CVE-2024-24013

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/pay/list...

CVE-2024-22625

Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /SupplyManagementSystem/admin/editcategory.php?id=...

CVE-2023-48244

The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request...

CVE-2023-6921

Blind SQL Injection vulnerability in PrestaShow Google Integrator PrestaShop addon allows for data extraction and modification. This attack is possible via command insertion in one of the cookies...

CVE-2023-7140

A vulnerability was found in code-projects Client Details System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/manage-users.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be...

GHSA-PV3G-VC3Q-8C9G Cross-Site Request Forgery in JFinalCMS via admin/nav/delete

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via admin/nav/delete...

Medium: python-wheel

Issue Overview: An issue discovered in Python Packaging Authority PyPA Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. CVE-2022-40898 Affected Packages: python-wheel Note: This advisory is applicable to Amazon Linux 2 AL2...

WordPress Plugin Advanced Local Pickup for WooCommerce Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

kernel: ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()

A vulnerability was found in the Linux kernel's ALSA subsystem in the addsecretdacpath function, where improper array handling can lead to out-of-bounds access. This occurs if the return value of the call to sndhdagetconnections returns an error code a negative number, which is stored in the...

CVE-2023-46006

Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edituser.php...

CVE-2023-46006

Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edituser.php...

Vulnerabilities fixed in OTRS

OTRS developers have fixed vulnerabilities in OTRS. An authenticated malicious person could exploit the vulnerabilities to launch a cross-site scripting attack. In addition, a malicious party can bypass security measures using an invalid certificate. OTRS has released updates to fix the...

AZL-31300 CVE-2023-44487 affecting package containerized-data-importer for versions less than 1.55.0-15

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

CVE-2023-5222

A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. This vulnerability affects the function isValidUser of the file /cgi-bin/vitogate.cgi of the component Web Management Interface. The manipulation leads to use of hard-coded password. The exploit has been...

Important: tomcat

Issue Overview: The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a reques...

How to export NetScaler files via FTP protocol

This article contains command sample in NetScaler to export some files via FTP protocol...

Business Directory Script SQL注入漏洞

Business Directory Script is an easy to use PHP directory script for anyone who wants to create a business directory. A security vulnerability exists in phpjabbers Business Directory Script version 3.2, which stems from the vulnerability to SQL injection via the column parameter...

CVE-2023-20201

creationtimestamp| type| source ---|---|--- 2023-08-17 02:36:57+00:00| seen| https://t.me/cibsecurity/68708...

ZTE mobile phones 安全漏洞

The ZTE cell phone is a network device from China's ZTE Corporation ZTE. ZTE's cell phone devices. A security vulnerability exists in ZTE mobile phones that stems from the presence of improper access control. An attacker could exploit the vulnerability to monitor events through an application in...

CVE-2023-38402

A vulnerability in the HPE Aruba Networking Virtual Intranet Access VIA client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTEM. A successful exploit could allow these malicious users to create a Denial-of-Service DoS condition affecting the Microsoft Windows...