CVE-2023-43359

Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data parameters in the Content Manager Menu component...

CVE-2023-43344

CVE-2023-43344 concerns OpenSolution Quick CMS v6.7. The vulnerability is a Cross-Site Scripting (XSS) flaw in the SEO - Meta description field of the Pages Menu component, allowing a local attacker to execute arbitrary script via a crafted payload. Root cause reported across sources is insuffici...

CVE-2023-43340

Cross-site scripting XSS vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword and cmspasswordconfim parameters...

Nextcloud: Self XSS when pasting HTML into Text app with Ctrl+Shift+V

A vulnerability was found where pasting HTML into the Text app using Ctrl+Shift+V would insert the HTML into the page, allowing for a potential XSS attack...

CVE-2023-40833

The CVE-2023-40833 entry concerns Thecosy IceCMS v1.0.0. A remote attacker can gain privileges via the Id and key parameters in getCosSetting, with impact described as Confidentiality/Integrity/Availability High. Public sources consistently describe a privilege escalation/vector affecting getCosS...

Code injection

An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to the echodriver.sys component. NOTE: the vendor's position is that the reported ability for user-mode applications to execute code as NT AUTHORITY\SYSTEM was "deactivated by...

CVE-2023-5511 Cross-Site Request Forgery (CSRF) in snipe/snipe-it

Cross-Site Request Forgery CSRF in GitHub repository snipe/snipe-it prior to v.6.2.3...

CVE-2023-5511 Cross-Site Request Forgery (CSRF) in snipe/snipe-it

Cross-Site Request Forgery CSRF in GitHub repository snipe/snipe-it prior to v.6.2.3...

kernel: scsi: storvsc: Fix handling of virtual Fibre Channel timeouts

In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Hyper-V provides the ability to connect Fibre Channel LUNs to the host system and present them in a guest VM as a SCSI device. I/O to the vFC device is handled by the...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2023-44476

CVE-2023-44476 affects the CopyRightPro WordPress plugin (versions <= 2.1). The vulnerability is Cross-Site Request Forgery (CSRF) with CVSS v3.1 metrics indicating high impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; base score 8.8). Connected sources confirm the flaw, with remediation ...

CVE-2023-44848

An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admintemplate.php component...

Code injection

An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin notify.php component...

CVE-2023-44848

An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admintemplate.php component...

CVE-2023-44848

An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admintemplate.php component...

CVE-2023-44846

An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin notify.php component...

CVE-2023-44847

An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin Weixin.php component...

CVE-2023-44847

SeaCMS 12.8 is affected by CVE-2023-44847 due to vulnerability in the admin_Weixin.php component that allows an attacker to execute arbitrary code. The issue is documented across multiple sources (NVD, Red Hat, CNNVD, etc.). Descriptions consistently indicate remote code execution via the admin_W...