CVE-2023-43707

OsCommerce is affected by a Cross‑Site Scripting (XSS) vulnerability (CVE-2023-43707). The issue arises from insufficient input sanitization in the CatalogsPageDescriptionForm[1][name] parameter, enabling injected JavaScript that could execute in a user’s browser. Documented impact is browser-lev...

CVE-2023-43706 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting XSS vulnerability. This vulnerability allows attackers to inject JS through the "emailtemplateskey" parameter, potentially leading to unauthorized execution of scripts within a user's web browser...

CVE-2023-43706 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting XSS vulnerability. This vulnerability allows attackers to inject JS through the "emailtemplateskey" parameter, potentially leading to unauthorized execution of scripts within a user's web browser...

CVE-2023-43705 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting XSS vulnerability. This vulnerability allows attackers to inject JS through the "translationvalue1" parameter, potentially leading to unauthorized execution of scripts within a user's web browser...

CVE-2023-43704 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting XSS vulnerability. This vulnerability allows attackers to inject JS through the "title" parameter, potentially leading to unauthorized execution of scripts within a user's web browser...

CVE-2023-43702 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

Os Commerce is currently susceptible to a Cross-Site Scripting XSS vulnerability. This vulnerability allows attackers to inject JS through the "trackingnumber" parameter, potentially leading to unauthorized execution of scripts within a user's web browser...

PT-2023-28946 · Unknown · Oscommerce

Name of the Vulnerable Software and Affected Versions: Os Commerce affected versions not specified Description: The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to inject JavaScript through the orders products status manual name long1 parameter. This could potentially...

PT-2023-28933 · Unknown · Oscommerce

Name of the Vulnerable Software and Affected Versions: Os Commerce affected versions not specified Description: The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to inject JavaScript through the SKIP CART PAGE TITLE1 parameter. This potentially leads to unauthorized...

PT-2023-28947 · Unknown · Oscommerce

Name of the Vulnerable Software and Affected Versions: Os Commerce affected versions not specified Description: The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to inject JavaScript through the stock indication text1 parameter. This could lead to unauthorized execution ...

PT-2023-28927 · Unknown · Oscommerce

Name of the Vulnerable Software and Affected Versions: Os Commerce affected versions not specified Description: The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to inject JavaScript through the configuration title1 parameter. This could potentially lead to unauthorized...

Rocky Linux 8 : kernel (RLSA-2023:5244)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:5244 advisory. - A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hcisock.c in the Linux Kernel. This fla...

Input validation

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". For the...

CVE-2023-41046 Velocity execution without script rights in Xwiki platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". For the...

Design/Logic Flaw

An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator. See Instruction Manual Appendix A and...

CVE-2023-31175

The CVE-2023-31175 issue affects SEL-5037 SEL Grid Configurator (pre-4.5.0.20). It is a privilege-related execution flaw that could allow an attacker to run arbitrary commands with the highest privileges on the host. Affected component is SEL Grid Configurator; root cause is improper privilege ha...

Design/Logic Flaw

DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installation user...

SUSE-SU-2023:3104-1 Security update for the Linux Kernel (Live Patch 34 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122130 fixes several issues. The following security issues were fixed: - CVE-2023-3159: Fixed use-after-free issue in driver/firewire in outboundphypacketcallback bsc1212347. - CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution ...

SUSE-SU-2023:3083-1 Security update for the Linux Kernel (Live Patch 39 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122147 fixes several issues. The following security issues were fixed: - CVE-2023-3159: Fixed use-after-free issue in driver/firewire in outboundphypacketcallback bsc1212347. - CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution ...

SUSE SLES12 Security Update : kernel (Live Patch 38 for SLE 12 SP5) (SUSE-SU-2023:3069-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3069-1 advisory. This update for the Linux Kernel 4.12.14-122144 fixes several issues. The following security issues were fixed: - CVE-2023-3159: Fixed...

SUSE-SU-2023:3076-1 Security update for the Linux Kernel (Live Patch 33 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059124 fixes several issues. The following security issues were fixed: - CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via TCAFLOWERKEYENCOPTSGENEVE packets in flsetgeneveopt in net/sched/clsflower.c bsc1212509. -...