CVE-2023-46648: Insufficient Entropy

An insufficient entropy vulnerability was identified in GitHub Enterprise Server GHES that allowed an attacker to brute force a user invitation to the GHES Management Console. To exploit this vulnerability, an attacker would need knowledge that a user invitation was pending. This vulnerability...

CVE-2023-46647: Improper Privilege Management

Improper privilege management in all versions of GitHub Enterprise Server allows users with authorized access to the management console with an editor role to escalate their privileges by making requests to the endpoint used for bootstrapping the instance. This vulnerability affected GitHub...

GitHub Enterprise Server Security Vulnerability

GitHub Enterprise Server is a U.S. GitHub open source application. Provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server versions prior to 3.8.12, prior to...

CVE-2023-6911

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting XSS attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console...

CVE-2023-6911

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting XSS attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console...

Cross site scripting

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting XSS attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console...

CVE-2023-6911

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting XSS attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console...

CVE-2023-6911

CVE-2023-6911 affects WSO2 products, with the root cause described as improper output encoding in the Registry feature of the Management Console, enabling a Stored Cross Site Scripting (XSS) payload injection. The issue is documented across multiple sources (including Red Hat, Veracode, GHSA/osv ...

CVE-2023-6911

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting XSS attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console...

Some WSO2 Products Cross-Site Scripting Vulnerabilities

WSO2 API Manager is a suite of API lifecycle management solutions from US-based WSO2. A cross-site scripting vulnerability exists in some WSO2 products, which stems from improperly encoded output, and can be exploited by an attacker to perform a cross-site scripting attack by injecting a maliciou...

PT-2023-32819 · Wso2 · Wso2

Name of the Vulnerable Software and Affected Versions: WSO2 products affected versions not specified Description: The issue is related to improper output encoding, allowing a Stored Cross Site Scripting XSS attack. An attacker can inject a malicious payload into the Registry feature of the...

CVE-2023-6911: Improper Neutralization of Input During Web Page Generation

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting XSS attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console...

CVE-2023-48431

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 2. Affected software does not correctly validate the response received by an UMC server. An attacker can use this to crash the affected software by providing and configuring a malicious UMC server or by manipulating the...

PT-2023-8059 · Siemens · Totally Integrated Automation Portal +5

Name of the Vulnerable Software and Affected Versions: Opcenter Execution Foundation versions prior to V2407 Opcenter Quality versions prior to V2312 SIMATIC PCS neo versions prior to V4.1 SINEC NMS versions prior to V2.0 SP1 Totally Integrated Automation Portal TIA Portal V14 Totally Integrated...

CVE-2023-41999

An authentication bypass exists in Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier that allows them to authenticate to the management console and perform tasks that require authentication...

CVE-2023-41999

An authentication bypass exists in Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier that allows them to authenticate to the management console and perform tasks that require authentication...

Authentication flaw

An authentication bypass exists in Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier that allows them to authenticate to the management console and perform tasks that require authentication...

CVE-2023-41999

Summary: CVE-2023-41999 affects Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier, allowing authentication to the management console and action on authenticated tasks. What’s affected: Arcserve UDP (management console) before v9.2....

Arcserve Unified Data Protection Security Vulnerability

Arcserve Unified Data Protection is Arcserve's all-in-one data and ransomware protection solution. A security vulnerability exists in Arcserve Unified Data Protection prior to version 9.2 that stems from the presence of an authentication bypass, whereby an unauthenticated, remote attacker could...

PT-2023-28208 · Arcserve · Arcserve Udp

Name of the Vulnerable Software and Affected Versions: Arcserve UDP versions prior to 9.2 Description: An authentication bypass issue exists, allowing an unauthenticated, remote attacker to obtain a valid authentication identifier. This identifier enables the attacker to authenticate to the...