CyberAlerts

CVE-2023-7299

Description: A vulnerability was found in DataGear up to 4.60. It has been declared as critical. This vulnerability affects unknown code of the file /dataSet/resolveSql. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. Upgrading to version 4.7.0 is able to address this issue. It is recommended to upgrade the affected component. In DataGear bis 4.60 wurde eine Schwachstelle ausgemacht. Sie wurde als kritisch eingestuft. Dabei geht es um eine nicht genauer bekannte Funktion der Datei /dataSet/resolveSql. Durch Beeinflussen des Arguments sql mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Ein Aktualisieren auf die Version 4.7.0 vermag dieses Problem zu lösen. Als bestmögliche Massnahme wird das Einspielen eines Upgrades empfohlen.

CVSS: MEDIUM (5.3)

EPSS Score: 0.06%

Source: CVE

November 27th, 2024 (5 months ago)

CVE-2023-49587

Command Injection vulnerability in SAP Solution Manager

Description: SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other component without user interaction over the network.

CVSS: MEDIUM (6.4)

EPSS Score: 0.05%

Source: CVE

November 27th, 2024 (5 months ago)

CVE-2023-49215

Description: Usedesk before 1.7.57 allows filter reflected XSS.

CVSS: MEDIUM (6.1)

EPSS Score: 0.06%

Source: CVE

November 27th, 2024 (5 months ago)

CVE-2023-48880

Description: A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu Name field at /login.php?m=admin&c=Index&a=changeTableVal&_ajax=1&lang=cn.

CVSS: MEDIUM (4.8)

EPSS Score: 0.05%

Source: CVE

November 27th, 2024 (5 months ago)

CVE-2023-48836

Description: Car Rental Script 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter.

CVSS: MEDIUM (5.4)

EPSS Score: 0.07%

Source: CVE

November 27th, 2024 (5 months ago)

CVE-2023-48208

Description: A Cross Site Scripting vulnerability in Availability Booking Calendar 5.0 allows an attacker to inject JavaScript via the name, plugin_sms_api_key, plugin_sms_country_code, uuid, title, or country name parameter to index.php.

CVSS: MEDIUM (6.1)

EPSS Score: 0.08%

Source: CVE

November 27th, 2024 (5 months ago)

CVE-2023-48198

Description: A Cross-Site Scripting (XSS) vulnerability in the 'product description' component within '/api/stock/products' of Grocy version <= 4.0.3 allows attackers to obtain a victim's cookies.

CVSS: MEDIUM (5.4)

EPSS Score: 0.05%

Source: CVE

November 27th, 2024 (5 months ago)

CVE-2023-42479

Cross-Site Scripting (XSS) vulnerability in SAP Biller Direct

Description: An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting request to the Biller Direct system. This can result in the disclosure or modification of non-sensitive information.

CVSS: MEDIUM (6.1)

EPSS Score: 0.08%

Source: CVE

November 27th, 2024 (5 months ago)

CVE-2023-37360

Description: pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL (which may be realistic within enterprise security products).

CVSS: MEDIUM (5.9)

EPSS Score: 0.07%

Source: CVE

November 27th, 2024 (5 months ago)

CVE-2023-37237

Description: In Veritas NetBackup Appliance before 4.1.0.1 MR3, insecure permissions may allow an authenticated Admin to bypass shell restrictions and execute arbitrary operating system commands via SSH.

CVSS: MEDIUM (6.5)

EPSS Score: 0.15%

Source: CVE

November 27th, 2024 (5 months ago)

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2023-7299	DataGear resolveSql sql injection Description: A vulnerability was found in DataGear up to 4.60. It has been declared as critical. This vulnerability affects unknown code of the file /dataSet/resolveSql. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. Upgrading to version 4.7.0 is able to address this issue. It is recommended to upgrade the affected component. In DataGear bis 4.60 wurde eine Schwachstelle ausgemacht. Sie wurde als kritisch eingestuft. Dabei geht es um eine nicht genauer bekannte Funktion der Datei /dataSet/resolveSql. Durch Beeinflussen des Arguments sql mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Ein Aktualisieren auf die Version 4.7.0 vermag dieses Problem zu lösen. Als bestmögliche Massnahme wird das Einspielen eines Upgrades empfohlen. CVSS: MEDIUM (5.3) EPSS Score: 0.06% Source: CVE November 27th, 2024 (5 months ago)
CVE-2023-49587	Command Injection vulnerability in SAP Solution Manager Description: SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other component without user interaction over the network. CVSS: MEDIUM (6.4) EPSS Score: 0.05% Source: CVE November 27th, 2024 (5 months ago)
CVE-2023-49215	Description: Usedesk before 1.7.57 allows filter reflected XSS. CVSS: MEDIUM (6.1) EPSS Score: 0.06% Source: CVE November 27th, 2024 (5 months ago)
CVE-2023-48880	Description: A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu Name field at /login.php?m=admin&c=Index&a=changeTableVal&_ajax=1&lang=cn. CVSS: MEDIUM (4.8) EPSS Score: 0.05% Source: CVE November 27th, 2024 (5 months ago)
CVE-2023-48836	Description: Car Rental Script 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter. CVSS: MEDIUM (5.4) EPSS Score: 0.07% Source: CVE November 27th, 2024 (5 months ago)
CVE-2023-48208	Description: A Cross Site Scripting vulnerability in Availability Booking Calendar 5.0 allows an attacker to inject JavaScript via the name, plugin_sms_api_key, plugin_sms_country_code, uuid, title, or country name parameter to index.php. CVSS: MEDIUM (6.1) EPSS Score: 0.08% Source: CVE November 27th, 2024 (5 months ago)
CVE-2023-48198	Description: A Cross-Site Scripting (XSS) vulnerability in the 'product description' component within '/api/stock/products' of Grocy version <= 4.0.3 allows attackers to obtain a victim's cookies. CVSS: MEDIUM (5.4) EPSS Score: 0.05% Source: CVE November 27th, 2024 (5 months ago)
CVE-2023-42479	Cross-Site Scripting (XSS) vulnerability in SAP Biller Direct Description: An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting request to the Biller Direct system. This can result in the disclosure or modification of non-sensitive information. CVSS: MEDIUM (6.1) EPSS Score: 0.08% Source: CVE November 27th, 2024 (5 months ago)
CVE-2023-37360	Description: pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL (which may be realistic within enterprise security products). CVSS: MEDIUM (5.9) EPSS Score: 0.07% Source: CVE November 27th, 2024 (5 months ago)
CVE-2023-37237	Description: In Veritas NetBackup Appliance before 4.1.0.1 MR3, insecure permissions may allow an authenticated Admin to bypass shell restrictions and execute arbitrary operating system commands via SSH. CVSS: MEDIUM (6.5) EPSS Score: 0.15% Source: CVE November 27th, 2024 (5 months ago)