31333 matches found
CVE-2023-44389
Zope (Zope 4 and Zope 5) is affected by a stored XSS via the title property in the ZMI. The vulnerability arises because the title value can execute script code when viewed, with the issue mapped to the Zope management interface (ZMI). All versions are affected until patches are released in Zope ...
CVE-2023-43804
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak...
CVE-2023-43804
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak...
UBUNTU-CVE-2023-43804
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak...
CVE-2023-43804
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak...
CVE-2023-43804
CVE-2023-43804 affects the Python urllib3 library, where a Cookie header may be leaked across cross-origin redirects if redirects are not disabled. The issue is resolved in urllib3 1.26.17 or 2.0.5. Affected environments are confirmed in multiple reports, including AlmaLinux and Brocade advisorie...
PT-2023-7587 · Tenda · Tenda Ac10
Name of the Vulnerable Software and Affected Versions: Tenda AC10 version US AC10V4.0si V16.03.10.13 cn Description: The issue is related to a stack overflow in the SetFirewallCfg function when handling the firewallEn parameter. This can allow a remote attacker to execute arbitrary code or cause ...
PT-2023-24026 · Nxlog · Nxlog Manager
Name of the Vulnerable Software and Affected Versions: NXLog Manager version 5.6.5633 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows an attacker to eliminate roles within the platform by sending a specifically crafted query to the server. This is due to the...
PT-2023-16553 · Unknown · Pandora Fms
Name of the Vulnerable Software and Affected Versions: Pandora FMS version 7.67 and prior versions Description: A Cross-site Scripting XSS issue in the Syslog Section of Pandora FMS allows an attacker to transfer a user's cookie value to the attacker's server. Recommendations: For Pandora FMS...
Medium: tomcat9
Issue Overview: URL Redirection to Untrusted Site 'Open Redirect' vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. The...
WordPress Contact Form Generator 2.5.5 Cross Site Scripting Vulnerability
Exploit Title: WP Plugins Contact Form Generator 2.5.5 - Reflected Cross-Site Scripting Exploit Author: Arvandy Software Link: https://wordpress.org/plugins/contact-form-generator/ Vendor Homepage: https://www.creative-solutions.net/ Version: 2.5.5 Tested on: Windows, Linux CVE: CVE-2023-37988...
GHSA-4MQG-H5JF-J9M7 TorchServe Pre-Auth Remote Code Execution
Impact Use of Open Source Library potentially exposed to RCE Issue: Use of a version of the SnakeYAML v1.31 open source library with multiple issues that potentially exposes the user to unsafe deserialization of Java objects. This could allow third parties to execute arbitrary code on the target...
CVE-2023-32822
The issue CVE-2023-32822 affects the ftm component and is caused by a missing bounds check that enables an out-of-bounds write. This can lead to local escalation of privilege with System-level execution privileges required, and no user interaction is needed to exploit (per the consolidated descri...
Android Security Bulletin—October 2023Stay organized with collectionsSave and categorize content based on your preferences.
The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2023-10-06 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...
PT-2023-8826 · Hitachi · Hitachi Ops Center Common Services
Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Common Services versions prior to 10.9.3-00 Description: The issue is related to an uncontrolled allocation of resources, which can be exploited by a remote attacker to cause a denial of service. This can lead to a disrupti...
Android Automotive OS Update Bulletin—October 2023Stay organized with collectionsSave and categorize content based on your preferences.
The Android Automotive OS AAOS Update Bulletin contains details of security vulnerabilities affecting the Android Automotive OS platform. The full AAOS update comprises the security patch level of 2023-10-05 or later from the October 2023 Android Security Bulletin in addition to all issues in thi...
PT-2023-28932 · Unknown · Oscommerce
Name of the Vulnerable Software and Affected Versions: Os Commerce affected versions not specified Description: The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to inject JavaScript via the title parameter in the "/admin/admin-menu/add-submit" endpoint. This can lead to...
CVE-2023-27371 affecting package libmicrohttpd for versions less than 0.9.76-1
CVE-2023-27371 affecting package libmicrohttpd for versions less than 0.9.76-1. An upgraded version of the package is available that resolves this issue...
GHSA-6JQW-JWF5-RP8H Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server
Impact In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was...