PT-2023-31559 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad versions prior to 6.2.0 Description: An issue was discovered due to a lack of rate limiting in the "email address verification" feature. This allows an attacker to send many requests for a known address, causing Denial Of Service by...

CVE-2023-50455: Allocation of Resources Without Limits or Throttling

An issue was discovered in Zammad before 6.2.0. Due to lack of rate limiting in the "email address verification" feature, an attacker could send many requests for a known address to cause Denial Of Service generation of many emails, which would also spam the victim...

Insecure and Inflexible Forwarder Approval Mechanism (Full Access Grant)

Lines of code Vulnerability details Impact The current implementation of the onlyApprovedForwarder modifier in the Ocean smart contract has several negative impacts: 1. Security Risk: Users are exposed to a significant security risk if their forwarder is compromised. An attacker can exploit full...

jose4j: Insecure iteration count setting

A flaw was found in Jose4J which allows a malicious user or internal person to erroneously set a low iteration count of 1000 or less to secure the Json Web Token. This could apply to lack of entropy and leave the system less secure...

PT-2023-9595

Name of the Vulnerable Software and Affected Versions MySQL Connectors versions 9.0.0 and prior Description The issue is related to a lack of authentication for a critical function in the Connector/Python component of MySQL Connectors, allowing a low-privileged attacker with network access via...

CVE-2023-48833: Uncontrolled Resource Consumption

A lack of rate limiting in pjActionAJaxSend in Time Slots Booking Calendar 4.0 allows attackers to cause resource exhaustion...

CVE-2023-48831: Uncontrolled Resource Consumption

A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion...

CVE-2023-48834: Uncontrolled Resource Consumption

A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion...

CVE-2023-48840: Uncontrolled Resource Consumption

A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion...

CVE-2023-49955: Undefined Security Weakness

An issue was discovered in Dalmann OCPP.Core before 1.2.0 for OCPP Open Charge Point Protocol for electric vehicles. It does not validate the length of the chargePointVendor field in a BootNotification message, potentially leading to server instability and a denial of service when processing...

CVE-2023-5953 Welcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File Upload

The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server...

PT-2023-9820 · Foxit · Foxit Pdf Reader +1

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required, as the target must visit a malicious page ...

Fuji Electric Tellus Lite V-Simulator 6 V9 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Fuji Electric Tellus Lite V-Simulator 6 V9 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2023-41792 Lack of Authorization and Stored XSS Via SNMP Trap Editor Page

Cross-Site Request Forgery CSRF vulnerability in Pandora FMS on all allows Cross-Site Scripting XSS. This vulnerability allowed Javascript code to be executed in the SNMP Trap Editor. This issue affects Pandora FMS: from 700 through 773...

CVE-2023-3104: Missing Authentication for Critical Function

Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication...

Cross Site Scripting (XSS)

openCRX is vulnerable to Cross Site Scripting XSS. The vulnerability is due to a lack of validation in Category creation field, which allows an attacker to inject HTML into the application...

Sql injection

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admininit, allowing unauthenticated users to perform SQL injections...

PC Settings Tool Privilege Escalation

The vulnerability of the PC Settings Tool software relates to the lack of authentication for a critical function. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2023-43275

Cross-Site Request Forgery CSRF vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalogadd.php, allows attackers to create crafted web pages due to a lack of verification of the token value of the submitted form...