CVE-2023-36619

Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users...

CVE-2023-36619

Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users...

CVE-2023-42508

JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body...

Code injection

JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body...

CVE-2023-42508 JFrog Artifactory Improper header input validation leads to email manipulation sent from the platform

JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body...

CVE-2023-42508 JFrog Artifactory Improper header input validation leads to email manipulation sent from the platform

JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body...

CVE-2023-42508

CVE-2023-42508 : JFrog Artifactory versions prior to 7.66.0 are affected by an endpoint abuse vulnerability that allows unauthenticated users to send emails with manipulated email bodies via a crafted payload. Root cause described as improper header input validation leading to email manipulation....

CVE-2023-4490

The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

Sql injection

The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

GNOME Shell Security Vulnerability

GNOME Shell is a shell from the GNOME Project that provides core user interface functionality for the GNOME desktop such as switching windows, launching applications or viewing notifications. A security vulnerability exists in GNOME Shell, which stems from a lock screen in GNOME Shell that allows...

Cross site scripting

The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform...

CVE-2023-3169

The CVE concerns tagDiv Composer for WordPress (pre-4.2). Concrete detail: unauthenticated stored XSS via the REST endpoint /wp-json/tdw/save_css, exploiting the compiled_css parameter which is stored and later executed when CSS loads. Root cause: authorisation is missing on the REST route and in...

Cross site request forgery (csrf)

The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog...

PT-2023-27525 · WordPress · Profile Builder

Name of the Vulnerable Software and Affected Versions: Profile Builder WordPress plugin versions prior to 3.9.8 Description: The issue concerns a lack of authorization and CSRF protection in the page creation function of the plugin. This allows unauthenticated users to create specific pages,...

CVE-2023-31424 Web authentication and authorization bypass

Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization...

CVE-2023-40570

Datasette is an open source multi-tool for exploring and publishing data. This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1.0a2 or 1.0a3 - in an online accessible location but with authentication enabled using a plugin such as datasette-auth-passwords. The /-/ap...

Information Disclosure

Datasette is vulnerable to Information Disclosure. The vulnerability exists because it does not check permissions when viewing the /-/api endpoint, resulting in databases and tables disclosure to unauthenticated users...

Jupiter X Core Premium < 3.4.3 - Unauthenticated Privilege Escalation

Description The plugin does not properly validate users during the Facebook login process, allowing unauthenticated users to login as any user by knowing their email address...

Stripe Payment < 3.8.0 - Unauthenticated WC Order Status Update

Description The plugin does not have authorisation in its ehcallbackhandler function, allowing unauthenticated users to update the status of arbitrary WooCommerce orders...

CVE-2023-39959

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for...