wp-forecast < 9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The wp-forecast plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

CVE-2023-33652

Sitecore Experience Platform XP v9.3 was discovered to contain an authenticated remote code execution RCE vulnerability via the component /sitecore/shell/Invoke.aspx...

Design/Logic Flaw

Sitecore Experience Platform XP v9.3 was discovered to contain an authenticated remote code execution RCE vulnerability via the component /Applications/Content%20Manager/Execute.aspx?cmd=convert&mode=HTML...

CVE-2023-33652

Sitecore Experience Platform XP v9.3 was discovered to contain an authenticated remote code execution RCE vulnerability via the component /sitecore/shell/Invoke.aspx...

CVE-2023-33653

Sitecore Experience Platform XP v9.3 was discovered to contain an authenticated remote code execution RCE vulnerability via the component /Applications/Content%20Manager/Execute.aspx?cmd=convert&mode=HTML...

CVE-2023-33652

Sitecore Experience Platform (XP) v9.3 is affected by an authenticated remote code execution (RCE) vulnerability in the /sitecore/shell/Invoke.aspx component. The CVSS 3.1 base score is 8.8 (HIGH) with NETWORK attack vector, LOW exploit complexity, LOW privileges required, and no user interaction...

CVE-2023-33653

CVE-2023-33653 affects Sitecore Experience Platform (XP) v9.3. The authenticated RCE exists in the content management component via /Applications/Content%20Manager/Execute.aspx?cmd=convert&mode=HTML. CVSS v3.1 base score 8.8 (HIGH) with network access, low privileges required, no user interaction...

CVE-2022-38573

CVE-2022-38573 affects 10-Strike Network Inventory Explorer v9.3, where a buffer overflow is triggered via the Add Computers function. The issue has a CVSS v3.1 base score of 9.8 (CRITICAL), with network access, no privileges required, and no user interaction required. Impact is rated HIGH on con...

CVE-2019-5620

CVE-2019-5620 concerns ABB MicroSCADA Pro SYS600 9.3, where a missing authentication for a critical function (CWE-306) enables a network-accessible flaw. The issue is tied to the wserver.exe component, described in public exploit evidence as a remote code execution scenario via unauthenticated EX...