PT-2023-30979 · Unknown · Car Rental Script

Name of the Vulnerable Software and Affected Versions: Car Rental Script version 3.0 Description: The issue concerns Multiple Stored Cross-Site Scripting XSS problems. These issues can be triggered via several parameters, including name, plugin sms api key, plugin sms country code, calendar id,...

CVE-2023-49096 Argument Injection in FFmpeg codec parameters in Jellyfin

Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument injection in the VideosController, specifically the /Videos//stream and /Videos//stream. endpoints which are present in the current Jellyfin version. Additional endpoints in the...

Mattermost Injection vulnerability

Mattermost webapp fails to validate route parameters in//channels/ allowing an attacker to perform a client-side path traversal...

GHSA-7664-HCP7-F497 Mattermost Injection vulnerability

Mattermost webapp fails to validate route parameters in//channels/ allowing an attacker to perform a client-side path traversal...

CVE-2023-6458

Mattermost webapp fails to validate route parameters in//channels/ allowing an attacker to perform a client-side path traversal...

Path traversal

Mattermost webapp fails to validate route parameters in//channels/ allowing an attacker to perform a client-side path traversal...

CVE-2023-6458 Client side path traversal due to lack of route parameters validation

Mattermost webapp fails to validate route parameters in//channels/ allowing an attacker to perform a client-side path traversal...

CVE-2023-6458 Client side path traversal due to lack of route parameters validation

Mattermost webapp fails to validate route parameters in//channels/ allowing an attacker to perform a client-side path traversal...

PT-2023-32671 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue concerns a failure to validate route parameters in the Mattermost webapp, specifically in the //channels/ path, allowing an attacker to perform a client-side path traversal...

Porch-Pirate - The Most Comprehensive Postman Recon / OSINT Client And Framework That Facilitates The Automated Discovery And Exploitation Of API Endpoints And Secrets Committed To Workspaces, Collections, Requests, Users And Teams

Porch Pirate started as a tool to quickly uncover Postman secrets, and has slowly begun to evolve into a multi-purpose reconaissance / OSINT framework for Postman. While existing tools are great proof of concepts, they only attempt to identify very specific keywords as "secrets", and in very...

CVE-2023-33088

Memory corruption when processing cmd parameters while parsing vdev...

CVE-2023-33081

Transient DOS while converting TWT Target Wake Time frame parameters in the OTA broadcast...

Memory corruption

Memory corruption when processing cmd parameters while parsing vdev...

CVE-2023-33088 NULL pointer dereference in WLAN Firmware

Memory corruption when processing cmd parameters while parsing vdev...

CVE-2023-33088

CVE-2023-33088 relates to memory corruption when processing cmd parameters during vdev parsing in Qualcomm chipsets. The connected CVE record also references a NULL pointer dereference in WLAN Firmware as a related detail. Public data here does not provide explicit affected models, versions, or a...

PT-2023-24175 · Qualcomm · Snapdragon +133

Name of the Vulnerable Software and Affected Versions: No specific software or affected versions are mentioned in the provided descriptions. Description: The issue is related to a Transient Denial of Service DOS that occurs while converting TWT Target Wake Time frame parameters in the OTA...

Medium: openssl11

Issue Overview: Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHgeneratekey to generate an X9.42 DH key may experience long delays. Likewise, applications that...

PHPJabbers Time Slots Booking Calendar 4.0 Cross Site Scripting

Exploit Title: PHPJabbers Time Slots Booking Calendar v4.0 - Multiple Stored XSS Date: 13/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/time-slots-booking-calendar/ Version: v4.0 Tested on...

WordPress plugin AMP+ Plus security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2023-24179 · Qualcomm · 315 5G Iot Modem Firmware +273

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption when processing command parameters while parsing vdev. No information is provided about the estimated number of...