CVE-2023-1539

Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6...

PT-2023-2196 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 Description: The issue is related to a deserialization vulnerability in the Device-gateway service, which could allow deserialization of requests prior to authentication,...

PT-2023-20244 · Ibm · Ibm Security Guardium Key Lifecycle Manager

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium Key Lifecycle Manager versions 3.0 through 4.1.1 Description: The issue allows a local user to read user credentials stored in plain clear text. Recommendations: For versions 3.0 through 4.1.1, consider restricting acces...

CVE-2023-1539

CVE-2023-1539 affects the GitHub repository answerdev/answer : versions prior to 1.0.6 have an improper restriction of excessive authentication attempts and a guessable CAPTCHA. Root cause: insufficient controls on repeated authentication attempts (exact technical details not expanded beyond what...

PT-2023-2345 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 Description: The issue is related to insufficient authorization mechanisms in the Device-Gateway service of the Delta Electronics InfraSuite Device Master software. This can b...

PT-2023-16785 · Pacsrapor · Pacsrapor

Name of the Vulnerable Software and Affected Versions: Pacsrapor versions prior to 1.22 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection and Command Line Execution through S...

PT-2023-16174 · Izmir Katip Celebi University · Ubys

Name of the Vulnerable Software and Affected Versions: Izmir Katip Celebi University UBYS versions prior to 23.03.16 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2023-9946 · Unknown · 404Like Plugin

Name of the Vulnerable Software and Affected Versions: 404like Plugin versions up to 1.0.2 Description: A critical issue has been found in the 404like Plugin, affecting the checkPage function of the file 404Like.php. The manipulation of the searchWord argument leads to SQL injection, allowing...

Fuse function only allows creation of emoji typed characters, and does not allow creation of other font classes like text.

Lines of code Vulnerability details Impact The fuse function only allows creation of emoji typed characters due to this line in the fuse function: bytes memory charAsBytes = Utils.characterToUnicodeBytes0, tileData.characterIndex, characterModifier;, which only accepts a fontClass of 0 as the fir...

PT-2023-16613 · WordPress · Shortcodes Ultimate

Name of the Vulnerable Software and Affected Versions: WordPress Shortcodes Plugin — Shortcodes Ultimate versions prior to 5.12.8 Description: The issue allows any authenticated users, such as subscribers, to retrieve arbitrary user meta, excluding the user pass, via the user shortcode. This...

The vulnerability of the NetAct network management system lies in the improper restriction of XML links to external objects. This allows attackers to gain unauthorized access to protected information or perform SSRF attacks.

The vulnerability of the NetAct network management system is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information or perform an SSRF attack...

PT-2023-20841 · Unknown · Alphaware - Simple E-Commerce System

Name of the Vulnerable Software and Affected Versions: Alphaware - Simple E-Commerce System version 1.0 Description: The issue is related to a SQL injection that can directly issue instructions to the background database system. This is possible via the "/alphaware/details.php?id" API endpoint,...

PT-2023-19506 · Squidex · Squidex

Name of the Vulnerable Software and Affected Versions: Squidex versions prior to 7.4.0 Description: The issue is related to a cross-site scripting XSS vulnerability in the squid.svg file. This type of vulnerability allows an attacker to inject malicious scripts into a website, potentially leading...

strong Password Policy Bypass through removing a specific Parameter and setting the Passwort to 1

Hello, i was able to detect another password security issue. While changing the password the attacker can use the proxy and submit for example password as 1. Altough there is a passwort policy restriction but i managed to bypass that. Let me show you : The Password is now 2 lets change it to HACK...

PT-2023-27907 · Knplabs · Knplabs/Knp-Snappy

Name of the Vulnerable Software and Affected Versions: knplabs/knp-snappy versions prior to 1.4.3 Description: The issue concerns a PHAR deserialization vulnerability in the knplabs/knp-snappy PHP library. This vulnerability allows an attacker to gain remote code execution by exploiting the lack ...

PT-2023-16784 · Persolus · Persolus

Name of the Vulnerable Software and Affected Versions: Persolus versions prior to 2.03.93 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

The vulnerability of the SAPRSBRO component in SAP NetWeaver AS ABAP and SAP NetWeaver ABAP software integration platforms allows attackers to re-record arbitrary files.

The vulnerability of the SAPRSBRO component in SAP NetWeaver AS ABAP and SAP NetWeaver ABAP software integration platforms is related to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to re-record arbitrary...

PT-2023-2176

Name of the Vulnerable Software and Affected Versions Snappy versions prior to 1.4.2 Description The issue is related to PHAR deserialization due to a lack of checking on the protocol before passing it into the file exists function. If an attacker can upload files of any type to the server, they...

PT-2023-21567 · Docker · Play With Docker

Name of the Vulnerable Software and Affected Versions: Play With Docker versions 0.0.2 and prior Description: Play With Docker is a browser-based Docker playground. The issue arises from incorrect CORS configuration, allowing an attacker to bypass the CORS policy by setting the origin header in a...

PT-2023-11626 · Unknown · Depositgame

Name of the Vulnerable Software and Affected Versions: DepositGame version 1.0 Description: An issue in DepositGame allows an attacker to gain sensitive information via the GetBonusWithdraw and withdraw functions. Recommendations: For DepositGame version 1.0, consider disabling the GetBonusWithdr...