CVE-2023-4110

PHP Jabbers Availability Booking Calendar index.php cross site scripting

A vulnerability has been found in PHP Jabbers Availability Booking Calendar 5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument session_id leads to cross site scripting. The attack can be launched remotely. The identifier VDB-235957 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS 1.8% KEV · Not listed

Vendors

Phpjabbers

Products

Availability Booking Calendar

CVE-2023-4108

Audit logging fails to sanitize post metadata

Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost

CVE-2023-4107

Incorrect authorization allows a user manager to update a system admin

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost

CVE-2023-4106

A guest user can perform various actions on public playbooks

Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost

CVE-2023-4105

Attachment of deleted message in a thread remains accessible and downloadable

Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost

CVE-2023-4103

Multiple vulnerabilities in IDM Sistemas QSige

QSige statistics are affected by a remote SQLi vulnerability. It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Qsige

Products

Qsige

CVE-2023-4102

Multiple vulnerabilities in IDM Sistemas QSige

QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Qsige

Products

Qsige

CVE-2023-4101

Multiple vulnerabilities in IDM Sistemas QSige

The QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Qsige

Products

Qsige

CVE-2023-4100

Multiple vulnerabilities in IDM Sistemas QSige

Allows an attacker to perform XSS attacks stored on certain resources. Exploiting this vulnerability can lead to a DoS condition, among other actions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qsige

Products

Qsige

CVE-2023-4099

Multiple vulnerabilities in IDM Sistemas QSige

The QSige Monitor application does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Qsige

Products

Qsige

CVE-2023-4098

Multiple vulnerabilities in IDM Sistemas QSige

It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Qsige

Products

Qsige

CVE-2023-4097

Multiple vulnerabilities in IDM Sistemas QSige

The file upload functionality is not implemented correctly and allows uploading of any type of file. As a prerequisite, it is necessary for the attacker to log into the application with a valid username.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Qsige

Products

Qsige

CVE-2023-4096

Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea

Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force attack on the emailed PIN number in order to change the password of a legitimate user.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Fujitsu

Products

Arconte Aurea

CVE-2023-4095

User enumeration vulnerability in Fujitsu Arconte Áurea

User enumeration vulnerability in Arconte Áurea 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to obtain a list of registered users in the application, obtaining the necessary information to perform more complex attacks on the platform.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Fujitsu

Products

Arconte Aurea

CVE-2023-4094

Weak authentication vulnerability in Fujitsu Arconte Áurea

ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate account and cause a denial of service. In addition, a resource has been identified that could allow circumventing the attempt limit set in the login form.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fujitsu

Products

Arconte Aurea

CVE-2023-4093

Reflected and persistent XSS vulnerability in Fujitsu Arconte Áurea

Reflected and persistent XSS vulnerability in Arconte Áurea, in its 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to inject malicious JavaScript code, compromise the victim's browser and take control of it, redirect the user to malicious domains or access information being viewed by the legitimate user.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fujitsu

Products

Arconte Aurea

CVE-2023-4092

SQL injection vulnerability in Fujitsu Arconte Áurea

SQL injection vulnerability in Arconte Áurea, in its 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to read sensitive data from the database, modify data (insert/update/delete), perform database administration operations and, in some cases, execute commands on the operating system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Fujitsu

Products

Arconte Aurea

CVE-2023-4090

Cross-Site Scripting (XSS) vulnerability on WideStand CMS of Acilia

Cross-site Scripting (XSS) reflected vulnerability on WideStand until 5.3.5 version, which generates one of the meta tags directly using the content of the queried URL, which would allow an attacker to inject HTML/Javascript code into the response.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Acilia

Products

Widestand

CVE-2023-4088

Malicious Code Execution Vulnerability in FA Engineering Software Products

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Mitsubishielectric

Products

Gx Works3

CVE-2023-4057

Mozilla: Memory safety bugs fixed in Firefox ESR 115.1, and Thunderbird 115.1

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 5 more