CVE-2023-4103 Multiple vulnerabilities in IDM Sistemas QSige

QSige statistics are affected by a remote SQLi vulnerability. It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application...

CVE-2023-24518

A Cross-site Request Forgery CSRF vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they are currently authenticated against. This issue affects Pandora FMS version 767 and earlier versions on all platforms...

Cross site request forgery (csrf)

A Cross-site Request Forgery CSRF vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they are currently authenticated against. This issue affects Pandora FMS version 767 and earlier versions on all platforms...

CVE-2023-4098

CVE-2023-4098 affects IDM Sistemas QSige web application with a SQL injection vulnerability caused by improper input parameter filtering. The issue allows unauthorized access to perform injections, potentially leading to information disclosure, DoS, and compromised integrity; exploitation require...

CVE-2023-4098 Multiple vulnerabilities in IDM Sistemas QSige

It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application...

CVE-2023-4098 Multiple vulnerabilities in IDM Sistemas QSige

It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application...

CVE-2023-24518 Disabling the administrator's account through cross-site request forgery

A Cross-site Request Forgery CSRF vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they are currently authenticated against. This issue affects Pandora FMS version 767 and earlier versions on all platforms...

Cross Site Scripting

thorsten/phpmyfaq is vulnerable to Cross Site Scripting. The vulnerability is due to improper sanitization of data. This can be exploited by an attacker to inject malicious JavaScript into the web application...

PT-2023-27727 · Idm Sistemas Qsige +1 · Qsige

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The web application does not correctly filter input parameters, allowing for SQL injections, Denial of Service DoS, or information disclosure. It is...

IDM Sistemas QSige SQL Injection Vulnerability

IDM Sistemas QSige is a communication management system from IDM Sistemas. A security vulnerability exists in IDM Sistemas QSige that stems from a web application that does not properly filter input parameters, resulting in SQL injection, DoS, or information disclosure...

IDM Sistemas QSige SQL Injection Vulnerability

IDM Sistemas QSige is a communication management system from IDM Sistemas. IDM Sistemas QSige suffers from a SQL injection vulnerability that stems from a web application that does not properly filter input parameters, resulting in SQL injection, DoS, or information disclosure...

Mars: No CSRF protection when adding an item to cart

The report details a vulnerability due to lack of CSRF protection when adding items to a shopping cart. This allows attackers to force users to unknowingly add items to their cart...

PT-2023-32048 · Field Logic · Field Logic Datacube4

Name of the Vulnerable Software and Affected Versions: Field Logic DataCube4 up to 20231001 Description: A problematic issue was found in the Web API component, affecting unknown code of the file /api/. This leads to improper authentication. The exploit has been disclosed to the public and may be...

Juniper SRX Firewall / EX Switch Remote Code Execution Exploit

This Metasploit module exploits a PHP environment variable manipulation vulnerability affecting Juniper SRX firewalls and EX switches. The affected Juniper devices running FreeBSD and every FreeBSD process can access their stdin by opening /dev/fd/0. The exploit also makes use of two useful PHP...

Engineers Online Portal SQL Injection Vulnerability

Engineers Online Portal is open source an online portal . It is developed using PHP, MySQL database, HTML, CSS, Javascript, jQuery, Ajax, Bootstrap and some other libraries. Engineers Online Portal has a SQL injection vulnerability that stems from manipulation of the teacherid parameter that can...

CVE-2023-43664

CVE-2023-43664 affects PrestaShop: in the Back Office, an employee can list all modules due to missing access rights check in ajaxProcessGetPossibleHookingListForModule. The root cause is improper authorization in that function. The issue is mitigated in commit 15bd281c and is included in PrestaS...

CVE-2023-43663 Improper Privilege Management in Prestashop

PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionality. Commit ce1f6708 addresses this issue and is included i...

CVE-2023-43663

PrestaShop vulnerability CVE-2023-43663 affects PrestaShop core where, in affected versions, any module can be disabled or uninstalled from the back office—even by users with low privileges. The issue enables low-privilege users to disable portions of shop functionality, indicating an improper pr...

Qualys Named a Market Leader in GigaOm Radar Report for Application Security Testing

Qualys Web Application Scanning WAS has been named a leader in the GigaOm Radar Report for Application Security Testing, 2023. Web app security is critical for every organization, for attacks on this vector caused 25% of breaches, according to the Verizon 2023 Data Breach Investigations Report. T...

UBUNTU-CVE-2023-41320

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. UI layout preferences management can be hijacked to lead to SQL injection. This injection can be use to...