10639 matches found
Security Bulletin: IBM HTTP Server is vulnerable to information disclosure due to the included Apache HTTP Server (CVE-2023-31122)
Summary IBM HTTP Server is vulnerable to information disclosure when using the modmacro module due to the included Apache HTTP Server. Vulnerability Details CVEID:CVE-2023-31122 DESCRIPTION: Apache HTTP Server could allow a remote attacker to obtain sensitive information, caused by an out-of-boun...
CVE-2023-46347
In the module "Step by Step products Pack" ndksteppingpack version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform SQL injection. The method NdkSpack::getPacks has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection...
CVE-2023-46347: Improper Neutralization of Special Elements used in an SQL Command
In the module "Step by Step products Pack" ndksteppingpack version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform SQL injection. The method NdkSpack::getPacks has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection...
Security Bulletin: IBM Integration Bus is vulnerable to a remote attacker due to Apache Tomcat
Summary IBM Integration Bus is vulnerable to a remote attacker due to Apache Tomcat CVE-2023-41080. Vulnerability Details CVEID:CVE-2023-41080 DESCRIPTION: Apache Tomcat could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability in the FORM authentication...
Security Bulletin: IBM WebSphere Application Server Liberty could provide weaker than expected security (CVE-2023-46158)
Summary IBM WebSphere Application Server Liberty could provide weaker than expected security with the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0, appSecurity-4.0 or appSecurity-5.0 feature enabled. Vulnerability Details CVEID:CVE-2023-46158 DESCRIPTION: IBM WebSphere Application Server...
Security Bulletin: IBM App Connect Enterprise is vulnerable to a heap-based buffer overflow due to electron
Summary IBM App Connect Enterprise is vulnerable to a heap-based buffer overflow due to electron CVE-2023-4863. Electron is used for Discovery Connectors in IBM App Connect Enterprise. Vulnerability Details CVEID:CVE-2023-4863 DESCRIPTION: Google Chrome is vulnerable to a heap-based buffer...
CVE-2023-45376
In the module "Carousels Pack - Instagram, Products, Brands, Supplier" hicarouselspack for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a guest can perform SQL injection via HiCpProductGetter::getViewedProduct...
CVE-2023-45376
In the module "Carousels Pack - Instagram, Products, Brands, Supplier" hicarouselspack for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a guest can perform SQL injection via HiCpProductGetter::getViewedProduct...
CVE-2023-45376
In the module "Carousels Pack - Instagram, Products, Brands, Supplier" hicarouselspack for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a guest can perform SQL injection via HiCpProductGetter::getViewedProduct...
Sql injection
In the module "Carousels Pack - Instagram, Products, Brands, Supplier" hicarouselspack for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a guest can perform SQL injection via HiCpProductGetter::getViewedProduct...
CVE-2023-45376: Improper Neutralization of Special Elements used in an SQL Command
In the module "Carousels Pack - Instagram, Products, Brands, Supplier" hicarouselspack for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a guest can perform SQL injection via HiCpProductGetter::getViewedProduct...
CVE-2023-45376
In the module "Carousels Pack - Instagram, Products, Brands, Supplier" hicarouselspack for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a guest can perform SQL injection via HiCpProductGetter::getViewedProduct...
CVE-2023-45376
The CVE-2023-45376 entry concerns the PrestaShop add-on component Carousels Pack - Instagram, Products, Brands, Supplier (hicarouselspack) up to version 1.5.0 from HiPresta. A guest can exploit an SQL injection via HiCpProductGetter::getViewedProduct(), enabling unauthorized access/manipulation t...
CVE-2023-45376
In the module "Carousels Pack - Instagram, Products, Brands, Supplier" hicarouselspack for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a guest can perform SQL injection via HiCpProductGetter::getViewedProduct...
PT-2023-29533 · Prestashop +1 · Carousels Pack +1
Name of the Vulnerable Software and Affected Versions: Carousels Pack - Instagram, Products, Brands, Supplier hicarouselspack for PrestaShop versions up to 1.5.0 Description: A guest can perform SQL injection via the HiCpProductGetter::getViewedProduct function. This issue allows for potential da...
Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-389)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-389 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
Security Bulletin: IBM® Db2® could allow a local user with special privileges to cause a denial of service during database deactivation on DPF (CVE-2023-38719)
Summary IBM® Db2® could allow a local user with special privileges to cause a denial of service during database deactivation on DPF. Vulnerability Details CVEID:CVE-2023-38719 DESCRIPTION: IBM Db2 could allow a local user with special privileges to cause a denial of service during database...
Security Bulletin: IBM® Db2® is vulnerable to denial of service with a specially crafted SQL statement using External Tables. (CVE-2023-40372)
Summary IBM® Db2® is vulnerable to denial of service with a specially crafted SQL statement using External Tables. Vulnerability Details CVEID:CVE-2023-40372 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to denial of service with a specially crafted SQ...
bbp style pack < 5.6.8 - Contributor+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...