CVE-2023-49003

The CVE concerns simplemobiletools Simple Dialer 5.18.1, where an attacker can bypass intended access restrictions by interacting with com.simplemobiletools.dialer.activities.DialerActivity. Connected sources confirm the affected product/version and the bypass of access controls; no exploit detai...

CVE-2023-49003

An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simplemobiletools.dialer.activities.DialerActivity...

Phone Dialer-voice Call Dialer Security Vulnerability

Phone Dialer-voice Call Dialer is a voice call dialer that allows you to dial by voice when it is not convenient to dial by hand. A security vulnerability exists in Phone Dialer-voice Call Dialer version v.1.2.5 that originates from a vulnerability that allows an attacker to bypass expected acces...

CVE-2023-49001

Affected software: Indi Browser (aka kvbrowser) v12.11.23. Vulnerable component: com.example.gurry.kvbrowswer.webview. Issue cause/impact: bypass of intended access restrictions by interacting with the webview component, enabling unauthorized access as described in multiple sources; no concrete p...

PT-2023-11747 · Gila Cms · Gila Cms

Name of the Vulnerable Software and Affected Versions: Gila CMS versions 1.15.4 and earlier Description: A SQL injection issue was discovered that allows a remote attacker to execute arbitrary web scripts via the ID parameter after the login portal. Recommendations: For Gila CMS versions 1.15.4 a...

The vulnerability of the Xreader software for viewing electronic documents lies in the incorrect restriction on the path name to the restricted access catalog, allowing a perpetrator to execute arbitrary code.

The vulnerability of the Xreader software for viewing electronic documents is related to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a hacker to execute arbitrary code by having the user open a specially crafted EPUB or CBT...

CLSA-2023-1703612912 openssh: Fix of CVE-2023-51385

CVE-2023-51385: ban user/hostnames with most shell metacharacters in command line...

PT-2023-30163 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.0 Description: A cross-site request forgery CSRF issue exists in the User settings /me page. If a user views a malicious page while logged in, settings may be changed without the user's intention. The API endpoint...

PT-2023-31526 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.6 Description: The issue concerns the storage of sensitive information in cleartext form on the App Settings page, located at "/admin/app". This could allow an attacker with access to the page to obtain the Secret...

PT-2023-8310 · Buffalo · Buffalo Vr-S1000

Name of the Vulnerable Software and Affected Versions: BUFFALO VR-S1000 versions 2.37 and earlier Description: The issue is related to the use of a hard-coded cryptographic key in the firmware, which may allow an attacker to analyze the password of a specific product user. This could potentially...

PT-2023-32875 · Unknown · Code-Projects E-Commerce Website

Name of the Vulnerable Software and Affected Versions: code-projects E-Commerce Website version 1.0 Description: A critical issue was found in the code-projects E-Commerce Website, affecting an unknown function of the file index search.php. The manipulation of the search argument leads to SQL...

PT-2023-31405 · Ibm · Ibm Financial Transaction Manager For Swift Services

Name of the Vulnerable Software and Affected Versions: IBM Financial Transaction Manager for SWIFT Services version 3.2.4 Description: The Message Entry and Repair MER facility of IBM Financial Transaction Manager for SWIFT Services assumes the sending address and the message type of FIN messages...

Paid Memberships Pro < 2.12.6 - Missing Authorization via API

Description The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to unauthorized modification of membership levels created by the plugin due to an incorrectly implemented capability check in the pmprorestapigetpermissionscheck...

PT-2023-32854 · Unknown · Phpgurukul Online Notes Sharing System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Notes Sharing System version 1.0 Description: A vulnerability was found in the PHPGurukul Online Notes Sharing System, affecting unknown code of the file /user/signup.php. This issue leads to weak password requirements. The...

PT-2023-9274 · Superagi · Superagi

Name of the Vulnerable Software and Affected Versions: SuperAGI versions all Description: The issue is related to the incorrect management of code generation in the eval function of the SuperAGI framework, which can be exploited by a remote attacker to execute arbitrary code and gain full control...

PT-2023-32859 · Sourcecodester · Sourcecodester Simple Student Attendance System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Student Attendance System version 1.0 Description: A critical issue has been found in the system, affecting an unknown functionality. The manipulation of the page argument leads to path traversal, allowing access to...

PT-2023-31591 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti version 1.2.25 Description: The issue is a Reflected Cross Site Scripting XSS vulnerability that allows remote attackers to escalate privileges. This occurs when an xml template file is uploaded via the "templates import.php" API...

PT-2023-31657 · Unknown · Freshlight Lab Menu Image

Name of the Vulnerable Software and Affected Versions: Freshlight Lab Menu Image, Icons made easy versions n/a through 3.10 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS, which means...

PT-2023-29421 · Unknown · Online Examination System

Name of the Vulnerable Software and Affected Versions: Online Examination System version 1.0 Description: The issue concerns multiple Authenticated SQL Injection vulnerabilities. The 'name' parameter of the "update.php" resource does not validate the characters received, and they are sent...

The vulnerability of OMICARD’s marketing mailing system lies in the improper restriction on the name of the path to the restricted catalog. This allows attackers to bypass the authentication process and upload arbitrary files.

The vulnerability of OMICARD’s marketing email system is related to incorrect restrictions on the path name to the restricted catalog during the processing of the FileName parameter. Exploiting this vulnerability allows a malicious actor to bypass authentication procedures and upload arbitrary...