CVE-2023-6758

A vulnerability was found in Thecosy IceCMS 2.0.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /adplanet/PlanetCommentList of the component API. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit...

Repox Cross-Site Scripting Vulnerability

Repox is a framework for managing dataspaces from Repox, Inc. A cross-site scripting vulnerability exists in Repox 2.3.7 and earlier versions, which stems from the presence of a stored cross-site scripting XSS vulnerability...

IceCMS Security Vulnerability

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation by NgShow individual developers. A security vulnerability exists in Thecosy IceCMS version 2.0.1, which stems from the presence of unknown code in the application that can be exploited by an attacke...

PT-2023-31642 · Jenkins · Jenkins Dingding Json Pusher Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Dingding JSON Pusher Plugin versions 2.0 and earlier Description: The issue concerns the Jenkins Dingding JSON Pusher Plugin, where access tokens are not masked on the job configuration form. This increases the potential for attackers...

PYSEC-2023-281

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

DoraCMS Cross-Site Scripting Vulnerability (CNVD-2023-9750397)

DoraCMS is a software application. Based on Nodejs+eggjs+mongodb to write a content management system . A cross-site scripting XSS vulnerability exists in DoraCMS version v2.1.8. An attacker can exploit this vulnerability to execute arbitrary code by uploading a specially crafted HTML or image fi...

PT-2023-31567 · Caddy · Caddy-Geo-Ip

Name of the Vulnerable Software and Affected Versions: caddy-geo-ip versions 0.6.0 and earlier for Caddy 2 Description: The issue allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism, such as the trusted proxy directive in revers...

GPAC Security Vulnerabilities

GPAC is an open source multimedia framework. A security vulnerability exists in GPAC version 2.3-DEV-rev617-g671976fcc-master. An attacker can exploit this vulnerability to execute arbitrary code and cause a denial of service via the str2ulong class in src/mediatools/avilib.c in gpac/MP4Box...

WordPress Plugin Welcart e-Commerce Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2023-48172

A Cross Site Scripting XSS vulnerability in Shuttle Booking Software 2.0 allows a remote attacker to inject JavaScript via the name, description, title, or address parameter to index.php...

CVE-2023-5712

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sdglobalvalue function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level...

Microweber Security Breach

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in Microweber versions prior to 2.0, which stems from th...

EnBw SENEC Legacy Storage Box Security Vulnerability

The EnBw SENEC Legacy Storage Box is a series of storage boxes from German company EnBw. A security vulnerability exists in EnBw SENEC Legacy Storage Box versions V1, V2, and V3, which stems from the affected devices transmitting unencrypted sensitive information, and can be exploited by an...

GPAC Security Vulnerabilities

GPAC is an open source multimedia framework. A security vulnerability exists in GPAC version 2.3-DEV-rev617-g671976fcc-master, which stems from the presence of a memory leak vulnerability...

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

PT-2023-30974 · Unknown · Shuttle Booking

Name of the Vulnerable Software and Affected Versions: Shuttle Booking Software version 2.0 Description: The issue concerns a CSV Injection vulnerability in the Languages section of the software, which can be exploited via an export. Recommendations: For Shuttle Booking Software version 2.0,...

DaiCuo Security Breach

DaiCuo DaiCuo is China's DaiCuo DaiCuo company based on ThinkPHP, Bootstrap, Jquery, an adaptive backend management framework. A security vulnerability exists in DaiCuo v2.5.15, which stems from a stored cross-site scripting XSS vulnerability in the file /admin.php. An attacker can exploit this...

PT-2023-32695 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 2.0 Description: The issue concerns Business Logic Errors in the microweber/microweber GitHub repository. Unpublished and deleted products can be added to checkout, indicating a flaw in the application'...

Microweber Security Breach

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in Microweber versions prior to 2.0, which stems from a...

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...