Siemens LOGO! 8 BM Devices Improper Input Validation (CVE-2022-36362)

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions. Affected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to manipulate the devices IP address, which means the device would not be...

PT-2023-28812 · Unknown +1 · Hoteldruid +1

Name of the Vulnerable Software and Affected Versions: Hoteldruid version 3.0.5 Description: The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities are located at the /hoteldruid/clienti.php endpoint via the annonascita, annoscaddoc, giornonascita, giornoscaddoc, lingua...

PT-2023-28811 · Unknown +1 · Hoteldruid +1

Name of the Vulnerable Software and Affected Versions: Hoteldruid version 3.0.5 Description: A SQL injection vulnerability was discovered in Hoteldruid via the id utente log parameter at the "/hoteldruid/personalizza.php" API endpoint. This issue allows for potential SQL injection attacks...

PT-2023-23431 · Fuxa · Fuxa

Name of the Vulnerable Software and Affected Versions: FUXA versions 1.1.12 and earlier Description: The issue allows for Local File Inclusion via the "/api/download" API endpoint. This could potentially be exploited to access sensitive files on the system. Recommendations: For versions 1.1.12 an...

Apache Druid < 0.21.0 Privilege Escalation

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not a...

Xxe

Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity Linking / XML External Entities Blowup. In order to take advantage of this vulnerability, an attacker must craft a malicious XML document, embed this docume...

PT-2023-26687 · Unknown · Client Dicom Rtst Loading Modules +1

Name of the Vulnerable Software and Affected Versions: MIM Assistant and Client DICOM RTst Loading modules affected versions not specified Description: The issue concerns an Improper Restriction of XML External Entity Reference, which allows XML Entity Linking or XML External Entity attacks...

PT-2023-28968 · WordPress · Saso Serial Codes Generator/Validator With Woocommerce Support

Name of the Vulnerable Software and Affected Versions: Serial Codes Generator and Validator with WooCommerce Support WordPress plugin versions prior to 2.4.15 Description: The issue concerns the Serial Codes Generator and Validator with WooCommerce Support WordPress plugin, where some settings ar...

PT-2023-26382 · Minitool · Minitool Movie Maker

Name of the Vulnerable Software and Affected Versions: MiniTool Movie Maker versions 6.1.0 through 7.0 Description: The issue is related to an insecure installation process in MiniTool Movie Maker, which allows attackers to achieve remote code execution through a man-in-the-middle attack...

PT-2023-6647 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana version 8.10.0 Description: The issue impacts Kibana when logging in the JSON layout or when the pattern layout is configured to log the %meta pattern, allowing sensitive information to be recorded in logs in the event of an error. The...

PT-2023-26748 · Unknown · Cheese Cafe Line

Name of the Vulnerable Software and Affected Versions: Cheese Cafe Line version 13.6.1 Description: An information leak in Cheese Cafe Line allows attackers to obtain the channel access token and send crafted messages. Recommendations: For version 13.6.1, consider restricting access to sensitive...

PT-2023-24730 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O versions 5.0 through 5.5 Description: An issue was discovered in SystemFirmwareManagementRuntimeDxe. The implementation of the GetImage method retrieves the value of a runtime variable named GetImageProgress, and later uses...

PT-2023-31502 · Tongda Oa · Tongda Oa

Name of the Vulnerable Software and Affected Versions: Tongda OA version 2017 Description: A critical issue was found in Tongda OA, affecting some unknown functionality of the file general/hr/manage/staff relatives/delete.php. The manipulation of the RELATIVES ID argument leads to SQL injection...

The vulnerability of the declarative delivery tool for GitOps on Kubernetes Argo CD, related to deficiencies in pathname restrictions for directories, allows attackers to gain unauthorized access to protected information.

The vulnerability of GitOps’ continuous delivery tool for Kubernetes Argo CD is related to shortcomings in pathname restrictions for directories. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

PT-2023-30797

Name of the Vulnerable Software and Affected Versions CF Software Oil Management Software versions prior to 20230912 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-30110 · Unknown · Saphira Connect

Name of the Vulnerable Software and Affected Versions: Saphira Connect versions prior to 9 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

PT-2023-30164

Name of the Vulnerable Software and Affected Versions Innosa Probbys versions prior to 2 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations For version...

PT-2023-31249 · Unknown · Greenradius

Name of the Vulnerable Software and Affected Versions: GreenRADIUS versions prior to 5.1.2.2 Description: A cross site scripting issue was discovered with the pagination function on the "Client-based Authentication Policy Configuration" screen of the GreenRADIUS web admin interface...

PT-2023-28285

Name of the Vulnerable Software and Affected Versions Lenosp versions 1.0.0 through 1.2.0 Description The issue concerns SQL Injection via the log query module. Recommendations For versions 1.0.0 through 1.2.0, consider restricting access to the log query module to minimize the risk of...

PT-2023-27719 · Cloudroits · Cloudroits Website Job Search

Name of the Vulnerable Software and Affected Versions: Cloudroits Website Job Search version 15.0 Description: A SQL injection issue allows a remote authenticated attacker to execute arbitrary code via the name parameter in the controllers/main.py component. Recommendations: For Cloudroits Websit...