CVE-2023-27214

Online Student Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the fromdate and todate parameters at /eduauth/student/between-date-reprtsdetails.php...

Sql injection

Online Student Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the fromdate and todate parameters at /eduauth/student/between-date-reprtsdetails.php...

CVE-2023-27214

Online Student Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the fromdate and todate parameters at /eduauth/student/between-date-reprtsdetails.php...

Easy Forms for MailChimp < 6.8.9 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its from parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Edit a form and put the following paylo...

org.xwiki.platform:xwiki-platform-panels-ui vulnerable to Eval Injection

Impact Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of UIX parameters A proof of concept exploit is to log in, add an XWiki.UIExtensionClass xobject to the user profil...

Open Redirect

keycloak-connect is vulnerable to Open Redirect. The vulnerability exists in the module.exports function of the check-sso.js as it does not properly escape the slashes in the cleanUrl attribute, allowing an attacker to redirect the user to malicious urls with query param prompt=none when checking...

EulerOS 2.0 SP5 : golang (EulerOS-SA-2023-1505)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during...

Debian: Security Advisory (DLA-247-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-4HMQ-GGRM-QFC6 directus vulnerable to HTML Injection in Password Reset email to custom Reset URL

Impact Instances relying on an allow-listed reset URL are vulnerable to an HTML injection attack through the use of query parameters in the reset URL. Patches The problem has been resolved and released under version 9.23.0. People relying on a custom password reset URL should upgrade to 9.23.0 or...

directus vulnerable to HTML Injection in Password Reset email to custom Reset URL

Impact Instances relying on an allow-listed reset URL are vulnerable to an HTML injection attack through the use of query parameters in the reset URL. Patches The problem has been resolved and released under version 9.23.0. People relying on a custom password reset URL should upgrade to 9.23.0 or...

Code injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper...

CVE-2023-27479 Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-ui

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper...

CVE-2023-27479 Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-ui

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper...

CVE-2023-27479 Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-ui

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper...

SUSE CVE-2023-25731

Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox 110...

CVE-2022-47457

In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services...

CVE-2022-47455

In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services...

CVE-2022-47453

In wcn service, there is a possible missing params check. This could lead to local denial of service in wcn service...

PT-2023-15334 · Unknown · Wlan Driver

Name of the Vulnerable Software and Affected Versions: Wlan driver affected versions not specified Description: The issue is related to a possible missing parameters check in the wlan driver, which could lead to a local denial of service in wlan services. Recommendations: At the moment, there is ...

PT-2023-15332 · Unknown · Wlan Driver

Name of the Vulnerable Software and Affected Versions: Wlan driver affected versions not specified Description: The issue is related to a possible missing parameters check in the wlan driver, which could lead to a local denial of service in wlan services. Recommendations: At the moment, there is ...