CVE-2023-49971

A cross-site scripting XSS vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter at /customersupport/index.php?page=customerlist...

Customer Support System 跨站脚本漏洞

Customer Support System is a customer support system by oretnom23 Personal Developer that helps a particular business or company to provide customer support after a customer has purchased a product from them. Customer Support System suffers from a cross-site scripting vulnerability that stems fro...

PT-2024-20545 · Casaos · Casaos

Name of the Vulnerable Software and Affected Versions: CasaOS versions 0.4.4.3 through 0.4.6 Description: The CasaOS web application lacks control over login attempts, allowing attackers to perform password brute force attacks and gain full access to the server with super user-level access...

CVE-2024-2054

CVE-2024-2054 affects Artica Proxy (administrative web app). Multiple connected sources confirm an unauthenticated PHP object deserialization flaw that enables remote code execution as the www-data user. Public materials describe exploitable behavior via deserialization in Artica Proxy versions a...

CVE-2024-2054 Artica Proxy Unauthenticated PHP Deserialization Vulnerability

The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user...

CVE-2024-2053

CVE-2024-2053 — Artica Proxy Unauthenticated LFI : The Artica Proxy administrative web app (versions 4.40/4.50) contains a local file inclusion flaw in the images.listener.php endpoint that bypasses attempted path-traversal protections. An unauthenticated attacker can cause the server to disclose...

CVE-2024-2053 Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability

The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to...

CVE-2023-45599

A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. This issue affects: AiLux imx6 bundle below version...

CVE-2023-45598

A CWE-425 “Direct Request 'Forced Browsing'” vulnerability in the “measure” functionality of the web application allows a remote unauthenticated attacker to access confidential measure information. This issue affects: AiLux imx6 bundle below version imx61.0.7-2...

CVE-2023-45599

A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. This issue affects: AiLux imx6 bundle below version...

CVE-2023-45595

A CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the “fileconfiguration” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. This issue affects: AiLux imx6 bundle below version imx61.0.7-2...

Design/Logic Flaw

A CWE-1269 “Product Released in Non-Release Configuration” vulnerability in the Django web framework used by the web application due to the “debug” configuration parameter set to “True” allows a remote unauthenticated attacker to access critical information and have other unspecified impacts to t...

Design/Logic Flaw

A CWE-1236 “Improper Neutralization of Formula Elements in a CSV File” vulnerability in the “fileconfiguration” functionality of the web application concerning the function “exportfile” allows a remote authenticated attacker to inject arbitrary formulas inside generated CSV files. This issue...

Session fixation

A CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the session cookie “sessionid” lasting two weeks, facilitates session hijacking attacks against victims. This issue affects: AiLux imx6 bundle below version imx61.0.7-2...

Authorization

A CWE-862 “Missing Authorization” vulnerability in the “fileconfiguration” functionality of the web application allows a remote unauthenticated attacker to access confidential configuration files. This issue affects: AiLux imx6 bundle below version imx61.0.7-2...

Unrestricted file upload

A CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the “fileconfiguration” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. This issue affects: AiLux imx6 bundle below version imx61.0.7-2...

Authorization

A CWE-862 “Missing Authorization” vulnerability in the “measure” functionality of the web application allows a remote unauthenticated attacker to access confidential measure information. This issue affects: AiLux imx6 bundle below version imx61.0.7-2...

CVE-2023-45600

A CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the session cookie “sessionid” lasting two weeks, facilitates session hijacking attacks against victims. This issue affects: AiLux imx6 bundle below version imx61.0.7-2...

CVE-2023-45600

The CVE-2023-45600 entry identifies a CWE-613 vulnerability in AiLux imx6 bundle versions prior to imx6_1.0.7-2, caused by a session cookie (sessionid) expiring after two weeks, enabling session hijacking. Affected component: web application session handling. Impact: potential unauthorized access...

CVE-2023-45599

Summary: CVE-2023-45599 affects AiLux imx6 bundle prior to version imx6_1.0.7-2. The issue is a CWE-646 flaw in the web application’s “iec61850” functionality that allows a remote authenticated attacker to upload arbitrary file types. Affected product/versions: AiLux imx6 bundle before imx6_1.0.7...