JVN#36340790: JB Inquiry form vulnerable to exposure of private personal information to an unauthorized actor

JB Inquiry form provided by Jubei Inc. contains an exposure of private personal information to an unauthorized actor vulnerability CWE-359 . Impact A remote attacker may obtain information entered from forms created using the affected product. Solution Update the Software Update to the latest...

PT-2023-14648 · Silkalns · Activello Theme

Name of the Vulnerable Software and Affected Versions: Silkalns Activello theme versions = 1.4.4 Description: The issue is related to an Authenticated Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker could potentially inject malicious scripts into the website, which...

PT-2023-22202 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions prior to 14.8RC1 Description: The HTML macro in XWiki does not properly neutralize script-related HTML tags, allowing any user who can use the HTML macro to introduce an XSS attack. This is particularly dangerous in a standard...

PT-2023-22201 · Xwiki · Xwiki Commons

Name of the Vulnerable Software and Affected Versions: XWiki Commons versions prior to 13.10.10 XWiki Commons versions prior to 14.4.4 XWiki Commons versions prior to 14.8RC1 Description: It is possible to bypass the existing security measures put in place to avoid open redirect by using a redire...

PT-2023-6616 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension versions 3.4.8 and earlier Description: The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user...

PT-2023-21993 · Siemens · Polarion Alm

Name of the Vulnerable Software and Affected Versions: Polarion ALM versions prior to V22R2 Polarion ALM versions prior to V2304.0 Description: A XML External Entity Injection XXE vulnerability has been identified in the application. This could allow an attacker to view files on the application...

PT-2023-13514 · Hitachi Vantara · Pentaho Business Analytics Server

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.3.0.0 Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.2.0.4 Hitachi Vantara Pentaho Business Analytics Server versions prior to 8.3.0.27 Description:...

PT-2023-6436 · Adobe · Acrobat 2020 +3

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat versions prior to 23.001.20094 Adobe Acrobat Reader versions 23.001.20093 and earlier Adobe Acrobat 2020 versions prior to 20.005.30442 Adobe Acrobat Reader 2020 versions 20.005.30441 and earlier Description: The issue is relate...

PT-2023-20043

Name of the Vulnerable Software and Affected Versions Allegro Tech BigFlow versions prior to 1.6.0 Description The issue is related to Missing SSL Certificate Validation. This means that the software may not properly verify the identity of the server it is connecting to, potentially allowing for...

Medium: python-werkzeug

Issue Overview: Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =Host-test=bad for...

CVE-2023-28706 Apache Airflow Hive Provider Beeline Remote Command Execution

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 6.0.0...

PT-2023-20064 · Unknown · Marcel Pol Zeno Font Resizer

Name of the Vulnerable Software and Affected Versions: Marcel Pol Zeno Font Resizer plugin versions = 1.7.9 Description: The issue is related to a Stored Cross-site Scripting XSS vulnerability. This vulnerability requires authentication with admin+ privileges. Recommendations: For versions = 1.7....

PT-2023-22184 · Unknown · Woocommerce +1

Name of the Vulnerable Software and Affected Versions: PI Websolution Product Enquiry for WooCommerce versions 2.2.12 and earlier Description: The issue is related to a Stored Cross-site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects th...

CVE-2023-29014 Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a user into following ...

PT-2023-22246 · Bzip3 · Bzip3

Name of the Vulnerable Software and Affected Versions: bzip3 versions prior to 1.2.3 Description: An issue was discovered in libbzip3.a. There is an xwrite out-of-bounds read. Recommendations: For versions prior to 1.2.3, update to version 1.2.3 or later to resolve the issue...

PT-2023-19557 · WordPress · Vikbooking Hotel Booking Engine & Pms

Name of the Vulnerable Software and Affected Versions: VikBooking Hotel Booking Engine & PMS plugin versions = 1.5.11 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the VikBooking Hotel Booking Engine & PMS plugin. This vulnerability requires...

PT-2023-22273 · Atos · Atos Unify Openscape 4000 Platform +1

Name of the Vulnerable Software and Affected Versions: Atos Unify OpenScape 4000 Platform versions 10 R1 through 10 R1.34.3 Atos Unify OpenScape 4000 Manager Platform versions 10 R1 through 10 R1.34.3 Description: The issue allows an unauthenticated attacker to run arbitrary commands on the...

PT-2023-22272 · Atos · Atos Unify Openscape 4000 Platform +1

Name of the Vulnerable Software and Affected Versions: Atos Unify OpenScape 4000 Platform versions 10 R1 through 10 R1.34.3 Atos Unify OpenScape 4000 Manager Platform versions 10 R1 through 10 R1.34.3 Description: The issue allows an unauthenticated attacker to run arbitrary commands on the...

PT-2023-22271 · Atos · Atos Unify Openscape 4000 Platform +1

Name of the Vulnerable Software and Affected Versions: Atos Unify OpenScape 4000 Platform versions 10 R1 through 10 R1.34.3 Atos Unify OpenScape 4000 Manager Platform versions 10 R1 through 10 R1.34.3 Description: The webservice in the affected platforms allows an unauthenticated attacker to run...

thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via HTML export

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting XSS because it fails to sanitize user input in the FAQ site while generating an HTML Export. This has been fixed in 3.1.12...