phpkobo AjaxNewTicker Cross-Site Scripting Vulnerability

phpkobo AjaxNewTicker is an application from phpkobo Inc. A security vulnerability exists in phpkobo AjaxNewTicker version v.1.0.5, which stems from a cross-site scripting XSS vulnerability in the parameter ID of the file index.php...

Medium: php

Issue Overview: A flaw was found in php. The main cause of this vulnerability is improper input validation while parsing an Extensible Markup LanguageXML entity. A special character could allow an attacker to traverse directories. The highest threat from this vulnerability is confidentiality...

Medium: php

Issue Overview: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress quines gzip files, resulting in an infinite loop. CVE-2022-31628 In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to...

Oracle Linux 6 / 7 : php54 (ELSA-2015-1066)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1066 advisory. - fix use after free CVE-2015-1351 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note tha...

CVE-2023-41330 Unsafe deserialization in knplabs/knp-snappy

knplabs/knp-snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Issue On March 17th the vulnerability CVE-2023-28115 was disclosed, allowing an attacker to gain remote code execution through PHAR deserialization. Version 1.4.2 added a check if...

Exploitation of Juniper Networks SRX Series and EX Series Devices

On August 17, 2023, Juniper Networks published an out-of-band advisory on four different CVEs affecting Junos OS on SRX and EX Series devices: CVE-2023-36846 Affects the SRX Series A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an...

VulnCheck KEV: CVE-2023-36844

Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to...

Phpjabbers Fundraising Script 跨站脚本漏洞

Phpjabbers Fundraising Script is a simple open source Php donation script from Phpjabbers Serbia. It is used for charity fundraising. A security vulnerability exists in PHPJabbers Fundraising Script v1.0, which originates from a cross-site scripting vulnerability in the "action" parameter of the...

CVE-2023-36845 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution...

CVE-2023-36845 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution...

CVE-2023-36844 Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment...

CVE-2023-36844 Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment...

PT-2023-4586 · Juniper Networks · J-Web +1

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS on EX Series versions prior to 20.4R3-S9 Juniper Networks Junos OS on EX Series version 21.1R1 and later Juniper Networks Junos OS on EX Series versions prior to 21.2R3-S7 Juniper Networks Junos OS on EX Series...

Online Travel Agency System 代码问题漏洞

Online Travel Agency System is an online travel agency system. A file upload vulnerability exists in Online Travel Agency System v1.0, which stems from a lack of validation of uploaded files in the artical.php file. The vulnerability can be exploited to remotely execute arbitrary code by uploadin...

CVE-2023-4112

A vulnerability was found in PHP Jabbers Shuttle Booking Software 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this...

PT-2023-5956 · Php +11 · Php +11

Name of the Vulnerable Software and Affected Versions: PHP versions 8.0. through 8.0.29 PHP versions 8.1. through 8.1.21 PHP versions 8.2. through 8.2.7 Description: The issue is related to the way PHP's XML functions rely on libxml global state to track configuration variables. This state can be...

PT-2023-5957 · Php +10 · Php +10

Name of the Vulnerable Software and Affected Versions: PHP versions 8.0. before 8.0.30 PHP versions 8.1. before 8.1.22 PHP versions 8.2. before 8.2.8 Description: The issue is caused by insufficient length checking when loading phar files, leading to a stack buffer overflow, which can result in...

Campcodes Retro Cellphone Online Store 跨站脚本漏洞

Campcodes Retro Cellphone Online Store is a retro cellphone online store by Campcodes. A cross-site scripting vulnerability exists in Campcodes Retro Cellphone Online Store version 1.0, which stems from the parameter un in the file /admin/addusermodal.php can lead to cross-site scripting...

CVE-2023-3557

A vulnerability was found in GZ Scripts Property Listing Script 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /preview.php. The manipulation of the argument page/layout/sortby leads to cross site scripting. The attack may be initiated remotely. The...

PT-2023-25234 · Gz Scripts · Gz Multi Hotel Booking System

Name of the Vulnerable Software and Affected Versions: GZ Scripts GZ Multi Hotel Booking System version 1.8 Description: A vulnerability was found in the GZ Multi Hotel Booking System. It has been classified as problematic. The issue affects an unknown function of the file /index.php. The...