PT-2023-23176 · Mage Ai · Mage Ai

Name of the Vulnerable Software and Affected Versions: mage-ai versions 0.8.34 through 0.8.71 Description: The issue affects mage-ai, an open-source data pipeline tool, when used with user authentication enabled. It allows the terminal to be accessed by users who are not signed in or do not have...

Siemens SIMATIC Communication Processor (CVE-2015-8214)

A vulnerability has been identified in SIMATIC NET CP 342-5 incl. SIPLUS variants All versions, SIMATIC NET CP 343-1 Advanced incl. SIPLUS variants All versions V3.0.44, SIMATIC NET CP 343-1 Lean incl. SIPLUS variants All versions V3.1.1, SIMATIC NET CP 343-1 Standard incl. SIPLUS variants All...

CVE-2023-1020

The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

Sql injection

The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2023-1020

The CVE-2023-1020 entry concerns the WordPress plugin Steveas WP Live Chat Shoutbox, affected in versions up to 1.4.2. The root cause is a SQL injection vulnerability caused by unsanitized/uncleaned parameters in an AJAX action accessible to unauthenticated users, enabling arbitrary SQL execution...

Ebook Store < 5.78 - Unauthenticated Sensitive Data Disclose

The plugin does not have authorisation check in its ebookstoreexportorders function, allowing unauthenticated users to call it and retrieve order information...

Jetpack CRM < 5.4.0 - PHAR Deserialisation via CSRF

The plugin does not have CSRF proper check in step 2 and 3 of the zeroBSCRMCSVImporterLitehtmlapp function, which then call fileexists on user input, which could allow unauthenticated users to perform PHAR Deserialisation attacks if they can upload a malicious file using a gadget chain, and then...

Bitcoin / AltCoin Payment Gateway <= 1.7.1 - Unauthenticated SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by authenticated users PoC Setup: 1. Install woocommerce dependency, no setup required 2. Install the vulnerable plugin woo-altcoin-payment-gateway version 1.7.1...

ChatBot < 4.4.7 - Unauthenticated PHP Object Injection

The plugin unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is present on the blog PoC To simulate a gadget chain, put the following code in a plugin: class Evil public functio...

Siemens SCALANCE W1750D Exposure of Sensitive Information to an Unauthorized Actor (CVE-2018-7083)

If a process running within Aruba Instant crashes, it may leave behind a core dump, which contains the memory contents of the process at the time it crashed. It was discovered that core dumps are stored in a way that unauthenticated users can access them through the Aruba Instant web interface...

CVE-2023-1782

HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3...

CVE-2023-1782

HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3...

CVE-2023-1782 Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation

HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3...

Contact Forms by Cimatti < 1.5.5 - Unauthenticated Stored XSS

The plugin does not sanitise and escape some parameters, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

Bookly < 21.6 - Unauthenticated Stored XSS

The plugin does not sanitise and escape some parameters, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

PT-2023-20252 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.5.2 Description: The issue is related to the generation of error messages containing sensitive information. This could potentially provide useful information to attackers, including the Python/Airflow versio...

Tags Cloud Manager <= 1.0.0 - Reflected XSS

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against ??? high privilege users such as admin|only unauthenticated users...

CVE-2023-0037

The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

EUVD-2023-12142

The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2023-0037 10WebMapBuilder < 1.0.73 - Unauthenticated SQLi

The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...