PT-2023-36189 · Cni +1 · Cni +1

Name of the Vulnerable Software and Affected Versions: cni affected versions not specified Description: The issue is related to a security release in the go 1.19 package, which is used to rebuild the cni package. Recommendations: At the moment, there is no information about a newer version that...

CVE-2022-36243 Directory Traversal on Shop Beat Services

Shop Beat Solutions pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Directory Traversal via server.shopbeat.co.za. Information Exposure Through Directory Listing vulnerability in "studio" software of Shop Beat. This issue affects: Shop Beat studio studio versions prior to 3.2....

Abstrium Pydio Cells 访问控制错误漏洞

Abstrium Pydio Cells is a next-generation file sharing platform developed using the Go language by Abstrium France. An Access Control Error vulnerability exists in Abstrium Pydio Cells version 4.2.0, which stems from incorrect access control...

CVE-2023-34205

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

PT-2023-5360 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 7.0.1 Description: The issue is related to improper access control in the OpenEMR software, which can be exploited by a remote attacker to view, create, and edit protected information. Recommendations: For OpenEMR...

CVE-2023-22970

Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file...

CVE-2023-2879

GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file...

CVE-2023-20882

In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry. Under the right circumstances, when client connections are closed prematurely, gorouter marks the currently selected...

CVE-2023-2798 Denial of service in HtmlUnit

Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks DoS. If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. This effect may support a denial of service attack.This issue...

CVE-2023-2851

CVE-2023-2851 describes an SQL Injection vulnerability in AGT Tech Ceppatron (cash register device) that allows command line execution through SQL injection. According to the sources, it affects all versions of the software; the root cause is improper neutralization of special elements used in SQ...

PT-2023-15090 · WordPress · Marty Thornley Bulk Resize Media

Name of the Vulnerable Software and Affected Versions: Marty Thornley Bulk Resize Media plugin versions = 1.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a...

Design/Logic Flaw

Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz often outside the range of human adult hearing. Commands at these frequencies are essentially...

GHSA-V6M2-J92J-2H78 Cross-site scripting in Liferay Portal

Stored cross-site scripting XSS vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 before fix pack 18, and 7.2 before fix pack 5 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form's name fiel...

CVE-2023-2045

CVE-2023-2045 affects Ipekyolu Software Auto Damage Tracking Software prior to version 4. The vulnerability is an SQL Injection caused by improper neutralization of special elements in SQL commands. This can impact confidentiality, integrity, and availability (CVSSv3.1 base score 9.8). The issue ...

Cross-Site Request Forgery (CSRF)

Tag Profiler Plugin is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists because the http endpoint doesn't require POST requests which allows an attacker to perform cross-site request forgery attacks...

JetFormBuilder < 3.0.7 - Cross-Site Request Forgery (CSRF)

The plugin does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in user to submit a crafted request...

PT-2023-17441 · Ipekyolu · Ipekyolu Software Auto Damage Tracking

Name of the Vulnerable Software and Affected Versions: Ipekyolu Software Auto Damage Tracking Software versions prior to 4 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

Mitel MiVoice Connect 跨站脚本漏洞

Mitel MiVoice Connect is Mitel Canada's software for centralized management of Mitel Networks' call processing and collaboration tools. A cross-site scripting vulnerability exists in Mitel MiVoice Connect 19.3 SP2 and prior versions, which originated from a vulnerability that allows an...

PT-2023-21175 · Unknown · Cityboss E-Municipality

Name of the Vulnerable Software and Affected Versions: Cityboss E-municipality versions prior to 6.05 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-23340 · Mitel · Mitel Mivoice Connect

Name of the Vulnerable Software and Affected Versions: Mitel MiVoice Connect versions 9.6.2208.101 and earlier Description: A vulnerability in the Connect Mobility Router component could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges...