CVE-2015-10127

CVE-2015-10127 relates to the PlusCaptcha Plugin for WordPress (versions up to 2.0.6). The vulnerability is described as a cross-site scripting issue arising from manipulation of some unknown functionality, with the attack potentially launched remotely. A fix is available in version 2.0.14, and t...

SUSE CVE-2023-49792

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a reverse proxy is configured as truste...

OPENSUSE-SU-2023:0413-1 Security update for cppcheck

This update for cppcheck fixes the following issues: - CVE-2023-39070: Fixed heap use-after-free in removeContradiction boo1215233 - update to 2.12.1: Support importing projects with project-name - update to 2.12.0: uselessOverride finds overriding functions that either duplicate code from or...

CVE-2023-51386

CVE-2023-51386 affects Sandbox Accounts for Events. An authenticated user could read data from the events table by sending requests to the events API, exposing information such as planned events, timeframes, budgets, and owner email addresses. The issue has been patched in version 1.10.0. Affecte...

CVE-2023-51651

AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the buildEndpoint method in the RestSerializer component of the AWS SDK f...

Path traversal

AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the buildEndpoint method in the RestSerializer component of the AWS SDK f...

PYSEC-2023-249

Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of gradio prior to 4.11.0 contained a vulnerability in the /file route which made them susceptible to file traversal...

CVE-2023-50727

CVE-2023-50727 concerns a reflected XSS vulnerability in the Resque (Ruby) web interface. The issue arises when the /queues endpoint is appended with a crafted string (for example, current_queue path manipulation like ">). Affected software is Resque prior to version 2.6.0; the vulnerability i...

CVE-2023-49791

CVE-2023-49791 affects Nextcloud Server and Nextcloud Enterprise Server where an attacker with an active session of another user could call the API to delete/modify workflows without password confirmation, bypassing the UI check. The description lists affected ranges: Nextcloud Server pre-26.0.9 ...

CVE-2023-48704 Unauthenticated heap buffer overflow in Gorrila codec decompression

ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on...

CVE-2023-49086

Cacti (web frontend to RRDTool) versions prior to 1.2.27 are vulnerable to a DOM XSS in graphs_new.php, bypassing the fix for CVE-2023-39360. Exploitation requires an authorized user and results in execution of arbitrary JavaScript in the victim’s browser. The issue is resolved in version 1.2.27....

CVE-2023-50732

CVE-2023-50732 affects XWiki Platform: an attacker can cause Velocity code execution without script right through the document tree. Affected versions: XWiki Platform prior to 14.10.7 and prior to 15.2RC1. Root cause: Velocity script execution without required rights via document tree, enabling c...

Design/Logic Flaw

Resque pronounced like "rescue" is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the currentqueue parameter in the path of the queues endpoin...

Authentication flaw

Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token JWT signed wit...

AIX 7.2 TL 5 : bind (IJ44424)

https://vulners.com/cve/CVE-2023-3341 ISC BIND is vulnerable to a denial of service, caused by a stack exhaustion flaw in control channel code. By sending a specially crafted message over the control channel, a remote attacker could exploit this vulnerability to cause named to terminate...

AIX : Multiple Vulnerabilities (IJ48539)

The version of AIX installed on the remote host is prior to APAR IJ48539. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ48539 advisory. - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the piodmgrsu command to...

Cisco Identity Services Engine RCE (cisco-sa-struts-C2kCMkmT)

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Please see the included Cisco BIDs and Cisco Security Advisory for more information. Note that Nessu...

PT-2023-29259 · Unknown · Leave Management System Project

Name of the Vulnerable Software and Affected Versions: Leave Management System Project version 1.0 Description: The issue concerns multiple Authenticated SQL Injection vulnerabilities. Specifically, the setearnleave parameter of the "admin/setleaves.php" resource does not validate the characters...

AIX : Multiple Vulnerabilities (IJ48481)

The version of AIX installed on the remote host is prior to APAR IJ48481. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ48481 advisory. - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the piodmgrsu command to...

AIX (IJ48540)

The version of AIX installed on the remote host is prior to APAR IJ48540. It is, therefore, affected by a vulnerability as referenced in the IJ48540 advisory. - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in AIX windows to cause a denial of...