PT-2023-19499 · Waneditor · Waneditor

Name of the Vulnerable Software and Affected Versions: WangEditor version 5 Description: A cross-site scripting XSS issue was found in WangEditor via the component /dist/index.js. Recommendations: For WangEditor version 5, update to a newer version that contains a fix for this issue...

PT-2023-10724 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The provided information does not contain details about a specific vulnerability. It appears to be a rejection notice for a candidate number, indicating that it was not...

CVE-2023-25823 Gradio contains Use of Hard-coded Credentials

Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-coded Credentials. When using Gradio's share links i.e. creating a Gradio app and then setting share=True, a private SSH key is sent to any...

PT-2023-20613 · WordPress · Reviewx Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: ReviewX WordPress Plugin versions prior to 1.6.4 Description: The issue affects the 'rx export review' action in the ReviewX WordPress Plugin, where an authenticated SQL injection vulnerability exists in the filterValue and selectedColumns...

CVE-2023-24812 SQL injection of notes/search-by-tag

Misskey is an open source, decentralized social media platform. In versions prior to 13.3.3 SQL injection is possible due to insufficient parameter validation in the note search API by tag notes/search-by-tag. This has been fixed in version 13.3.3. Users are advised to upgrade. Users unable to...

CVE-2023-25813 SQL Injection via replacements in sequelize

Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fix...

CVE-2021-4325 NHN TOAST UI Chart Legend cross site scripting

A vulnerability, which was classified as problematic, has been found in NHN TOAST UI Chart 4.1.4. This issue affects some unknown processing of the component Legend Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 4.2.0 is able to...

PT-2023-10402 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The provided information does not describe a vulnerability but rather a rejected CVE candidate number. There is no general information about an issue, estimated number of...

K16882: OpenLDAP vulnerability CVE-2013-4449

Security Advisory Description Description The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service slapd crash by unbinding immediately after a search request, which triggers rwmconndestroy to free the...

PT-2023-10262 · Harrystech · Harrystech Dynosaur-Rails

Name of the Vulnerable Software and Affected Versions: harrystech Dynosaur-Rails affected versions not specified Description: A critical vulnerability has been found in harrystech Dynosaur-Rails, affecting the basic auth function of the file app/controllers/application controller.rb. The...

PT-2023-10157 · Unknown · Cention-Chatserver

Name of the Vulnerable Software and Affected Versions: cention-chatserver version 3.8.0-rc1 Description: A vulnerability was found in the function formatBody of the file lib/InternalChatProtocol.fe. The manipulation of the argument body leads to cross-site scripting. The attack can be launched...

Sql injection

A vulnerability was found in OCLC-Research OAICat 1.5.61. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.5.62 is able to address this issue. The identifier of the patc...

CVE-2013-10019 OCLC-Research OAICat sql injection

A vulnerability was found in OCLC-Research OAICat 1.5.61. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.5.62 is able to address this issue. The identifier of the patc...

PT-2023-20216 · Unknown · Notation-Go

Name of the Vulnerable Software and Affected Versions: notation-go versions prior to 1.0.0-rc.3 Description: The issue causes excessive memory consumption when verifying signatures, leading to application crashes and impacting availability. Users can review their trust policy file for the identit...

TRANSFERING KIBToken TO YOURSELF INCREASES YOUR BALANCE

Lines of code Vulnerability details Impact using temporary variables to update balances is a dangerous construction. If transferred to yourself, it will cause your balance to increase, thus growing the token balance infinitely Proof of Concept KIBToken overrides transfer to perform the transfer o...

Repository._removeContract() removes the contract wrongly.

Lines of code Vulnerability details Impact After removing the contract, the contracts array would contain the wrong contract names. Proof of Concept Repository.removeContract removes the contract name from contracts array. File: 2023-02-malt\contracts\Repository.sol 223: function...

PT-2023-20915 · Tenda · Tenda Ax3

Name of the Vulnerable Software and Affected Versions: Tenda AX3 version 16.03.12.11 Description: The issue is related to a Buffer Overflow that can be triggered via the "/goform/SetFirewallCfg" API endpoint. This allows for potential exploitation. Recommendations: For Tenda AX3 version...

PT-2023-13777 · Ibm · Ibm Sterling B2B Integrator Standard Edition

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator Standard Edition versions 6.1.0.0 through 6.1.1.1 IBM Sterling B2B Integrator Standard Edition version 6.1.2.0 Description: The issue allows an authenticated user to perform actions they should not have access to d...

PT-2023-16550 · Unknown · Diaenergie

Name of the Vulnerable Software and Affected Versions: DIAEnergie versions prior to v1.9.03.001 Description: The issue concerns improper authorization in the affected product, which could allow an unauthorized user to bypass authorization and access privileged functionality. Recommendations: For...

Kibana 7.17.9 and 8.6.2 Security Update

Kibana open redirect issue ESA-2023-03 An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. Affected Versions: Kibana Versions 7.0.0 through 7.17.8 and 8.0.0 through 8.6.1 Solutions and...