#ExploitObserverAlert
CVE-2023-49098
DESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to CVE-2023-49098. Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939.
CVE-2023-49098
DESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to CVE-2023-49098. Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939.
#ExploitObserverAlert
CVE-2022-29458
DESCRIPTION: Exploit Observer has 9 entries in 3 file formats related to CVE-2022-29458. ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.
FIRST-EPSS: 0.001020000
NVD-IS: 5.2
NVD-ES: 1.8
CVE-2022-29458
DESCRIPTION: Exploit Observer has 9 entries in 3 file formats related to CVE-2022-29458. ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.
FIRST-EPSS: 0.001020000
NVD-IS: 5.2
NVD-ES: 1.8
#ExploitObserverAlert
CVE-2021-34470
DESCRIPTION: Exploit Observer has 7 entries in 3 file formats related to CVE-2021-34470. Microsoft Exchange Server Elevation of Privilege Vulnerability
FIRST-EPSS: 0.000460000
NVD-IS: 5.9
NVD-ES: 2.1
CVE-2021-34470
DESCRIPTION: Exploit Observer has 7 entries in 3 file formats related to CVE-2021-34470. Microsoft Exchange Server Elevation of Privilege Vulnerability
FIRST-EPSS: 0.000460000
NVD-IS: 5.9
NVD-ES: 2.1
#ExploitObserverAlert
CVE-2020-20300
DESCRIPTION: Exploit Observer has 4 entries in 3 file formats related to CVE-2020-20300. SQL injection vulnerability in the wp_where function in WeiPHP 5.0.
FIRST-EPSS: 0.161230000
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2020-20300
DESCRIPTION: Exploit Observer has 4 entries in 3 file formats related to CVE-2020-20300. SQL injection vulnerability in the wp_where function in WeiPHP 5.0.
FIRST-EPSS: 0.161230000
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2019-18922
DESCRIPTION: Exploit Observer has 5 entries in 3 file formats related to CVE-2019-18922. A Directory Traversal in the Web interface of the Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 [1.00.047] allows unauthenticated attackers to read arbitrary system files via a GET request. NOTE: This is an End-of-Life product.
FIRST-EPSS: 0.310540000
NVD-IS: 3.6
NVD-ES: 3.9
CVE-2019-18922
DESCRIPTION: Exploit Observer has 5 entries in 3 file formats related to CVE-2019-18922. A Directory Traversal in the Web interface of the Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 [1.00.047] allows unauthenticated attackers to read arbitrary system files via a GET request. NOTE: This is an End-of-Life product.
FIRST-EPSS: 0.310540000
NVD-IS: 3.6
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2023-51805
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-51805. SQL Injection vulnerability in TDuckCLoud tduck-platform v.4.0 allows a remote attacker to obtain sensitive information via the getFormKey parameter in the search function of FormDataMysqlService.java file.
CVE-2023-51805
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-51805. SQL Injection vulnerability in TDuckCLoud tduck-platform v.4.0 allows a remote attacker to obtain sensitive information via the getFormKey parameter in the search function of FormDataMysqlService.java file.
#ExploitObserverAlert
CVE-2021-23899
DESCRIPTION: Exploit Observer has 5 entries in 2 file formats related to CVE-2021-23899. OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.
FIRST-EPSS: 0.002450000
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2021-23899
DESCRIPTION: Exploit Observer has 5 entries in 2 file formats related to CVE-2021-23899. OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.
FIRST-EPSS: 0.002450000
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2023-51067
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-51067. An unauthenticated reflected cross-site scripting (XSS) vulnerability in QStar Archive Solutions Release RELEASE_3-0 Build 7 allows attackers to execute arbitrary javascript on a victim's browser via a crafted link.
CVE-2023-51067
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-51067. An unauthenticated reflected cross-site scripting (XSS) vulnerability in QStar Archive Solutions Release RELEASE_3-0 Build 7 allows attackers to execute arbitrary javascript on a victim's browser via a crafted link.
#ExploitObserverAlert
CVE-2024-21654
DESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to CVE-2024-21654. Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.
CVE-2024-21654
DESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to CVE-2024-21654. Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.
#ExploitObserverAlert
CVE-2023-31714
DESCRIPTION: Exploit Observer has 4 entries in 3 file formats related to CVE-2023-31714. Chitor-CMS before v1.1.2 was discovered to contain multiple SQL injection vulnerabilities.
FIRST-EPSS: 0.005350000
NVD-IS: 5.9
NVD-ES: 3.9
CVE-2023-31714
DESCRIPTION: Exploit Observer has 4 entries in 3 file formats related to CVE-2023-31714. Chitor-CMS before v1.1.2 was discovered to contain multiple SQL injection vulnerabilities.
FIRST-EPSS: 0.005350000
NVD-IS: 5.9
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2020-26876
DESCRIPTION: Exploit Observer has 6 entries in 3 file formats related to CVE-2020-26876. The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because show_in_rest is enabled for custom post types (e.g., /wp-json/wp/v2/course and /wp-json/wp/v2/lesson exist).
FIRST-EPSS: 0.019880000
NVD-IS: 3.6
NVD-ES: 3.9
CVE-2020-26876
DESCRIPTION: Exploit Observer has 6 entries in 3 file formats related to CVE-2020-26876. The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because show_in_rest is enabled for custom post types (e.g., /wp-json/wp/v2/course and /wp-json/wp/v2/lesson exist).
