PT-2023-31380 · Woo · Woopayments

Name of the Vulnerable Software and Affected Versions: WooPayments – Fully Integrated Solution Built and Supported by Woo versions through 6.4.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for...

PT-2023-32783 · Microweber · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 2.0 Description: A vulnerability has been identified in microweber where users can exploit business logic errors to obtain items at a lower price. This occurs when the admin disables the use of the coup...

Security Bulletin: IBM UrbanCode Deploy (UCD) is affected by a HTTP request smuggling Vulnerability in Eclipse Jetty (CVE-2023-40167)

Summary Due to the use of Jetty IBM UrbanCode Deploy UCD is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP/1 request header. By sending a specially crafted request, a remote attacker could exploit this vulnerability to poison the web cache, bypass web application...

CVE-2023-6756

A vulnerability was found in Thecosy IceCMS 2.0.1. It has been classified as problematic. Affected is an unknown function of the file /login of the component Captcha Handler. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack...

Are HTTP Content-Security-Policy (CSP) Headers Sufficient to Secure Your Client Side?

Modern web frameworks have shifted business logic from the server side to the client side web browser, enhancing performance, flexibility, and user experience. However, this move introduces security and privacy concerns, as exposing sensitive logic and data can lead to vulnerabilities like code...

CVE-2023-6756

The CVE-2023-6756 issue affects Thecosy IceCMS 2.0.1, specifically the Captcha Handler on the /login endpoint. The vulnerability allows attackers to bypass or excessive-restrict authentication attempts, with remote exploitation and public Exploit disclosure. Multiple connected sources confirm the...

Backoffice User can bypass "Publish" restriction

Impact Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Explanation of the vulnerability Backoffice users without permission to publish content, but only to send for approval, can bypass the restriction by modifying the request...

GHSA-335X-5WCM-8JV2 Backoffice User can bypass "Publish" restriction

Impact Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Explanation of the vulnerability Backoffice users without permission to publish content, but only to send for approval, can bypass the restriction by modifying the request...

PT-2023-32766 · Sourcecodester · Sourcecodester Online Tours & Travels Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Tours & Travels Management System version 1.0 Description: A critical issue affects the function prepare of the file email setup.php. The manipulation of the argument name leads to SQL injection. The exploit has been...

PT-2023-31643 · Jenkins · Jenkins Htmlresource Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins HTMLResource Plugin versions 1.02 and earlier Description: A cross-site request forgery CSRF issue allows attackers to delete arbitrary files on the Jenkins controller file system. This can be exploited by attackers to potentially...

CVE-2023-48227 Umbraco CMS Backoffice User can bypass "Publish" restriction

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Versions 8.18.10, 10.7.0, and 12.3.0 contains a...

Advisory ROSA-SA-2023-2305

software: suricata 6.0.13 WASP: ROSA-CHROME packageevrstring: suricata-6.0.13-1.src.rpm CVE-ID: CVE-2023-35852 BDU-ID: 2023-06800 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Suricata Intrusion Detection and Prevention System is related to an incorrect restriction of the path name of a...

Security Bulletin: Multiple vulnerabilities in Python may affect the IBM Storage Scale System

Summary Multiple security vulnerabilities have been identified in IBM Storage Scale System where Python is vulnerable to denial of service. Fixes for these vulnerabilities are available. Vulnerability Details CVEID:CVE-2022-45061 DESCRIPTION: Python is vulnerable to a denial of service, caused by...

PT-2023-9242 · Unknown · Masterscada 4D

Name of the Vulnerable Software and Affected Versions: MasterSCADA 4D affected versions not specified Description: The issue is related to incorrect restriction of access to a directory with limited access in the MasterSCADA 4D SCADA system. Exploitation of this issue may allow a remote attacker ...

PT-2023-9302 · Espeak-Ng +6 · Espeak-Ng +6

Name of the Vulnerable Software and Affected Versions: Espeak-ng version 1.52-dev Description: The issue is related to a Stack Buffer Underflow via the CountVowelPosition function at synthdata.c. This could allow an attacker to cause a denial of service or potentially execute arbitrary code. The...

The vulnerability of the built-in document editing server Collabora Online – the CODE Server (richdocumentscode) – is related to an incorrect limitation on the path to the restricted access catalog. This allows a malicious user to execute arbitrary commands.

The vulnerability of the built-in document editing server Collabora Online – CODE Server richdocumentcode is related to an incorrect limitation on the path to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

PT-2023-7742 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.18 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form...

PT-2023-30850 · Siemens · Sinec Ins

Name of the Vulnerable Software and Affected Versions: SINEC INS versions prior to V1.0 SP2 Update 2 Description: A vulnerability has been identified in the affected software, where it does not correctly validate the response received by a UMC server. This can be exploited by an attacker to crash...

PT-2023-30849 · Siemens · Sinec Ins

Name of the Vulnerable Software and Affected Versions: SINEC INS versions prior to V1.0 SP2 Update 2 Description: A vulnerability has been identified in the REST API of affected devices, where it does not check the length of parameters in certain conditions. This allows a malicious admin to crash...

PT-2023-11471 · Beyondtrust · Beyondtrust Privilege Management For Windows

Name of the Vulnerable Software and Affected Versions: BeyondTrust Privilege Management for Windows versions through 5.6 Description: An issue was discovered in BeyondTrust Privilege Management for Windows. When adding the Add Admin token to a process and specifying that it runs at medium integri...