CVE-2023-4983

app1pro Shopicial search cross site scripting

A vulnerability was found in app1pro Shopicial up to 20230830. It has been declared as problematic. This vulnerability affects unknown code of the file search. The manipulation of the argument from with the input comments</script>'"><img src=x onerror=alert(document.cookie)> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-239794 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

App1pro

Products

Shopicial

CVE-2023-4982

Cross-site Scripting (XSS) - Stored in librenms/librenms

Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 23.9.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Librenms

Products

Librenms

CVE-2023-4981

Cross-site Scripting (XSS) - DOM in librenms/librenms

Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Librenms

Products

Librenms

CVE-2023-4980

Cross-site Scripting (XSS) - Generic in librenms/librenms

Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Librenms

Products

Librenms

CVE-2023-4979

Cross-site Scripting (XSS) - Reflected in librenms/librenms

Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.9.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Librenms

Products

Librenms

CVE-2023-4978

Cross-site Scripting (XSS) - DOM in librenms/librenms

Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Librenms

Products

Librenms

CVE-2023-4977

Code Injection in librenms/librenms

Code Injection in GitHub repository librenms/librenms prior to 23.9.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Librenms

Products

Librenms

CVE-2023-4974

Academy LMS GET Parameter filter sql injection

A vulnerability was found in Academy LMS 6.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument price_min/price_max leads to sql injection. The attack may be launched remotely. VDB-239750 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS 5.3% KEV · Not listed

Vendors

Creativeitem

Products

Academy Lms

CVE-2023-4973

Academy LMS GET Parameter filter cross site scripting

A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument searched_word/searched_tution_class_type[]/searched_price_type[]/searched_duration[] leads to cross site scripting. The attack can be launched remotely. The identifier VDB-239749 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS 1.9% KEV · Not listed

Vendors

Creativeitem Microsoft

Products

Academy Lms Windows

CVE-2023-4970

PubyDoc <= 2.0.6 - Admin+ Stored XSS

The PubyDoc WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Pubydoc

Products

Pubydoc

CVE-2023-4965

phpipam Header redirect

A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Handler. The manipulation of the argument X-Forwarded-Host leads to open redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239732.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Phpipam

Products

Phpipam

CVE-2023-4964

Potential open redirect vulnerability in opentext SMAX and AMX product.

Potential open redirect vulnerability in opentext Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11 and opentext Asset Management X (AMX) versions 2021.08, 2021.11, 2022.05, 2022.11. The vulnerability could allow attackers to redirect a user to malicious websites.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Microfocus

Products

Asset Management X Service Management Automation X

CVE-2023-4958

Stackrox: missing http security headers allows for clickjacking in web ui

In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Advanced Cluster Security

CVE-2023-4951

Cross Site Scripting (XSS) Issue on "Client Based Authentication Policy Configuration" Screen

A cross site scripting issue was discovered with the pagination function on the "Client-based Authentication Policy Configuration" screen of the GreenRADIUS web admin interface. This issue is found in GreenRADIUS v5.1.1.1 and prior. A fix was included in v5.1.2.2.

CVSS 3.1 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Greenrocketsecurity

Products

Greenradius

CVE-2023-4949

Memory Corruption Vulnerability in Grub-Legacy's XFS Implementation

An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory corruption in grub’s XFS file system implementation.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Gnu Xen

Products

Grub Xen

CVE-2023-4933

WP Job Openings < 3.4.3 - Sensitive Data Exposure via Directory Listing

The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Awsm

Products

Wp Job Openings

CVE-2023-4932

Reflected Cross-Site Scripting in SAS 9.4

SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SASStoredProcess/do` endpoint allows arbitrary JavaScript to be executed when specially crafted URL is opened by an authenticated user. The attack is possible from a low-privileged user. Only versions 9.4_M7 and 9.4_M8 were tested and confirmed to be vulnerable, status of others is unknown. For above mentioned versions hot fixes were published.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sas

Products

Integration Technologies

CVE-2023-4931

Uncontrolled search path element vulnerability in Plesk

Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon.dll, sspicli.dll, propsys.dll and profapi.dll files.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Plesk

Products

Plesk

CVE-2023-4929

NPort 5000 Series Firmware Improper Validation of Integrity Check Vulnerability

All firmware versions of the NPort 5000 Series are affected by an improper validation of integrity check vulnerability. This vulnerability results from insufficient checks on firmware updates or upgrades, potentially allowing malicious users to manipulate the firmware and gain control of devices.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Moxa

Products

Nport 5100 Nport 5100a Nport 5100ai M12 and 224 more

CVE-2023-4928

SQL Injection in instantsoft/icms2

SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Instantcms

Products

Icms2