FIRST-EPSS: 0.019880000
NVD-IS: 3.6
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2020-14408
DESCRIPTION: Exploit Observer has 6 entries in 3 file formats related to CVE-2020-14408. An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login route allows for injection of arbitrary JavaScript code into a web page's content, creating a Reflected XSS attack vector.
FIRST-EPSS: 0.001130000
NVD-IS: 2.7
NVD-ES: 2.8
CVE-2020-14408
DESCRIPTION: Exploit Observer has 6 entries in 3 file formats related to CVE-2020-14408. An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login route allows for injection of arbitrary JavaScript code into a web page's content, creating a Reflected XSS attack vector.
FIRST-EPSS: 0.001130000
NVD-IS: 2.7
NVD-ES: 2.8
#ExploitObserverAlert
CVE-2023-51790
DESCRIPTION: Exploit Observer has 2 entries in 1 file formats related to CVE-2023-51790. Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in the Admin Tools plug-in component.
CVE-2023-51790
DESCRIPTION: Exploit Observer has 2 entries in 1 file formats related to CVE-2023-51790. Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in the Admin Tools plug-in component.
#ExploitObserverAlert
CVE-2019-13462
DESCRIPTION: Exploit Observer has 4 entries in 3 file formats related to CVE-2019-13462. Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.
FIRST-EPSS: 0.475050000
NVD-IS: 5.2
NVD-ES: 3.9
CVE-2019-13462
DESCRIPTION: Exploit Observer has 4 entries in 3 file formats related to CVE-2019-13462. Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.
FIRST-EPSS: 0.475050000
NVD-IS: 5.2
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2023-51063
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-51063. QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 was discovered to contain a DOM Based Reflected Cross Site Scripting (XSS) vulnerability within the component qnme-ajax?method=tree_level.
CVE-2023-51063
DESCRIPTION: Exploit Observer has 1 entries in 1 file formats related to CVE-2023-51063. QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 was discovered to contain a DOM Based Reflected Cross Site Scripting (XSS) vulnerability within the component qnme-ajax?method=tree_level.
#ExploitObserverAlert
GHSA-g273-wppx-82w4
DESCRIPTION: Exploit Observer has 3 entries in 2 file formats related to GHSA-G273-WPPX-82W4. An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure.
GHSS: 6.5
GHSA-g273-wppx-82w4
DESCRIPTION: Exploit Observer has 3 entries in 2 file formats related to GHSA-G273-WPPX-82W4. An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure.
GHSS: 6.5
#ExploitObserverAlert
CVE-2021-30497
DESCRIPTION: Exploit Observer has 5 entries in 3 file formats related to CVE-2021-30497. Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. The imageFilePath parameter processed by the /AvalancheWeb/image endpoint is not verified to be within the scope of the image folder, e.g., the attacker can obtain sensitive information via the C:/Windows/system32/config/system.sav value.
FIRST-EPSS: 0.963550000
NVD-IS: 3.6
NVD-ES: 3.9
CVE-2021-30497
DESCRIPTION: Exploit Observer has 5 entries in 3 file formats related to CVE-2021-30497. Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. The imageFilePath parameter processed by the /AvalancheWeb/image endpoint is not verified to be within the scope of the image folder, e.g., the attacker can obtain sensitive information via the C:/Windows/system32/config/system.sav value.
FIRST-EPSS: 0.963550000
NVD-IS: 3.6
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2023-38180
DESCRIPTION: Exploit Observer has 7 entries in 3 file formats related to CVE-2023-38180. .NET and Visual Studio Denial of Service Vulnerability
FIRST-EPSS: 0.010490000
NVD-IS: 3.6
NVD-ES: 3.9
CVE-2023-38180
DESCRIPTION: Exploit Observer has 7 entries in 3 file formats related to CVE-2023-38180. .NET and Visual Studio Denial of Service Vulnerability
FIRST-EPSS: 0.010490000
NVD-IS: 3.6
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2022-36883
DESCRIPTION: Exploit Observer has 5 entries in 3 file formats related to CVE-2022-36883. A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
FIRST-EPSS: 0.013280000
NVD-IS: 3.6
NVD-ES: 3.9
CVE-2022-36883
DESCRIPTION: Exploit Observer has 5 entries in 3 file formats related to CVE-2022-36883. A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
FIRST-EPSS: 0.013280000
NVD-IS: 3.6
NVD-ES: 3.9
#ExploitObserverAlert
CVE-2019-3912
DESCRIPTION: Exploit Observer has 3 entries in 3 file formats related to CVE-2019-3912. An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unauthenticated remote attacker to redirect users to arbitrary web sites.
FIRST-EPSS: 0.001600000
NVD-IS: 2.7
NVD-ES: 2.8
CVE-2019-3912
DESCRIPTION: Exploit Observer has 3 entries in 3 file formats related to CVE-2019-3912. An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unauthenticated remote attacker to redirect users to arbitrary web sites.
FIRST-EPSS: 0.001600000
NVD-IS: 2.7
NVD-ES: 2.8
#ExploitObserverAlert
CVE-2021-33807
DESCRIPTION: Exploit Observer has 6 entries in 3 file formats related to CVE-2021-33807. Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData.
FIRST-EPSS: 0.023310000
NVD-IS: 3.6
NVD-ES: 3.9
CVE-2021-33807
DESCRIPTION: Exploit Observer has 6 entries in 3 file formats related to CVE-2021-33807. Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData.
FIRST-EPSS: 0.023310000
NVD-IS: 3.6
NVD-ES: 3.9