‼ CVE-2023-2621 ‼
📖 Read
via "National Vulnerability Database".
The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computersystem. This vulnerability stems from the use of an outdated version of a third-party library, which is used to extract archives uploaded to McFeeder server. An authenticated malicious client canexploit this vulnerability by uploading a crafted ZIP archive via thenetwork to McFeeder’s service endpoint.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5514 ‼
📖 Read
via "National Vulnerability Database".
The response messages received from the eSOMS report generation using certain parameter queries with full file path can beabused for enumerating the local file system structure.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-47099 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Virtualmin 7.7. The Create Virtual Server functionality allows XSS attacks against anyone who accesses the Virtual Server Summary tab.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-47096 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Virtualmin 7.7. The Cloudmin Services Client under System Settings allows XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5889 ‼
📖 Read
via "National Vulnerability Database".
Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-47095 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Virtualmin 7.7. The Custom Fields feature of Edit Virtual Server under System Customization allows XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5893 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5894 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/ojs prior to 3.3.0-16.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-47094 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Virtualmin 7.7. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Account Plans tab of System Settings via the Plan Name field. Whenever the module is accessed, the XSS payload is executed.📖 Read
via "National Vulnerability Database".
🤯1
‼ CVE-2023-5516 ‼
📖 Read
via "National Vulnerability Database".
Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosinginformation about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical details like version Info, endpoints,backend server, Internal IP. etc., which can potentially expose additional attack surface containing other interesting vulnerabilities.📖 Read
via "National Vulnerability Database".
🦿 TechRepublic Premium Editorial Calendar: Policies, Checklists, Hiring Kits and Glossaries for Download 🦿
📖 Read
via "Tech Republic".
TechRepublic Premium content helps you solve your toughest IT issues and jump-start your career or next project.📖 Read
via "Tech Republic".
TechRepublic
TechRepublic Premium Editorial Calendar: Policies, Hiring Kits, and Glossaries for Download
TechRepublic Premium content helps you solve your toughest IT issues and jump-start your career or next project.
‼ CVE-2023-4198 ‼
📖 Read
via "National Vulnerability Database".
Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4197 ‼
📖 Read
via "National Vulnerability Database".
Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42636 ‼
📖 Read
via "National Vulnerability Database".
In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1718 ‼
📖 Read
via "National Vulnerability Database".
Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause denial-of-service via a crafted "tmp_url".📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42638 ‼
📖 Read
via "National Vulnerability Database".
In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42750 ‼
📖 Read
via "National Vulnerability Database".
In gnss service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed📖 Read
via "National Vulnerability Database".
‼ CVE-2022-48460 ‼
📖 Read
via "National Vulnerability Database".
In setting service, there is a possible undefined behavior due to incorrect error handling. This could lead to local denial of service with no additional execution privileges needed📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42642 ‼
📖 Read
via "National Vulnerability Database".
In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1719 ‼
📖 Read
via "National Vulnerability Database".
Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialised variables.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42645 ‼
📖 Read
via "National Vulnerability Database".
In sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed📖 Read
via "National Vulnerability Database".