CVE-2023-28359

A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat. This can be exploited by unauthenticated users when there is at least one custom emoji uploaded to the Rocket.Chat instance. The vulnerability causes a delay in the server response, with the...

CVE-2023-27298

Uncontrolled search path in the WULT software maintained by IntelR before version 1.0.0 commit id 592300b may allow an unauthenticated user to potentially enable escalation of privilege via network access...

CVE-2022-41646

Insufficient control flow management in the IntelR IPP Cryptography software before version 2021.6 may allow an unauthenticated user to potentially enable information disclosure via local access...

Design/Logic Flaw

Insufficient control flow management in the IntelR IPP Cryptography software before version 2021.6 may allow an unauthenticated user to potentially enable information disclosure via local access...

CVE-2023-27298

Uncontrolled search path in the WULT software maintained by IntelR before version 1.0.0 commit id 592300b may allow an unauthenticated user to potentially enable escalation of privilege via network access...

CVE-2023-25179

Uncontrolled resource consumption in the IntelR UniteR android application before Release 17 may allow an authenticated user to potentially enable denial of service via local access...

WordPress Advanced Custom Fields Plugin < 6.1.6 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:advancedcustomfields:advancedcustomfields"; ifdescription...

Debian dla-3407 : libjackson2-databind-java - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3407 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3407-1 [email protected] https://www.debian.org/lts/security/...

CVE-2023-22577

The CVE-2023-22577 issue affects White Rabbit Switch, where an unauthenticated user can retrieve sensitive information (password hashes and SNMP community strings). Connected sources consistently describe information disclosure as the impact. Root cause details are not explicitly provided in the ...

Bit Form < 1.9 - RCE via Unauthenticated Arbitrary File Upload

The plugin does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server, leading to Remote Code Execution. As an unauthenticated user access a form containing a File Upload form...

CVE-2023-29413

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause Denial-of-Service when accessed by an unauthenticated user on the Schneider UPS Monitor service...

CVE-2023-29413

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause Denial-of-Service when accessed by an unauthenticated user on the Schneider UPS Monitor service...

SPIP Remote Command Execution Exploit

This Metasploit module exploits a PHP code injection in SPIP. The vulnerability exists in the oubli parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges. Branches 3.2, 4.0, 4.1 and 4.2 are concerned. Vulnerable versions are below 3.2.18, below 4.0.10...

Bitcoin / AltCoin Payment Gateway <= 1.7.1 - Unauthenticated SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by authenticated users Setup: 1. Install woocommerce dependency, no setup required 2. Install the vulnerable plugin woo-altcoin-payment-gateway version 1.7.1 3. ...

CVE-2023-29203 Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm

XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from subwiki by requesting users on a subwiki which allows only global users with uorgsuggest.vm. This issue only concerns hidden users from main...

CVE-2022-45175

An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Insecure Direct Object Reference can occur under the 5.6.5-3/doc/ID-FILE/c/N/C/websocket endpoint. A malicious unauthenticated user can access cached files in the OnlyOffice backend of other users by guessing the file ID of a...

CVE-2022-45175

An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Insecure Direct Object Reference can occur under the 5.6.5-3/doc/ID-FILE/c/N/C/websocket endpoint. A malicious unauthenticated user can access cached files in the OnlyOffice backend of other users by guessing the file ID of a...

GHSA-VVP7-R422-RX83 Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm

Impact It's possible to list some users who are normally not viewable from subwiki by requesting users on a subwiki which allows only global users with uorgsuggest.vm. This issue only concerns hidden users from main wiki. Note that the disclosed information are the username and the first and last...

Cross site scripting

Stored Cross site scripting XSS vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious javascript on the incorrect login details page...

CVE-2023-28341

Stored Cross site scripting XSS vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious javascript on the incorrect login details page...