CVE-2023-43354

Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions -MicroTiny WYSIWYG editor component...

Cross site scripting

Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions -MicroTiny WYSIWYG editor component...

CMS Made Simple Cross-Site Scripting Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS by Cmsms team. The system supports role-based permission management system, wizard-based installation and update mechanism, intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in CMS Made Simple...

PT-2023-28799 · Unknown · Microtiny Wysiwyg Editor +1

Name of the Vulnerable Software and Affected Versions: CMSmadesimple version 2.2.18 Description: A Cross Site Scripting issue allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions - MicroTiny WYSIWYG editor component. This enables the...

torontohealthprofiles.ca Cross Site Scripting vulnerability OBB-3754958

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

U.S. Dept Of Defense: IDOR to delete profile images in https:███████

A vulnerability was discovered in which profile images could be deleted through a GET request by supplying a user ID. This allowed unauthorized deletion of user profile images...

CVE-2022-3761

OpenVPN Connect versions before 3.4.0.4506 macOS and OpenVPN Connect before 3.4.0.3100 Windows allows man-in-the-middle attackers to intercept configuration profile download requests which contains the users credentials...

PT-2023-6378 · Openvpn · Openvpn Connect

Name of the Vulnerable Software and Affected Versions: OpenVPN Connect versions before 3.4.0.4506 macOS OpenVPN Connect versions before 3.4.0.3100 Windows Description: The issue is related to errors in the certificate authentication procedure, allowing a remote attacker to perform a...

Design/Logic Flaw

Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when hideuserprofilesfrompublic is enabled. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 version of Discourse. Users are advised to upgrade. There are no know...

Discourse Information Disclosure Vulnerability

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. Discourse suffers from an information disclosure vulnerability that originates from allowing unauthorized attackers to access user profiles via hideuserprofilesfrompublic...

PT-2023-29226 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.1 Discourse versions prior to 3.2.0.beta2 Description: Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when hide user profiles from public i...

Qualys FIM Playbook for PCI 4.0

This File Integrity Monitoring FIM playbook is your comprehensive guide to establishing and maintaining an effective FIM program aligned with the latest PCI DSS 4.0 standards. By meticulously monitoring and ensuring the integrity of vital files and configurations, your organization can bolster it...

CVE-2023-45396

An Insecure Direct Object Reference IDOR vulnerability leads to events profiles access in Elenos ETG150 FM transmitter running on version 3.12...

CVE-2023-45396

An Insecure Direct Object Reference IDOR vulnerability leads to events profiles access in Elenos ETG150 FM transmitter running on version 3.12...

Design/Logic Flaw

An Insecure Direct Object Reference IDOR vulnerability leads to events profiles access in Elenos ETG150 FM transmitter running on version 3.12...

CVE-2023-45396

An Insecure Direct Object Reference IDOR vulnerability leads to events profiles access in Elenos ETG150 FM transmitter running on version 3.12...

PT-2023-29547 · Elenos · Elenos Etg150 Fm Transmitter

Name of the Vulnerable Software and Affected Versions: Elenos ETG150 FM transmitter version 3.12 Description: An Insecure Direct Object Reference IDOR issue allows access to events profiles. Recommendations: For Elenos ETG150 FM transmitter version 3.12, consider restricting access to sensitive...

CVE-2023-45396

An Insecure Direct Object Reference IDOR vulnerability leads to events profiles access in Elenos ETG150 FM transmitter running on version 3.12...

CVE-2023-4966

creationtimestamp| type| source ---|---|--- 2023-10-10 18:16:58+00:00| seen| https://t.me/cibsecurity/71957 2023-10-11 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1133 2023-10-11 10:17:06+00:00| seen| https://t.me/itsecnews/3438 2023-10-18 14:01:45+00:00| exploited|...

PT-2023-6540 · Google +5 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 118.0.5993.117 Microsoft Edge versions prior to 118.0.5993.117 Description: The issue is related to a use after free in the Profiles component, which can be exploited by a remote attacker using a crafted HTML...