GHSA-96XV-RMWJ-6P9W Grav Server-side Template Injection (SSTI) via Twig Default Filters

Hi, actually we have sent the bug report to [email protected] on 27th March 2023 and on 10th April 2023. Grav Server-side Template Injection SSTI via Insufficient Validation in filterFilter Summary: | Product | Grav CMS | | ----------------------- | --------------------------------------------...

CVE-2023-32754

Thinking Software Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database...

CVE-2023-32754 Thinking Software Efence - SQL injection

Thinking Software Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database...

CVE-2023-34252 Grav Server-side Template Injection via Insufficient Validation in filterFilter

Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the GravExtension.filterFilter function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a...

CVE-2023-33253

LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The vulnerability is in the message function, and is due to insufficient validation of the file such as shell.jpg.php.shell being...

CVE-2023-33253

LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The vulnerability is in the message function, and is due to insufficient validation of the file such as shell.jpg.php.shell being...

Input validation

LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The vulnerability is in the message function, and is due to insufficient validation of the file such as shell.jpg.php.shell being...

CVE-2023-33253

LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The vulnerability is in the message function, and is due to insufficient validation of the file such as shell.jpg.php.shell being...

CVE-2023-33253

LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The vulnerability is in the message function, and is due to insufficient validation of the file such as shell.jpg.php.shell being...

Exploit for Unrestricted Upload of File with Dangerous Type in Agilebio Labcollector

CVE-2023-33253 LabCollector 6.0 though 6.15 allows remote cod...

CVE-2023-33188 Uncontrolled data used in content resolution

Omni-notes is an open source note-taking application for Android. The Omni-notes Android app had an insufficient path validation vulnerability when displaying the details of a note received through an externally-provided intent. The paths of the note's attachments were not properly validated,...

Cisco Webex Network Recording Player (cisco-sa-webex-player-rCFDeVj2)

The version of Cisco Webex Network Recording Player and Cisco Webex Player installed on the remote host is affected by a memory corruption vulnerability due to insufficient validation of Webex recording files formatted as either Advanced Recording Format ARF or Webex Recording Format WRF. An...

CVE-2023-25598

A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient validation for the home.php page. A successful...

CVE-2023-25598

A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient validation for the home.php page. A successful...

GHSA-CQMJ-92XF-R6R9 Insufficient validation when decoding a Socket.IO packet

Impact A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. TypeError: Cannot convert object to primitive value at Socket.emit node:events:507:25 at .../nodemodules/socket.io/lib/socket.js:531:14 Patches A fix has been...

Microsoft Office 2019 Multiple RCE Vulnerabilities (May 2023) - Mac OS X

This host is missing an important security update for Microsoft Office 2019 on Mac OS X according to Microsoft security update May 2023 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holder...

The vulnerability of the OBVAM Trn Journal Domain sub-component of the Oracle Banking Virtual Account Management component of the banking analytics system’s simulation model, Oracle Financial Services Applications, allows a perpetrator to cause service failures or gain access to read, modify, add, or delete data.

The vulnerability of the OBVAM Trn Journal Domain component of the Oracle Banking Virtual Account Management banking analytics system’s simulation model relates to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to cause service failures or gain access...

Fedora 36 : chromium (2023-12b28d0d37)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-12b28d0d37 advisory. update to 113.0.5672.64. Fixes the following security issues: CVE-2023-2459 CVE-2023-2460 CVE-2023-2461 CVE-2023-2462 CVE-2023-2463 CVE-2023-2464...

Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (May 2023)

This host is missing a critical security update according to Microsoft Office Click-to-Run update May 2023 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Microsoft Excel 2013 Service Pack 1 Remote Code Execution Vulnerability (KB5002384)

This host is missing an important security update according to Microsoft KB5002384 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...