CVE-2023-4119

Academy LMS courses cross site scripting

A vulnerability has been found in Academy LMS 6.0 and classified as problematic. This vulnerability affects unknown code of the file /academy/home/courses. The manipulation of the argument query/sort_by leads to cross site scripting. The attack can be initiated remotely. VDB-235966 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.3 Medium EPSS 3.8% KEV · Not listed

Vendors

Creativeitem

Products

Academy Lms

CVE-2023-4117

PHP Jabbers Rental Property Booking index.php cross site scripting

A vulnerability, which was classified as problematic, has been found in PHP Jabbers Rental Property Booking 2.0. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-235964. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.3 Medium EPSS 3.1% KEV · Not listed

Vendors

Phpjabbers

Products

Rental Property Booking Calendar

CVE-2023-4116

PHP Jabbers Taxi Booking index.php cross site scripting

A vulnerability classified as problematic was found in PHP Jabbers Taxi Booking 2.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235963. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.3 Medium EPSS 8.4% KEV · Not listed

Vendors

Phpjabbers

Products

Taxi Booking Script

CVE-2023-4114

PHP Jabbers Night Club Booking Software index.php cross site scripting

A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-235961 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.3 Medium EPSS 8.3% KEV · Not listed

Vendors

Phpjabbers

Products

Night Club Booking Software

CVE-2023-4113

PHP Jabbers Service Booking Script index.php cross site scripting

A vulnerability was found in PHP Jabbers Service Booking Script 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-235960. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.3 Medium EPSS 8.4% KEV · Not listed

Vendors

Phpjabbers

Products

Service Booking Script

CVE-2023-4112

PHP Jabbers Shuttle Booking Software index.php cross site scripting

A vulnerability was found in PHP Jabbers Shuttle Booking Software 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-235959. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.3 Medium EPSS 8.4% KEV · Not listed

Vendors

Phpjabbers

Products

Shuttle Booking Software

CVE-2023-4111

PHP Jabbers Bus Reservation System index.php cross site scripting

A vulnerability was found in PHP Jabbers Bus Reservation System 1.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument index/pickup_id leads to cross site scripting. The attack may be launched remotely. VDB-235958 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.3 Medium EPSS 2.5% KEV · Not listed

Vendors

Phpjabbers

Products

Bus Reservation System

CVE-2023-4110

PHP Jabbers Availability Booking Calendar index.php cross site scripting

A vulnerability has been found in PHP Jabbers Availability Booking Calendar 5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument session_id leads to cross site scripting. The attack can be launched remotely. The identifier VDB-235957 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS 1.8% KEV · Not listed

Vendors

Phpjabbers

Products

Availability Booking Calendar

CVE-2023-4108

Audit logging fails to sanitize post metadata

Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost

CVE-2023-4107

Incorrect authorization allows a user manager to update a system admin

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost

CVE-2023-4106

A guest user can perform various actions on public playbooks

Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost

CVE-2023-4105

Attachment of deleted message in a thread remains accessible and downloadable

Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost

CVE-2023-4103

Multiple vulnerabilities in IDM Sistemas QSige

QSige statistics are affected by a remote SQLi vulnerability. It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Qsige

Products

Qsige

CVE-2023-4102

Multiple vulnerabilities in IDM Sistemas QSige

QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Qsige

Products

Qsige

CVE-2023-4101

Multiple vulnerabilities in IDM Sistemas QSige

The QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Qsige

Products

Qsige

CVE-2023-4100

Multiple vulnerabilities in IDM Sistemas QSige

Allows an attacker to perform XSS attacks stored on certain resources. Exploiting this vulnerability can lead to a DoS condition, among other actions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qsige

Products

Qsige

CVE-2023-4099

Multiple vulnerabilities in IDM Sistemas QSige

The QSige Monitor application does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Qsige

Products

Qsige

CVE-2023-4098

Multiple vulnerabilities in IDM Sistemas QSige

It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Qsige

Products

Qsige

CVE-2023-4097

Multiple vulnerabilities in IDM Sistemas QSige

The file upload functionality is not implemented correctly and allows uploading of any type of file. As a prerequisite, it is necessary for the attacker to log into the application with a valid username.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Qsige

Products

Qsige

CVE-2023-4096

Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea

Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force attack on the emailed PIN number in order to change the password of a legitimate user.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Fujitsu

Products

Arconte Aurea