62 matches found
CVE-2023-40958
Summary: CVE-2023-40958 affects Didotech srl Engineering & Lifecycle Management (pdm) versions 14.0, 15.0, and 16.0. An SQL injection via the query parameter in models/base_client.py allows a remote authenticated attacker to execute arbitrary code. This vulnerability is fixed in pdm-14.0.1.0.0, p...
CVE-2023-40955
CVE-2023-40955 affects Didotech srl Engineering & Lifecycle Management (aka pdm) versions 14.0, 15.0 and 16.0. A SQL injection vulnerability in the application allows a remote authenticated attacker to execute arbitrary code through the select parameter in the models/base_client.py component. Pat...
CVE-2023-40957
A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management aka pdm v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, and pdm-16.0.1.0.0 allows a remote authenticated attacker to execute arbitrary code via the request parameter in models/baseclient.py compone...
shop.deodatosrl.it Cross Site Scripting vulnerability OBB-3327134
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-48111
A cross-site scripting XSS vulnerability in the checklogin function of SIPE s.r.l WI400 between version 8 and 11 included allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the f parameter...
CVE-2023-24253
CVE-2023-24253 affects the Ikon Server from Domotica Labs srl, with vulnerable versions prior to 2.8.6. The issue is a SQL injection in Ikon Server prior to 2.8.6, as reported across multiple sources. The available connected documents confirm the vulnerability and point to a remediation: upgrade ...
CVE-2022-30422
Proietti Tech srl Planet Time Enterprise 4.2.0.1,4.2.0.0,4.1.0.0,4.0.0.0,3.3.1.0,3.3.0.0 is vulnerable to Remote code execution via the Viewstate parameter...
Remote code execution
Proietti Tech srl Planet Time Enterprise 4.2.0.1,4.2.0.0,4.1.0.0,4.0.0.0,3.3.1.0,3.3.0.0 is vulnerable to Remote code execution via the Viewstate parameter...
CVE-2022-30422
Proietti Tech srl Planet Time Enterprise 4.2.0.1,4.2.0.0,4.1.0.0,4.0.0.0,3.3.1.0,3.3.0.0 is vulnerable to Remote code execution via the Viewstate parameter...
CVE-2022-25569
Bettini Srl GAMS Product Line v4.3.0 was discovered to re-use static SSH keys across installations, allowing unauthenticated attackers to login as root users via extracting a key from the software...
Design/Logic Flaw
Bettini Srl GAMS Product Line v4.3.0 was discovered to re-use static SSH keys across installations, allowing unauthenticated attackers to login as root users via extracting a key from the software...
CVE-2022-25569
The CVE-2022-25569 issue affects Bettini Srl GAMS Product Line v4.3.0, where the product reuses static SSH keys across installations, enabling unauthenticated attackers to log in as root by extracting a key from the software. This is described in multiple connected records as a static SSH key reu...
CVE-2022-25569
Bettini Srl GAMS Product Line v4.3.0 was discovered to re-use static SSH keys across installations, allowing unauthenticated attackers to login as root users via extracting a key from the software...
donati-srl.com Improper Access Control vulnerability OBB-2453619
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
intecom-srl.com Cross Site Scripting vulnerability OBB-2285337
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Gestionale Open 11.00.00 - Local Privilege Escalation Vulnerability
Exploit Title: Gestionale Open 11.00.00 - Local Privilege Escalation Author: Alessandro 'mindsflee' Salzano Vendor Homepage: https://www.gestionaleopen.org/ Software Homepage: https://www.gestionaleopen.org/ Software Link:...
piacentinasrl.com Cross Site Scripting vulnerability OBB-1445729
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Joomla Codextrous B2jcontact 2.1.17 Shell Upload
Exploit Title : Joomla Codextrous ComB2jcontact Components 2.1.17 Shell Upload Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 04/01/2019 Vendor Homepage : codextrous.com/joomla-components/b2j-contact.html + extensions.joomla.org/extension/b2j-contact/ Software...
JVN#61081552: WordPress plugin "PixelYourSite" vulnerable to cross-site scripting
The WordPress plugin "PixelYourSite" provided by Minimal Work SRL contains a reflected cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on a logged in user's web browser. Solution Update the plugin Update the plugin according to the information provided by the...
LogicalDOC Enterprise 7.7.4 - User Enumeration
LogicalDOC Enterprise 7.7.4 - User Enumeration LogicalDOC Enterprise 7.7.4 Username Enumeration Weakness Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary: LogicalDOC is a free document management...