CVE-2022-4862

Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information. This issue affects M-Files New Web: before 22.12.12140.3...

CVE-2022-3284

Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0...

CVE-2022-3284

Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0...

Design/Logic Flaw

Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0...

Information disclosure

Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information. This issue affects M-Files New Web: before 22.12.12140.3...

CVE-2022-3284 Insecure way of passing a download key

Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0...

CVE-2022-3284 Insecure way of passing a download key

Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0...

CVE-2022-3284

CVE-2022-3284 affects M-Files New Web versions prior to 22.11.12011.0, where the download key for a vault file was passed insecurely and could be logged. Multiple sources (NVD, Red Hat, PRION, CNNVD, PT-Security) corroborate this issue and specify impact to confidentiality (high) with no integrit...

CVE-2023-1185

A vulnerability, which was classified as problematic, was found in ECshop up to 4.1.8. This affects an unknown part of the component New Product Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and...

PMB 跨站脚本漏洞

PMB is a 100% free document management reference tool from the PMB Services team. A security vulnerability exists in PMB v7.4.6, which stems from the discovery of a query parameter containing a Reflected Cross-Site Scripting XSS vulnerability via the query parameter in...

PT-2023-2087 · Ecshop · Ecshop

Name of the Vulnerable Software and Affected Versions: ECshop versions up to 4.1.8 Description: A vulnerability was found in the New Product Handler component of ECshop, allowing for unrestricted file upload. This can be exploited remotely, potentially allowing an attacker to upload arbitrary...

Atlassian Confluence 4.3.x < 6.2.1 Access Restriction Bypass using watch notifications

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to version 6.2.1. It is, therefore, affected by access restriction bypass using watch notifications which may permit an attacker to receive workbox notifications containing the...

PT-2023-15884

Name of the Vulnerable Software and Affected Versions M-Files Web versions prior to 22.12.12140.3 M-Files New Web versions prior to 22.12.12140.3 Description The issue allows rendering of HTML provided by another authenticated user in the browser, which can lead to the theft of user sensitive...

PT-2023-13204

Name of the Vulnerable Software and Affected Versions M-Files New Web versions prior to 22.11.12011.0 Description The download key for a file in a vault was passed in an insecure manner, making it easily loggable. This issue may potentially affect a significant number of devices worldwide, althou...

OESA-2023-1135 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: The public API function BIOnewNDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, C...

WordPress New Adman Plugin <= 1.6.8 is vulnerable to Cross Site Scripting (XSS)

Software New Adman Type Plugin Vulnerable versions = 1.6.8 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-27439 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b28d3bea3ea7 Credits Rio Darmawan Required privilege...

WordPress New Adman Plugin <= 1.6.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software New Adman Type Plugin Vulnerable versions = 1.6.8 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27441 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 4b6f936e2971 Credits Rio Darmawan Required...

SUSE-SU-2023:0568-1 Security update for ucode-intel

This update for ucode-intel fixes the following issues: Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for INTEL-SA-00767 bsc1208275 - CVE-2022-33196: Security updates for INTEL-SA-00738 bsc1208276 - CVE-2022-21216: Security updates for...

openssl: use-after-free following BIO_new_NDEF

A use-after-free vulnerability was found in OpenSSL's BIOnewNDEF function. The public API function BIOnewNDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally by OpenSSL to support the SMIME, CMS, and PKCS7 streaming capabilities, but it may also be...

CVE-2023-1062

A vulnerability, which was classified as critical, was found in SourceCodester Doctors Appointment System 1.0. Affected is an unknown function of the file /admin/add-new.php of the component Parameter Handler. The manipulation of the argument email leads to sql injection. It is possible to launch...