QNAP Systems QTS and QuTS hero Cross-Site Scripting Vulnerability

QNAP Systems QTS and QNAP Systems QuTS hero are both products of China Weilian Technology QNAP Systems, Inc.QNAP Systems QTS is an operating system for use with entry to mid-level QNAP NAS.QNAP Systems QuTS hero is an operating system. A security vulnerability exists in QNAP Systems QTS and QuTS...

CVE-2023-6188 GetSimpleCMS theme-edit.php code injection

A vulnerability was found in GetSimpleCMS 3.3.16/3.4.0a. It has been rated as critical. This issue affects some unknown processing of the file /admin/theme-edit.php. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and ma...

Advisory ROSA-SA-2023-2280

Software: cockpit 264.2 OS: ROSA Virtualization 2.1 packageevrstring: cockpit-264.2-1.0.1.rv3c.src.rpm CVE-ID: CVE-2021-3660 BDU-ID: 2021-04029 CVE-Crit: MEDIUM CVE-DESC.: A manager vulnerability for Cockpit servers is related to errors in the display of the user interface or frames. Exploitation...

PT-2023-32021 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.111 Description: A critical vulnerability was found in DedeCMS, affecting the AddMyAddon function of the album add.php file. The manipulation of the albumUploadFiles argument leads to os command injection. The attack can b...

PT-2023-31939 · Foru Cms · Foru Cms

Name of the Vulnerable Software and Affected Versions: ForU CMS affected versions not specified Description: A critical vulnerability has been found in ForU CMS, affecting an unknown part of the file /install/index.php. The manipulation of the db name argument leads to code injection. It is...

CVE-2023-43614

CVE-2023-43614 affects Welcart e-Commerce plugin for WordPress, versions 2.7–2.8.21. The issue is a cross-site scripting vulnerability on the Order Data Edit page, enabling a remote unauthenticated attacker to inject arbitrary script. Red Hat and other sources corroborate the same description acr...

CVE-2023-41156

Usermin 2.001 has a Stored Cross-Site Scripting (XSS) vulnerability in the filter and forward mail tab, allowing remote attackers to inject arbitrary script/HTML via the "save to new folder named" field when creating a new filter. Root cause: unsanitized input on that field. Description is corrob...

CVE-2023-41158

CVE-2023-41158 describes a Stored XSS in Webmin/Usermin 2.000, specifically in the MIME type programs tab. The vulnerability arises when creating a new MIME type program, where an attacker can inject arbitrary script/html via the description field. Impact is web UI XSS; exploitation status is not...

CVE-2023-41154

The CVE-2023-41154 issue affects Usermin 2.000, describing a Stored Cross‑Site Scripting (XSS) vulnerability in the scheduled cron jobs tab, exploitable via the value field when creating a new environment variable. The connected PT and vulnerability sources confirm this specific vector and provid...

PT-2023-5302 · Unknown · Modulys Gp

Name of the Vulnerable Software and Affected Versions: MODULYS GP MOD3GP-SY-120K affected versions not specified Description: The issue exists due to a lack of protection for the web page structure, allowing a remote attacker to perform cross-site scripting XSS attacks. This could enable an...

PT-2023-4832 · Imind · Imind

Name of the Vulnerable Software and Affected Versions: iMind affected versions not specified Description: The issue is related to the possibility of code or data injection, which could allow a remote attacker to execute arbitrary code with administrative privileges. Recommendations: At the moment...

CVE-2023-40535

CVE-2023-40535 is a stored cross-site scripting vulnerability in the VI Web Client’s View setting page, exploitable by a remote authenticated attacker to inject scripts. Affected product: VI Web Client prior to version 7.9.6. Root cause/impact: arbitrary script execution in a logged-in user’s bro...

The Threat Lurking in Data Centers – Hack Power Management Systems, Take All the Power

The Threat Lurking in Data Centers – Hack Power Management Systems, Take All the Power By Trellix · August 12, 2023 This story was also written by Jesse Chick, Philippe Laulheret and Sam Quinn. Summary In a modern working environment where many employees are working from home or in hybrid office...

The Threat Lurking in Data Centers – Hack Power Management Systems, Take All the Power

The Threat Lurking in Data Centers – Hack Power Management Systems, Take All the Power By Trellix · August 12, 2023 This story was also written by Jesse Chick, Philippe Laulheret and Sam Quinn. Summary In a modern working environment where many employees are working from home or in hybrid office...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to Go [CVE-2023-24539 and CVE-2023-24540]

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to remote code injection due to Go CVE-2023-24539 and CVE-2023-24540, with details below. IBM has addressed the vulnerabilities. Vulnerability Details CVEID:CVE-2023-24539 DESCRIPTION: Go is vulnerabl...

Chinese UNC4841 Group Exploits Zero-Day Flaw in Barracuda Email Security Gateway

A suspected China-nexus threat actor dubbed UNC4841 has been linked to the exploitation of a recently patched zero-day flaw in Barracuda Email Security Gateway ESG appliances since October 2022. "UNC4841 is an espionage actor behind this wide-ranging campaign in support of the People's Republic o...

CVE-2023-3193

Cross-site scripting (XSS) vulnerability CVE-2023-3193 affects Liferay Portal 7.4.3.70–7.4.3.73 and Liferay DXP 7.4 update 70–73, in the Layout module’s SEO configuration. The issue allows remote attackers to inject arbitrary script/HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPor...

Barracuda Urges Immediate Replacement of Hacked ESG Appliances

Enterprise security company Barracuda is now urging customers who were impacted by a recently disclosed zero-day flaw in its Email Security Gateway ESG appliances to immediately replace them. "Impacted ESG appliances must be immediately replaced regardless of patch version level," the company sai...

Barracuda Urges Immediate Replacement of Hacked ESG Appliances

Enterprise security company Barracuda is now urging customers who were impacted by a recently disclosed zero-day flaw in its Email Security Gateway ESG appliances to immediately replace them. "Impacted ESG appliances must be immediately replaced regardless of patch version level," the company sai...

CVE-2023-33731

Reflected Cross Site Scripting XSS in the view dashboard detail feature in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the URL directly...