SiteServerCMS Cross-Site Scripting Vulnerability

SSCMS SiteServerCMS SSCMS is an open source, cross-platform, enterprise-class content management system from China's SSCMS Inc. A cross-site scripting vulnerability exists in SiteServerCMS version 7.2.2, which stems from a cross-site scripting XSS vulnerability in the Material Management componen...

CVE-2023-42321

Cross Site Request Forgery CSRF vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admincp.php, members.admincp.php, and group.admincp.php files...

CVE-2023-4830

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tura Signalix allows SQL Injection. This issue affects Signalix: 7T0228...

CVE-2023-3935

A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system...

CVE-2023-37879

Insecure storage of sensitive information in Wing FTP Server User Web Client allows information elicitation.This issue affects Wing FTP Server: = 7.2.0...

CVE-2023-41367

Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver Guided Procedures - version 7.50, can gain access to admin view of specific function anonymously. On successful exploitation of vulnerability under specific circumstances, attacker can view user’s...

PT-2023-18277 · Blackberry · Blackberry Athoc

Name of the Vulnerable Software and Affected Versions: BlackBerry AtHoc version 7.15 Description: An SQL Injection issue in the Management Console Operator Audit Trail could allow an attacker to read sensitive data from the database, modify database data, execute administration operations on the...

PT-2023-18278 · Blackberry · Blackberry Athoc

Name of the Vulnerable Software and Affected Versions: BlackBerry AtHoc version 7.15 Description: A Reflected Cross-site Scripting XSS vulnerability in the Management Console Reports could allow an attacker to control a script executed in the victim's browser, enabling them to execute script...

BlackBerry AtHoc SQL Injection Vulnerability

BlackBerry AtHoc is a crisis communications solution for federal, state and local governments, public safety and law enforcement agencies, and schools from BlackBerry Canada. A security vulnerability exists in BlackBerry AtHoc version 7.15, which stems from a SQL injection vulnerability in the...

N-able Take Control Agent Security Vulnerability

N-able Take Control Agent is a cloud-based remote control solution from N-able USA. Built for MSPs and IT service organizations that need to securely access and troubleshoot endpoint devices. A security vulnerability exists in N-able Take Control Agent version 7.0.41.1141 and prior versions, whic...

PT-2023-27030 · Hexo · Hexo

Name of the Vulnerable Software and Affected Versions: Hexo versions up to 7.0.0 RC2 Description: Hexo was discovered to contain an arbitrary file read issue. This allows for the reading of arbitrary files, potentially leading to sensitive information disclosure. Recommendations: For versions up ...

CVE-2023-41150

F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product...

CVE-2023-40554

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Blog2Social, Adenion Blog2Social: Social Media Auto Post & Scheduler plugin = 7.2.0 versions...

CVE-2023-31172

An Incomplete Filtering of Special Elements vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator. See Instruction Manual Appendix A and Appendix E dated...

Malicious code in @cybs-ui/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e25c2aa7aae39d30717302a7e0a6b94336a286f1167456157770d53c08d9ba99 The OpenSSF Package Analysis project identified '@cybs-ui/components' @ 7.0.0 npm as malicious. It is considered malicious because: - The packag...

WordPress plugin FV Flowplayer Video Player 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2023-39806

iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function...

PT-2023-27333 · Openbsd · Openbsd

Name of the Vulnerable Software and Affected Versions: OpenBSD versions 7.3 before errata 014 Description: The issue is related to a missing argument-count bounds check in console terminal emulation, which could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI...

DEBIAN-CVE-2023-2905

Due to a failure in validating the length of a provided MQTTCMDPUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in .NET Kestrel where a malicious client can bypass QUIC stream limit in HTTP/3 in both ASP.NET and .NET runtimes, resulting in exploitation of this vulnerability. Note: .NET 6 included HTTP/3 support as a preview...