CVE-2023-5907

The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowe...

PT-2023-31244 · Xunruicms · Xunruicms

Name of the Vulnerable Software and Affected Versions: XunRuiCMS version 4.5.5 Description: A reflective cross-site scripting XSS issue was found in XunRuiCMS via the component /admin.php. This allows for potential XSS attacks. Recommendations: For XunRuiCMS version 4.5.5, as a temporary...

PT-2023-33064 · Unknown · Gsemac.Common

Name of the Vulnerable Software and Affected Versions: Gsemac.Common affected versions not specified Description: The project contains an out-of-date version of the Public Suffix List. Using old versions of the Public Suffix List can lead to incorrect construction of privacy boundaries between...

PT-2023-28362 · Sap · Sap Business Objects Web Intelligence

Name of the Vulnerable Software and Affected Versions: SAP Business Objects Web Intelligence version 420 Description: The issue allows an authenticated attacker to inject JavaScript code into Web Intelligence documents, which is then executed in the victim's browser each time the vulnerable page ...

PT-2023-31545 · Unknown · Izybat Orange Casiers

Name of the Vulnerable Software and Affected Versions: IzyBat Orange casiers before 20230803 1 Description: The issue allows SQL injection in the getEnsemble.php ensemble. Recommendations: For IzyBat Orange casiers before 20230803 1, update to a version 20230803 1 or later to resolve the issue. A...

Default credentials

dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying DockerSpawner.allowedimages configuration allow users to launch any pullable docker image, instead of restricting to...

CVE-2023-48311 Any image allowed by default

dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying DockerSpawner.allowedimages configuration allow users to launch any pullable docker image, instead of restricting to...

DockerSpawner allows any image by default

Impact Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying DockerSpawner.allowedimages configuration allow users to launch any pullable image, instead of restricting to only the single configured image, as intended. Patches Upgrade to DockerSpawner 13...

Drop Files WEM agent fails to install with the error "software installation prevented by policy"

WEM agent fails to install with the error "software installation prevented by policy"...

PT-2023-22017 · Ncp · Ncp Secure Enterprise Client

Name of the Vulnerable Software and Affected Versions: NCP Secure Enterprise Client versions prior to 12.22 Description: The issue allows attackers to delete arbitrary files on the operating system by creating a symbolic link. This is possible due to a flaw in the Support Assistant component of t...

PT-2023-22021 · Ncp · Ncp Secure Enterprise Client

Name of the Vulnerable Software and Affected Versions: NCP Secure Enterprise Client versions prior to 12.22 Description: The issue allows attackers to read registry information of the operating system by creating a symbolic link. This is possible due to a flaw in the Support Assistant component o...

PT-2023-31228 · Doracms · Doracms

Name of the Vulnerable Software and Affected Versions: DoraCMS version 2.1.8 Description: The issue allows attackers to gain access to the application via a bruteforce attack due to the re-use of the same code for verification of valid usernames and passwords. Recommendations: For DoraCMS version...

CVE-2023-35039

Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Authentication Abuse.This issue affects Password Reset with Code for WordPress REST API: from n/a through 0.0.15...

PT-2023-9320 · Oracle · Jd Edwards Enterpriseone Tools

Name of the Vulnerable Software and Affected Versions: JD Edwards EnterpriseOne Tools versions prior to 9.2.8.2 Description: The issue is related to insufficient input validation in the Web Runtime SEC component. It allows an unauthenticated attacker with network access via HTTP to compromise JD...

PT-2023-30980 · Unknown · Car Rental Script

Name of the Vulnerable Software and Affected Versions: Car Rental Script version 3.0 Description: The issue concerns Multiple HTML Injection problems. These issues can be exploited via the SMS API Key or Default Country Code. Recommendations: For Car Rental Script version 3.0, update the software...

PT-2023-9650 · Oracle · Oracle Database Server

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 19.3 through 19.23 Oracle Database Server versions 21.3 through 21.14 Oracle Database Server version 23.4 Description: The issue is related to the Java VM component of Oracle Database Server, where an incorrect...

PT-2023-31221 · Tenda · Tenda Ax9

Name of the Vulnerable Software and Affected Versions: Tenda AX9 version V22.03.01.46 Description: A command injection issue has been discovered in the mac parameter at the "/goform/SetOnlineDevName" API endpoint. This allows for potential command injection attacks. Recommendations: For Tenda AX9...

PT-2023-31322 · Unknown · Speedycache

Name of the Vulnerable Software and Affected Versions: SpeedyCache – Cache, Optimization, Performance versions n/a through 1.1.2 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability. This type of vulnerability allows an attacker to trick the server into making...

The vulnerability of the account_print.cgi component in the microprogramming software for Zyxel USG FLEX and VPN devices allows a hacker to execute arbitrary commands.

The vulnerability of the accountprint.cgi component in the Zyxel USG FLEX and VPN network devices is related to an incorrect limitation on the path name to the tmp directory. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the Delta Electronics InfraSuite Device Master software for real-time device monitoring lies in improper restrictions on path names in the catalog. This allows attackers to disclose user information, obtain login credentials in plain text, or perform NTLM relay attacks.

The vulnerability of the Delta Electronics InfraSuite Device Master software for real-time device monitoring is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability can allow a malicious actor to disclose user information, obtain login credentials in...