themes affected versions not specified Description The issue is related to Reflected Cross-Site Scripting via breadcrumbs in various versions of DeoThemes WordPress themes. This is due to insufficient input sanitization and...

PT-2023-3931 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.33 and prior Description: The issue is related to errors in processing input data in the MySQL Server product, specifically in the Server: Replication component. It allows a high-privileged attacker with network acce...

WordPress plugin AN_GradeBook SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

RestrictedPython 安全漏洞

RestrictedPython is a tool that helps define a subset of the Python language that allows program input to be provided to a trusted environment. A security vulnerability exists in RestrictedPython versions prior to 5.3, and prior to 6.1, which stems from allowing a user to provide program input to...

CVE-2023-2853

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Softmed SelfPatron allows Reflected XSS. This issue affects SelfPatron : before 2.0...

CVE-2023-0359

A missing nullptr-check in handlerainput can cause a nullptr-deref...

WordPress plugin Image Protector 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin of the WordPress Foundation. A cross-site scripting vulnerability...

CVE-2023-37307

In MISP before 2.4.172, titleforlayout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts...

The vulnerability of the command-line interface (CLI) of the FortiADC application controller allows a attacker to execute arbitrary commands.

The vulnerability of the command-line interface CLI of the FortiADC application controller is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

Meldekarten Generator 跨站脚本漏洞

Meldekarten Generator is a project to create a program by the individual developer jucktnich. A cross-site scripting vulnerability exists in Meldekarten generator 1.0.0b1.1.1 and earlier versions, which stems from the vulnerability of all text fields on a web page to an XSS attack, where user inp...