VBASE VISAM Automation Base FB File Parsing XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of VBASE VISAM Automation Base. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists withi...

PT-2023-26069 · Unknown · Judging Management System

Name of the Vulnerable Software and Affected Versions: Judging Management System version 1.0 Description: A SQL injection issue was found in the Judging Management System. The vulnerability can be exploited via the id parameter at the "/php-jms/deductScores.php" API endpoint. Recommendations: For...

PT-2023-26075 · Unknown · Maid Hiring Management System

Name of the Vulnerable Software and Affected Versions: Maid Hiring Management System version 1.0 Description: The issue is related to a SQL injection vulnerability found in the Admin page of the system. Recommendations: For Maid Hiring Management System version 1.0, consider restricting access to...

PT-2023-25612

Name of the Vulnerable Software and Affected Versions Digital Ant E-Commerce Software versions prior to 11 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker ca...

PT-2023-27232 · Totolink · Totolink T10 V2

Name of the Vulnerable Software and Affected Versions: TOTOLINK T10 v2 version 5.9c.5061 B20200511 Description: The issue is a stack-based buffer overflow in the setWiFiWpsConfig function, located in /lib/cste modules/wps.so. Attackers can exploit this by sending crafted data in an MQTT packet,...

PT-2023-4391 · Intel · Intel(R) Ai Hackathon

Name of the Vulnerable Software and Affected Versions: IntelR AI Hackathon software versions prior to 2.0.0 Description: The issue is related to an uncontrolled search path in the IntelR AI Hackathon software, which may allow an unauthenticated user to potentially enable escalation of privilege v...

PT-2023-14769 · Nootheme · Noo Timetable

Name of the Vulnerable Software and Affected Versions: NooTheme Noo Timetable plugin versions = 2.1.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher authentication levels. The estimated...

Arris VAP2500 Remote Code Execution Vulnerability (CNVD-2023-62027)

The Arris VAP2500 is a device from the Arris Group that is a video gateway and WIFI signal booster for extending home network coverage and providing wireless connectivity. The Arris VAP2500 suffers from a remote code execution vulnerability that stems from the listmacaddress.php file not strictly...

PT-2023-27233 · Totolink · Totolink T10 V2

Name of the Vulnerable Software and Affected Versions: TOTOLINK T10 v2 version 5.9c.5061 B20200511 Description: The issue is a stack-based buffer overflow in the setStaticDhcpConfig function located in /lib/cste modules/lan.so. Attackers can exploit this by sending crafted data in an MQTT packet,...

VBASE VISAM Automation Base VBASE-Editor WebRemote File Parsing XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of VBASE VISAM Automation Base. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists withi...

PT-2023-26601 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 5.0.0 Description: A SQL injection issue allows a remote attacker to obtain sensitive information via the volopp1 and volopp2 parameters within the "/QueryView.php" API endpoint. Recommendations: For ChurchCRM version 5.0.0,...

PT-2023-4252 · Sap · Sap Powerdesigner +2

Name of the Vulnerable Software and Affected Versions: SAP SQLA for PowerDesigner 17 bundled with SAP PowerDesigner 16.7 SP06 PL03 Description: The issue is related to the integration of a malicious library due to incorrect code generation management in the SAP SQL Anywhere tool for SAP...

PT-2023-26996 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 8.1.1 Description: The issue allows files to be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path in the back office. There are no...

PT-2023-8021 · Abb · Abb Freelance Controllers Ac 700F +1

Name of the Vulnerable Software and Affected Versions: ABB Freelance controllers AC 700F versions 9.0;0 through V9.2 SP2, through Freelance 2013, through Freelance 2013SP1, through Freelance 2016, through Freelance 2016SP1, through Freelance 2019, through Freelance 2019 SP1, through Freelance 201...

PT-2023-4513 · D Link · D-Link Dap-2660

Name of the Vulnerable Software and Affected Versions: D-Link DAP-2660 version 1.13 Description: The issue is related to buffer overflow errors in the /adv resource component of the D-Link DAP-2660 wireless access point's firmware. Exploitation of this issue can allow a remote attacker to gain...

PT-2023-4467 · Tp Link · Tp-Link Tl-Wr941Nd

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WR941ND version V6 Description: The issue is related to a buffer overflow via the pSize parameter at the "/userRpm/PingIframeRpm" API endpoint. This can potentially allow a remote attacker to execute arbitrary code or cause a denia...

PT-2023-5237 · D Link · D-Link Dir-859

Name of the Vulnerable Software and Affected Versions: D-LINK DIR-859 versions A1 1.05 through A1 1.06B01 Beta01 Description: The issue is related to a command injection vulnerability via the lxmldbc system function at the "/htdocs/cgibin" endpoint. This vulnerability is associated with the failu...

PT-2023-26691 · NetGear · Netgear R7100Lg

Name of the Vulnerable Software and Affected Versions: Netgear R7100LG version 1.0.0.78 Description: A command injection issue was discovered via the password parameter at the "usb remote invite.cgi" endpoint. This allows for potential exploitation. Recommendations: For Netgear R7100LG version...

Access Restriction Bypass

chromium is vulnerable to Access Restriction Bypass. The vulnerability exists due to inappropriate implementation in Blink in Google Chrome which allows a remote attacker to perform arbitrary read/write via a crafted HTML page...

Access Restriction Bypass

chromium is vulnerable to Access Restriction Bypass. The vulnerability exists due to inappropriate implementation in XML in Google Chromewhich allows a remote attacker to potentially perform an ASLR bypass via a crafted HTML page...