CVE-2023-45223: Exposure of Sensitive Information to an Unauthorized Actor

Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another user even if the Show Full Name option was disabled...

Mattermost Security Vulnerabilities

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from an inability to properly validate the "Show Full Name" option in some endpoints in Mattermost Boards, allowing members to obtain another...

PT-2023-29463 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from the improper validation of the "Show Full Name" option in certain endpoints within Mattermost Boards. This allows a member to obtain the full name of another user,...

clareartshow.com.au Cross Site Scripting vulnerability OBB-3788287

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-8269 · Hancom · Hancom Office Show

Name of the Vulnerable Software and Affected Versions: Hancom Office Show affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Hancom Office Show. User interaction is required, where the target must visit a maliciou...

CVE-2023-46213

In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized code in a user’s web browser...

Design/Logic Flaw

In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized code in a user’s web browser...

CVE-2023-46213: Improper Neutralization of Input During Web Page Generation

In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized code in a user’s web browser...

PT-2023-7070 · Splunk · Splunk Enterprise

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.0.7 Splunk Enterprise versions prior to 9.1.2 Description: The issue is related to ineffective escaping in the "Show syntax Highlighted" feature, which can result in the execution of unauthorized code in ...

PT-2024-14656

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer overflow vulnerability has been resolved in the Linux kernel, specifically in the PM / devfreq component, affecting the trans stat show function. The issue was addressed by...

An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur.

...

show-saengerin.de Improper Access Control vulnerability OBB-3775175

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-5964

The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exchange does not properly validate the Caption or Message parameters, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This...

WPB Show Core <= 2.2 - Unauthenticated Local File Inclusion

Description This plugin is vulnerable to a local file inclusion via the path parameter. PoC Send a GET request to wpb-show-core/download-file.php with the path parameter set to an arbitrary file path on the server, - "/etc/resolv.conf" - "/etc/hosts" - "../../../wp-config.php"...

WPB Show Core <= 2.2 - Unauthenticated Local File Inclusion

Description This plugin is vulnerable to a local file inclusion via the path parameter. Send a GET request to wpb-show-core/download-file.php with the path parameter set to an arbitrary file path on the server, - "/etc/resolv.conf" - "/etc/hosts" - "../../../wp-config.php"...

schiess-sport-show.de Improper Access Control vulnerability OBB-3771348

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-9196

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a use-after-free bug in the cifs debug data proc show function. This bug can cause a general protection fault when reading from /proc/fs/cifs/DebugData while...

CVE-2023-5414

The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the showeslogs function. This allows administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive information including...

PT-2023-32088 · WordPress · Icegram Express

Name of the Vulnerable Software and Affected Versions: Icegram Express plugin for WordPress versions up to, and including, 5.6.23 Description: The issue allows administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive information, including...

clareartshow.com.au Cross Site Scripting vulnerability OBB-3751248

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...