PT-2023-7983 · Moxa · Iologik E1200 Series

Name of the Vulnerable Software and Affected Versions: ioLogik E1200 Series firmware versions v3.3 and prior Description: A Cross-Site Request Forgery CSRF vulnerability has been identified, which may allow an attacker to trick a client into making an unintentional request to the web server. This...

Improper access control

Incorrect Access Control vulnerability in jshERP V3.3 allows attackers to obtain sensitive information via the doFilter function...

CVE-2023-48894

The CVE-2023-48894 entry concerns jshERP v3.3 and is caused by incorrect access control in the doFilter function, enabling attackers to obtain sensitive information. Affected software: jshERP 3.3. Documented impact is information disclosure without exploitation details. Remediation guidance from ...

CVE-2023-48894

Incorrect Access Control vulnerability in jshERP V3.3 allows attackers to obtain sensitive information via the doFilter function...

CVE-2023-34213

TN-5900 Series firmware versions v3.3 and prior are vulnerable to command-injection vulnerability. This vulnerability stems from insufficient input validation and improper authentication in the key-generation function, which could potentially allow malicious users to execute remote code on affect...

CVE-2023-33237

CVE-2023-33237 affects Moxa TN-5900 Series firmware v3.3 and prior. Vulnerability arises from inadequate authentication in the web API handler, allowing low-privilege APIs to perform restricted actions typically allowed to high-privilege APIs. CVSS v3.1 base score 8.8 (High): Network access, low ...

CVE-2023-33564

There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3...

GHSA-89P3-9J8C-FQH4 Duplicate Advisory: User account enumeration in eZ Publish Ibexa Kernel

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gmrf-99gw-vvwj. This link is maintained to preserve external references. Original Description This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open...

GSD-2022-1008251 HID: hyperv: fix possible memory leak in mousevsc_probe()

HID: hyperv: fix possible memory leak in mousevscprobe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.267 by commit...

Schneider Electric EcoStruxure Operator Terminal Expert SQL注入漏洞

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software support is mainly used to create and edit touch applications. A SQL injection vulnerability exists in Schneider Electric EcoStruxure Operator Terminal...

CVE-2022-35611

A Cross-Site Request Forgery CSRF in MQTTRoute v3.3 and below allows attackers to create and remove dashboards...

Cross site scripting

A cross-site scripting XSS vulnerability in MQTTRoute v3.3 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the dashboard name text field...

CVE-2022-35611

A Cross-Site Request Forgery CSRF in MQTTRoute v3.3 and below allows attackers to create and remove dashboards...

PT-2022-6502 · Schneider Electric · Ecostruxure Operator Terminal Expert +1

Name of the Vulnerable Software and Affected Versions: EcoStruxure Operator Terminal Expert versions prior to V3.3 Hotfix 1 Pro-face BLUE versions prior to V3.3 Hotfix 1 Description: The issue is related to incorrect project conversion, which can be exploited to execute malicious code. An adversa...

GSD-2022-1005583 RDMA/srpt: Fix a use-after-free

RDMA/srpt: Fix a use-after-free This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.61 by commit e60d7e2462bf57273563c4e00dbfa79ee973b9e2, it...

Cross site scripting

Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities via the firstname and lastname parameters...

CVE-2022-34991

CVE-2022-34991 affects Paymoney v3.3 with multiple reflected XSS vulnerabilities in the first_name and last_name parameters. The NVD entry lists CVSS 3.1 base metrics: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (base 5.4, MEDIUM). The connected records corroborate XSS but do not provide a specific patch...

CVE-2022-34991

Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities via the firstname and lastname parameters...

Techvillage Paymoney 跨站脚本漏洞

Techvillage Paymoney is a secure online payment gateway from Techvillage Bangladesh. A security vulnerability exists in Techvillage Paymoney v3.3, which stems from a security issue with the parameters firstname and lastname in Users, which can be exploited by an attacker to hijack an XSRF-Token...

GSD-2022-1003036 powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup

powerpc/fslrio: Fix refcount leak in fslriosetup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.14 by commit...