Spina Cross-site Scripting vulnerability

Cross-site Scripting XSS - Stored in GitHub repository spinacms/spina prior to 2.15.1...

PT-2023-25062 · H3C · H3C Magic

Name of the Vulnerable Software and Affected Versions: H3C Magic version B1STV100R012 Description: A stack overflow in the UpdateWanParams function allows attackers to cause a Denial of Service DoS via a crafted POST request to an unspecified API endpoint. Recommendations: For version B1STV100R01...

CVE-2022-44276

In Responsive Filemanager 9.12.0, an attacker can bypass upload restrictions resulting in RCE...

PT-2023-25027 · Unknown · Angular-Ui-Notification

Name of the Vulnerable Software and Affected Versions: angular-ui-notification versions 0.1.0 through 0.3.6 Description: The issue is related to a cross-site scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, potentially leading ...

CVE-2021-30203

A reflected cross-site scripting XSS vulnerability in the zero parameter of dzzoffice 2.02.1SCUTF8 allows attackers to execute arbitrary web scripts or HTML...

PT-2023-25412 · Unknown · Insider Threat Management Server

Name of the Vulnerable Software and Affected Versions: Insider Threat Management Server versions prior to 7.14.3 Description: A missing authorization check in multiple URL validation endpoints enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. Recommendations...

OSV-2023-512 Memcpy-param-overlap in repeat

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60091 Crash type: Memcpy-param-overlap Crash state: repeat pere cliregcompreal...

PT-2023-27522 · Owasp · Owasp Coraza Waf

Name of the Vulnerable Software and Affected Versions: OWASP Coraza WAF versions prior to 3.0.1 Description: The issue is caused by the misuse of log.Fatalf in the OWASP Coraza WAF library, which leads to the application crashing after receiving crafted requests from attackers. The application wi...

PT-2023-22039 · Trend Micro · Trend Micro Security

Name of the Vulnerable Software and Affected Versions: Trend Micro Security versions 2021 through 2023 Description: The issue allows an attacker to use a specific executable file as an execution and/or persistence mechanism, potentially executing a malicious program each time the executable file ...

CVE-2023-36666

INEX IXP-Manager before 6.3.1 allows XSS. list-preamble.foil.php, page-header-preamble.foil.php, edit-form.foil.php, page-header-preamble.foil.php, overview.foil.php, cust.foil.php, and view.foil.php may be affected...

CVE-2023-31469 Apache StreamPipes: Privilege escalation through non-admin user

A REST interface in Apache StreamPipes versions 0.69.0 to 0.91.0 was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles. The issue is resolved by upgrading to StreamPipes 0.92.0...

Denial Of Services (DoS)

mjson is vulnerable to Denial Of Services DoS. The vulnerability exists due to a lack of nested depth checks in Json.java, which allows an attacker to cause an application crash by passing a maliciously crafted JSON string...

BELL-CVE-2023-36191

Bulletin has no description...

CVE-2023-36191

...

CVE-2023-3302 Improper Neutralization of Formula Elements in a CSV File in admidio/admidio

Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9...

PT-2023-17241 · Unknown · Orangescrum

Name of the Vulnerable Software and Affected Versions: OrangeScrum version 2.0.11 Description: The issue allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF...

CVE-2023-30258

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request...

GHSA-W65Q-JCMV-28GJ Dynamic Linq vulnerable to remote code execution

Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed...

Moodle vulnerable to SQL Injection

A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions...

Moodle vulnerable to Cross-site Scripting

Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14...