PT-2023-7851 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.18 and earlier Description: The issue is related to the lack of protection of the web page structure in Adobe Experience Manager AEM, which can be exploited by a remote attacker to execute arbitrary code....

PT-2023-8141 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.18 and earlier Description: The issue is related to a lack of protection for the web page structure in Adobe Experience Manager, which can be exploited by a remote attacker to perform a cross-site scripti...

The vulnerability of ASUS RT-AX88U Wi-Fi router’s microprogramming software arises from the lack of measures taken to protect the website structure, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of ASUS RT-AX88U Wi-Fi router’s microprogramming software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to carry out XSS attacks...

GitLab 9.2 < 16.4.3 / 16.5 < 16.5.3 / 16.6 < 16.6.1 (CVE-2023-4317)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was...

The vulnerability of the monitoring and security management tool Trend Micro Apex Central lies in the lack of protective measures for the website structure. This allows attackers to carry out cross-site scripting attacks.

The vulnerability of the monitoring and security management tool Trend Micro Apex Central exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out cross-site scripting attacks remotely...

The vulnerability of the access control devices in Fortinet’s FortiNAC and FortiNAC-F systems arises from the lack of protective measures for the website structure. This allows attackers to execute arbitrary code.

The vulnerability of the access control devices in Fortinet’s FortiNAC and FortiNAC-F systems exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of microprogrammed software in Osprey Pump Controller controllers, due to the lack of measures taken to protect the website structure, allows a hacker to execute arbitrary code.

The vulnerability of the microprogramming software of Osprey Pump Controller controllers exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2023-4317

An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an unprotected branch ...

CVE-2023-4317

An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an unprotected branch ...

PT-2023-28723 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 9.2 through 16.4.2 GitLab versions 16.5 through 16.5.2 GitLab versions 16.6 through 16.6.0 Description: An issue has been discovered in GitLab where a user with the Developer role could update a pipeline schedule from an...

GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab that stems from the ability of a use...

The vulnerability of Intradesk’s request tracking system arises from the lack of measures taken to protect its web page structure, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of Intradesk’s request tracking system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out a cross-site scripting attack remotely...

PT-2023-31280 · Jenkins · Jenkins Matlab Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins MATLAB Plugin versions 2.11.0 and earlier Description: The issue arises from missing permission checks in the Jenkins MATLAB Plugin, allowing attackers to have Jenkins parse an XML file from the Jenkins controller file system...

The vulnerability of the Apache Submarine machine learning platform, related to the lack of protection for SQL query structures, allows attackers to execute arbitrary SQL queries.

The vulnerability of the Apache Submarine machine learning platform relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

The vulnerability of the clearAlertByIds() function in the ProSAFE Network Management System (NMS300) allows a hacker to increase their privileges.

The vulnerability of the clearAlertByIds function in the ProSAFE Network Management System NMS300 for managing, diagnosing, and optimizing network devices is related to the lack of protection for the SQL query structure. Exploiting this vulnerability could allow a malicious actor to increase thei...

WPCafe < 2.2.23 - Missing Authorization

Description The plugin is vulnerable to unauthorized access, modification, or loss of data due to a missing capability check on an unknown function, allowing unauthenticated attackers to make use of the unprotected functionality...

CoCart – Headless ecommerce <= 3.11.2 - Missing Authorization

Description The plugin is vulnerable to unauthorized access of data, modification of data, or loss of data due to a missing capability check on an unknown function, allowing unauthenticated attackers to make unauthorized use of the unprotected function...

The vulnerability of the “Show Syntax Highlighted” function on the Splunk Enterprise operating system for Windows allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the “Show Syntax Highlighted” function on the Splunk Enterprise operating system for Windows exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out cross-site scripting attacks remotely...

The vulnerability of the administration console of the SIMATIC PCS neo web-based process control system lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary JavaScript code.

The vulnerability of the administration console of the SIMATIC PCS neo web-based process control system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a remote attacker to execute arbitrary JavaScript code...

Server side request forgery (ssrf)

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker can use an unprotected endpoint in the Mail app to perform a SSRF attack. Nextcloud Mail app versions 2.2.8 and 3.3.0 contain a patch for...