Important: redis

Issue Overview: Redis is an open source BSD licensed, in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code...

CVE-2023-42426

Cross-site scripting XSS vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in the 'Insert Image' component...

PT-2023-5609 · D Link · D-Link Dar-8000

Name of the Vulnerable Software and Affected Versions: D-Link DAR-8000 versions up to 20151231 Description: The issue is related to the lack of protection against SQL injection in the /autheditpwd.php script of the D-Link DAR-8000 router's firmware. This allows a remote attacker to execute...

CVE-2019-19450

A code injection vulnerability was found in python-reportlab that may allow an attacker to execute code while parsing a unichar element attribute. An application that uses python-reportlab to parse untrusted input files may be vulnerable and could allow remote code execution. Mitigation Mitigatio...

CVE-2023-23362

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build...

Input validation

A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 4.3.6.2441 bui...

Command injection

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build...

CVE-2023-23362

CVE-2023-23362 is an OS command injection affecting QNAP QTS, QuTS Hero, QuTScloud. The issue allows remote authenticated users to execute commands via vulnerable QNAP devices. Public disclosures in the provided sources confirm the vulnerability and list fixed versions: QTS 5.0.1.2376 build 20230...

CVE-2023-43469

SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the ForPass.php component...

The vulnerability of Acronis Cloud Manager, a platform for managing hybrid clouds, stems from insufficient validation of input data, allowing attackers to execute arbitrary commands.

The vulnerability of Acronis Cloud Manager, a platform for managing hybrid clouds, is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary commands...

PT-2023-28753 · Dst-Admin · Dst-Admin

Name of the Vulnerable Software and Affected Versions: dst-admin version 1.5.0 Description: The issue is related to a remote command execution RCE vulnerability. It can be exploited via the userId parameter at the "/home/playerOperate" API endpoint. Recommendations: For dst-admin version 1.5.0, a...

The vulnerability of the Ansible Semaphore configuration management interface, related to improper control of code generation, allows a attacker to execute arbitrary code.

The vulnerability of the Ansible Semaphore configuration management interface is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the configuration management system and remote execution capabilities of SaltStack Salt, due to the lack of protection for service data, allows attackers to gain access to confidential information.

The vulnerability of the Configuration Management system and the remote execution of operations in SaltStack Salt is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose the protected information...

CVE-2023-34576

SQL injection vulnerability in updatepos.php in PrestaShop opartfaq through 1.0.3 allows remote attackers to run arbitrary SQL commands via unspedified vector...

(0Day) Ashlar-Vellum Cobalt AR File Parsing Type Confusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing o...

PrestaShop SQL Injection Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution offers multiple payment methods, short message alerts and product image zoom. A security vulnerability exists in PrestaShop opartplannedpopup 1.4.11 and earlier versions, which originated fro...

CVE-2023-34575

SQL injection vulnerability in PrestaShop opartsavecart through 2.0.7 allows remote attackers to run arbitrary SQL commands via OpartSaveCartDefaultModuleFrontController::initContent and OpartSaveCartDefaultModuleFrontController::displayAjaxSendCartByEmail methods...

Cross site scripting

A reflected cross-site scripting XSS vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'selector' parameter in '/reset-password'...

CVE-2023-42331

A file upload vulnerability in EliteCMS v1.01 allows a remote attacker to execute arbitrary code via the manageuploads.php component...

GHSA-G8H7-MCP6-PF47 File Upload vulnerability in Dolibarr ERP CRM

File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions...