Sierra Wireless ALEOS Cross-Site Scripting Vulnerability

Sierra Wireless ALEOS AAF is a framework for creating applications in Sierra Wireless AirLink gateways from Sierra Wireless Canada. Sierra Wireless ALEOS ALEOS 4.16 and prior versions have a cross-site scripting vulnerability that stems from the presence of a stored cross-site scripting XSS...

Sierra Wireless ALEOS Cross-Site Scripting Vulnerability

Sierra Wireless ALEOS AAF is a framework for creating applications in Sierra Wireless AirLink gateways from Sierra Wireless Canada. A security vulnerability exists in Sierra Wireless ALEOS 4.16 and earlier versions that stems from the ACEManager component not validating the name and type of...

PT-2023-32393 · WordPress · Word Balloon

Name of the Vulnerable Software and Affected Versions: Word Balloon WordPress plugin versions prior to 4.20.3 Description: The issue allows an unauthenticated attacker to trick a logged-in user into deleting arbitrary avatars by clicking a link, due to a lack of protection against CSRF attacks in...

PT-2023-20433 · Ibm · Ibm Planning Analytics On Cloud Pak For Data

Name of the Vulnerable Software and Affected Versions: IBM Planning Analytics on Cloud Pak for Data version 4.0 Description: The issue is caused by insecure network communication, which could allow an attacker on a shared network to obtain sensitive information. Recommendations: For IBM Planning...

RuoYi Security Breach

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v4.6 and earlier versions, which originates from a SQL injection vulnerability in /system/dept/edit...

CVE-2023-48754

Cross-Site Request Forgery CSRF vulnerability in Wap Nepal Delete Post Revisions In WordPress allows Cross Site Request Forgery.This issue affects Delete Post Revisions In WordPress: from n/a through 4.6...

CVE-2023-47851

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Akhtarujjaman Shuvo Bootstrap Shortcodes Ultimate allows Stored XSS.This issue affects Bootstrap Shortcodes Ultimate: from n/a through 4.3.1...

PT-2023-32596 · Unknown · Oscommerce

Name of the Vulnerable Software and Affected Versions: osCommerce version 4 Description: A problematic issue was found in osCommerce, affecting some unknown functionality of the file /catalog/compare of the component Instant Message Handler. The manipulation of the compare argument with a malicio...

google-translate-api-browser Code Issue Vulnerability

google-translate-api-browser is the free and unlimited Google Translate API. A code issue vulnerability exists in versions of google-translate-api-browser prior to 4.1.0, which stems from the translateOptions.tld field not being properly cleaned before being placed in a Google Translate URL. An...

PT-2023-29191 · Dell · Dell Command Configure

Name of the Vulnerable Software and Affected Versions: Dell Command | Configure versions prior to 4.11.0 Description: The issue is related to improper access control, which could be exploited by a local malicious standard user during the repair or change of installation, potentially leading to...

CVE-2023-26542

Cross-Site Request Forgery CSRF vulnerability in Exeebit phpinfo WP plugin = 4.0 versions...

minizip-ng Security Vulnerabilities

minizip-ng is a zip manipulation library for zlib-ng written in C and supported on Windows, macOS, and Linux. A security vulnerability in zlib-ng minizip-ng version 4.0.2 exists that could allow an attacker to execute arbitrary code via the mzpathresolve function in the mzos.c file...

Admidio Security Breach

Admidio is an open source member management system from the Admidio team. The system supports member lists, event management, guestbooks, photo albums and downloads. A security vulnerability exists in Admidio v4.2.12 and earlier versions, which stems from vulnerability to cross-site scripting XSS...

SUSE CVE-2023-38711

An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with IDIPV4ADDR or IDIPV6ADDR receives an IDcr payload with IDFQDN, a NULL pointer dereference causes a crash and restart of the pluto daemon. NOTE: the earliest affected version is 4.6...

CVE-2023-26364

@adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a minor denial of service while attempting to parse CSS. Exploitation of this issue does not require user interaction or privileges...

PublicCMS Security Vulnerabilities

PublicCMS is an open source content management system CMS written in Java by PublicCMS China. A security vulnerability exists in PublicCMS version v.4.0.202302.e, which stems from the presence of a Server Request Forgery SSRF vulnerability. An attacker can exploit the vulnerability to obtain...

Grocy Security Vulnerabilities

Grocy is a web-based self-hosted grocery and home management solution from Grocy Open Source. A security vulnerability exists in Grocy version v.4.0.3, which stems from a cross-site scripting XSS vulnerability in the /equipment/ component. An attacker could exploit the vulnerability to execute...

CVE-2023-47550

Cross-Site Request Forgery CSRF vulnerability in RedNao Donations Made Easy – Smart Donations allows Stored XSS.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12...

CVE-2023-48020

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/task/changeStatus...

CVE-2023-46099

A vulnerability has been identified in SIMATIC PCS neo All versions V4.1. There is a stored cross-site scripting vulnerability in the Administration Console of the affected product, that could allow an attacker with high privileges to inject Javascript code into the application that is later...