CVE-2023-2385

Netgear SRX5308 Web Management Interface cross site scripting

A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been rated as problematic. This issue affects some unknown processing of the file scgi-bin/platform.cgi?page=ike_policies.htm of the component Web Management Interface. The manipulation of the argument IpsecIKEPolicy.IKEPolicyName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227663. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Srx5308 Srx5308 Firmware

CVE-2023-2384

Netgear SRX5308 Web Management Interface cross site scripting

A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been declared as problematic. This vulnerability affects unknown code of the file scgi-bin/platform.cgi?page=dmz_setup.htm of the component Web Management Interface. The manipulation of the argument dhcp.SecDnsIPByte2 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227662 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Srx5308 Srx5308 Firmware

CVE-2023-2382

Netgear SRX5308 Web Management Interface cross site scripting

A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this issue is some unknown functionality of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument sysLogInfo.serverName leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227660. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Srx5308 Srx5308 Firmware

CVE-2023-2381

Netgear SRX5308 Web Management Interface cross site scripting

A vulnerability has been found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file scgi-bin/platform.cgi?page=bandwidth_profile.htm of the component Web Management Interface. The manipulation of the argument BandWidthProfile.ProfileName leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227659. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Srx5308 Srx5308 Firmware

CVE-2023-2380

Netgear SRX5308 denial of service

A vulnerability, which was classified as problematic, was found in Netgear SRX5308 up to 4.3.5-3. Affected is an unknown function. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-227658 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Netgear

Products

Srx5308 Srx5308 Firmware

CVE-2023-2372

SourceCodester Online DJ Management System cross site scripting

A vulnerability, which was classified as problematic, has been found in SourceCodester Online DJ Management System 1.0. Affected by this issue is some unknown functionality of the file classes/Master.php?f=save_event. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227648.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Online Dj Management System Project

Products

Online Dj Management System

CVE-2023-2370

SourceCodester Online DJ Management System GET Parameter manage_event.php sql injection

A vulnerability classified as critical has been found in SourceCodester Online DJ Management System 1.0. Affected is an unknown function of the file admin/events/manage_event.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-227646 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Online Dj Management System Project

Products

Online Dj Management System

CVE-2023-2369

SourceCodester Faculty Evaluation System manage_restriction.php sql injection

A vulnerability was found in SourceCodester Faculty Evaluation System 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/manage_restriction.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227645 was assigned to this vulnerability.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Faculty Evaluation System Project

Products

Faculty Evaluation System

CVE-2023-2368

SourceCodester Faculty Evaluation System sql injection

A vulnerability was found in SourceCodester Faculty Evaluation System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file index.php?page=manage_questionnaire. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227644.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Faculty Evaluation System Project

Products

Faculty Evaluation System

CVE-2023-2366

SourceCodester Faculty Evaluation System sql injection

A vulnerability was found in SourceCodester Faculty Evaluation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file ajax.php?action=delete_class. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227642 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Faculty Evaluation System Project

Products

Faculty Evaluation System

CVE-2023-2365

SourceCodester Faculty Evaluation System sql injection

A vulnerability has been found in SourceCodester Faculty Evaluation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file ajax.php?action=delete_subject. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227641 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Faculty Evaluation System Project

Products

Faculty Evaluation System

CVE-2023-2364

SourceCodester Resort Reservation System registration.php cross site scripting

A vulnerability, which was classified as problematic, was found in SourceCodester Resort Reservation System 1.0. Affected is an unknown function of the file registration.php. The manipulation of the argument fullname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227640.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Resort Reservation System Project

Products

Resort Reservation System

CVE-2023-2363

SourceCodester Resort Reservation System view_room.php sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Resort Reservation System 1.0. This issue affects some unknown processing of the file view_room.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227639.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Resort Reservation System Project

Products

Resort Reservation System

CVE-2023-2358

Hitachi Vantara Pentaho Business Analytics Server – Password Stored in a Recoverable Format

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in plaintext. 

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hitachivantara

Products

Pentaho Business Analytics

CVE-2023-2350

SourceCodester Service Provider Management System Users.php cross site scripting

A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227593 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Service Provider Management System

CVE-2023-2348

SourceCodester Service Provider Management System manage_user.php sql injection

A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227591.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Service Provider Management System

CVE-2023-2347

SourceCodester Service Provider Management System manage_service.php sql injection

A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/services/manage_service.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227590 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Service Provider Management System

CVE-2023-2346

SourceCodester Service Provider Management System view_inquiry.php sql injection

A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227589 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Service Provider Management System

CVE-2023-2344

SourceCodester Service Provider Management System HTTP POST Request sql injection

A vulnerability has been found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=save_service of the component HTTP POST Request Handler. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227587.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Service Provider Management System

CVE-2023-2330

Caldera Forms Google Sheets Connector < 1.3 - Access Code Update via CSRF

The Caldera Forms Google Sheets Connector WordPress plugin before 1.3 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Gsheetconnector

Products

Caldera Forms Google Sheets Connector