IBM App Connect Enterprise information disclosure

IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IBM X-Force ID: 288176.

Openfind Mail2000 - XSS (Reflected Cross-site scripting)

Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function. A remote attacker can exploit this vulnerability using phishing emails that contain malicious web pages injected with JavaScript. When users access the system and open the email, it triggers an XSS (Reflected Cross-site scripting) attack.

Hitron Technologies Inc. CODA-5310 - Using default credentials

Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt to ask users to change the default password and account. An unauthenticated remote attackers can exploit this vulnerability to obtain the administrator’s privilege, resulting in performing arbitrary system operation or disrupt service.

IBM App Connect Enterprise information disclosure

IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IBM X-Force ID: 288175.

Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass

Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.

Improper Access Control in nilsteampassnet/teampass

Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.

The Progress MOVEit Automation Configuration Export Function Uses a Cryptographic Method with Insufficient Bit Length

The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length.

IBM Aspera information disclosure

IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

IBM Aspera buffer overflow

IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 is vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the system. IBM X-Force ID: 248625.

Cross-site Scripting (XSS) - Stored in zadam/trilium

Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4.

Unverified Password Change in tsolucio/corebos

Unverified Password Change in GitHub repository tsolucio/corebos prior to 8.

Cross-site Scripting (XSS) - Stored in tsolucio/corebos

Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.

Cross-site Scripting (XSS) - Stored in tsolucio/corebos

Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.

Cross-site Scripting (XSS) - Stored in tsolucio/corebos

Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8 via evvtgendoc.

Cross-site Scripting (XSS) - Stored in tsolucio/corebos

Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.

python-reportlab: remote code execution via supplying a crafted PDF file

Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.

A buffer overflow in EasyPlayerPro-Win v3.2.19.0106 to v3.6.19.0823 allows attackers to cause a Denial of Service (DoS) via a crafted XML file.

Advent/SSC Inc. Tamale RMS < 23.1 is vulnerable to Directory Traversal. If one traverses to the affected URL, one enumerates Contact information on the host which contains usernames, e-mail addresses, and other internal information stored within the web app.

emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request.

Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on the Customer Name field in the Accounting module that is used to construct a CSV file.