CVE-2023-32985

Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system...

Xxe

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized read access to the file system when a malicious configuration file is loaded on to the software by a local user...

3 reasons to use a VPN

There are many good reasons to use a Virtual Private Network VPN, even if you are just casually scrolling. Privacy is a right that is yours to value and defend, and if you want to increase your online privacy then a VPN is one of the possible solutions. A VPN works like this: When youre connected...

PT-2023-20615 · Jenkins · Credentials Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins Code Dx Plugin versions 3.1.0 and earlier Description: The issue concerns the storage and display of Code Dx server API keys. In affected versions, these keys are stored unencrypted in job config.xml files on the Jenkins controller an...

PT-2023-23504 · Unknown · Glazedlists

Name of the Vulnerable Software and Affected Versions: glazedlists version 1.11.0 Description: The issue is related to an XML Deserialization vulnerability that allows an attacker to execute arbitrary code. This is achieved via the BeanXMLByteCoder.decode parameter. Recommendations: For glazedlis...

PT-2023-7454 · Aruba · Aruba Edgeconnect Enterprise

Name of the Vulnerable Software and Affected Versions: Aruba EdgeConnect Enterprise affected versions not specified Description: The issue is related to vulnerabilities in the command line interface of the Aruba EdgeConnect Enterprise platform. These vulnerabilities allow remote authenticated use...

PT-2023-22699 · Atlassian +1 · Confluence +1

Name of the Vulnerable Software and Affected Versions: MoroSystems EasyMind - Mind Maps plugin versions prior to 2.15.0 for Confluence Description: The issue allows persistent XSS when saving a Mind Map with the hyperlink parameter. This can lead to the execution of malicious scripts within the...

PT-2023-3023 · D Link · D-Link Dir-605L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-605L firmware version 1.17B01 BETA Description: The issue exists due to the lack of measures to neutralize special elements used in the operating system command. This can allow a remote attacker to execute arbitrary code. The...

PT-2023-19142 · Unknown · Arconix Shortcodes

Name of the Vulnerable Software and Affected Versions: Arconix Shortcodes plugin versions = 2.1.7 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher authentication levels. There is no information provided about the...

PT-2023-21092 · Gira · Gira Homeserver

Name of the Vulnerable Software and Affected Versions: Gira HomeServer versions up to 4.12.0.220829 beta Description: A problematic issue was found, affecting unknown code of the file /hslist. The manipulation of the argument lst with the input debug%27" leads to cross-site scripting. The attack...

Directory traversal

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In affected versions an arbitrary file read is possible when using include file syntax. By using the syntax --8--"/etc/passwd" or --8--"/proc/self/environ" the content of these files will be rendered in the...

Any file can be included with the pymdown-snippets extension

Summary Arbitrary file read when using include file syntax. Details By using the syntax --8--"/etc/passwd" or --8--"/proc/self/environ" the content of these files will be rendered in the generated documentation. Additionally, a path relative to a specified, allowed base path can also be used to...

CVE-2022-47393

An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multiple CODESYS products to force a denial-of-service situation...

Design/Logic Flaw

An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multiple CODESYS products to force a denial-of-service situation...

CVE-2022-47393

CVE-2022-47393 affects Codesys V3 where the CmpFileTransfer component can be abused after authentication via untrusted pointer dereference, potentially causing a denial-of-service. The cited sources assign a CVSS v3.1 base score of 6.5 (vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Affected produ...

Multiple vulnerabilities in Cybozu Garoon

Overview Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. CyVDB-3122 Denial-of-service DoS in Message CWE-400 - CVE-2023-26595 CyVDB-3142 Operation restriction bypass vulnerability in Message and Bulletin CWE-285 - CVE-2023-27304 CyVDB-3165 Operation...

PT-2023-18955 · Sick · Sick Ftmg Air Flow Sensor

Name of the Vulnerable Software and Affected Versions: SICK FTMg AIR FLOW SENSOR versions with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 Description: The issue allows an unprivileged remote attacker to download files by using an unprivileged account via the "REST...

PT-2023-23483 · Sourcecodester · Sourcecodester Faculty Evaluation System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Faculty Evaluation System version 1.0 Description: The issue concerns SQL Injection vulnerability via the "/eval/index.php?page=edit faculty&id=" endpoint. This allows for potential exploitation by injecting malicious SQL code...

PT-2023-23486 · Sourcecodester · Sourcecodester Faculty Evaluation System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Faculty Evaluation System version 1.0 Description: The issue is related to SQL Injection, which can be exploited via the "/eval/admin/manage class.php?id=" endpoint. The id variable is vulnerable to injection attacks. No...

JVN#41694426: Multiple vulnerabilities in Cybozu Garoon

Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. CyVDB-3122 Denial-of-service DoS in Message CWE-400 - CVE-2023-26595 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L| Base Score: 5.0 CVSS v2| AV:N/AC:L/Au:S/C:N/I:N/A:P...