Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
395 results · page 6 of 8
Apr 15, 2024iTop is an IT service management platform.CVE-2023-48710 · Other software · Combodo · reported by GitHubCritical 9.8
iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. The `pages/exec.php` script as been fixed to limit execution of PHP files only. Other file types won't be retrieved and exposed. The vulnerability is fixed in 2.7.10, 3.0.4, 3.1.1, and 3.2.0.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-48709 · Other software · Combodo · reported by GitHubHigh 8
iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does **not** prevent Remote Code Execution by default, uninformed users may become victims. This vulnerability is fixed in 2.7.9, 3.0.4, 3.1.1, and 3.2.0.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-47626 · Other software · Combodo · reported by GitHubHigh 8.8
iTop is an IT service management platform. When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-47622 · Other software · Combodo · reported by GitHubHigh 8.8
iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is fixed in 3.0.4 and 3.1.1.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-47123 · Other software · Combodo · reported by GitHubHigh 8.7
iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixed in 3.1.1 and 3.2.0.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-45808 · Other software · Combodo · reported by GitHubMedium 4.1
iTop is an IT service management platform. When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, by forging an http request, the user can create objects pointing to out of silo objects (for example a UserRequest in an out of scope Organization). Fixed in iTop 2.7.10, 3.0.4, 3.1.1, and 3.2.0.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-44396 · Other software · Combodo · reported by GitHubMedium 6.8
iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-43790 · Other software · Combodo · reported by GitHubMedium 5.7
iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024iTop is an IT service management platform.CVE-2023-38511 · Other software · Combodo · reported by GitHubMedium 5
iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2024A vulnerability was found in Xiamen Four-Faith RMP Router Management Platform 5.2.2.CVE-2024-3688 · Other software · Xiamen Four-Faith · reported by VulDBMedium 6.3
A vulnerability was found in Xiamen Four-Faith RMP Router Management Platform 5.2.2. It has been declared as critical. This vulnerability affects unknown code of the file /Device/Device/GetDeviceInfoList?deviceCode=&searchField=&deviceState=. The manipulation of the argument groupId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260476. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RMP Router Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024A vulnerability was found in Byzoro Smart S80 Management Platform up to 20240317.CVE-2024-3521 · Other software · Byzoro · reported by VulDBMedium 4.7
A vulnerability was found in Byzoro Smart S80 Management Platform up to 20240317. It has been rated as critical. Affected by this issue is some unknown functionality of the file /useratte/userattestation.php. The manipulation of the argument web_img leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259892. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S80 Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024File Upload vulnerability in Byzoro Networks Smart multi-service security gateway intelligent management platform version S210, allows an attacker to obtain senCVE-2024-28520 · Other software · byzoro · reported by MITREMedium 6.5
File Upload vulnerability in Byzoro Networks Smart multi-service security gateway intelligent management platform version S210, allows an attacker to obtain sensitive information via the uploadfile.php component.
- Product
- smart_s210_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2024Pimcore is an Open Source Data & Experience Management Platform.CVE-2024-29197 · Other software · pimcore · reported by GitHubMedium 6.5
Pimcore is an Open Source Data & Experience Management Platform. Any call with the query argument `?pimcore_preview=true` allows to view unpublished sites. In previous versions of Pimcore, session information would propagate to previews, so only a logged in user could open a preview. This no longer applies. Previews are broad open to any user and with just the hint of a restricted link one could gain access to possible confident / unreleased information. This vulnerability is fixed in 11.2.2 and 11.1.6.1.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2024An open redirect in the Login/Logout functionality of web management in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS could allow attackers to reCVE-2024-25657 · Other software · avsystem · reported by MITREMedium 5.4
An open redirect in the Login/Logout functionality of web management in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS could allow attackers to redirect authenticated users to malicious websites.
- Product
- unified_management_platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcvcn.gov.itcvcn.gov.it
Mar 18, 2024Improper input validation in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS can result in unauthenticated CPE (Customer Premises Equipment) deviceCVE-2024-25656 · Other software · avsystem · reported by MITREMedium 5.9
Improper input validation in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS can result in unauthenticated CPE (Customer Premises Equipment) devices storing arbitrarily large amounts of data during registration. This can potentially lead to DDoS attacks on the application database and, ultimately, affect the entire product.
- Product
- unified_management_platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcvcn.gov.itcvcn.gov.it
Mar 18, 2024Insecure storage of LDAP passwords in the authentication functionality of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allows members (with readCVE-2024-25655 · Other software · avsystem · reported by MITREMedium 6.5
Insecure storage of LDAP passwords in the authentication functionality of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allows members (with read access to the application database) to decrypt the LDAP passwords of users who successfully authenticate to web management via LDAP.
- Product
- unified_management_platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcvcn.gov.itcvcn.gov.it
Mar 18, 2024Insecure permissions for log files of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allow members (with local access to the UMP application serveCVE-2024-25654 · Other software · Avsystem · reported by MITREMedium 5.5
Insecure permissions for log files of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allow members (with local access to the UMP application server) to access credentials to authenticate to all services, and to decrypt sensitive data stored in the database.
- Product
- Unified Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcvcn.gov.itcvcn.gov.it
Mar 7, 2024File Upload vulnerability in Byzro Network Smart s42 Management Platform v.S42 allows a local attacker to execute arbitrary code via the useratte/userattestatioCVE-2024-27733 · Other software · byzronetwork · reported by MITREHigh 7.7
File Upload vulnerability in Byzro Network Smart s42 Management Platform v.S42 allows a local attacker to execute arbitrary code via the useratte/userattestation.php component.
- Product
- management_platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2024SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information and escalate privilCVE-2024-27718 · Other software · byzronetwork · reported by MITREHigh 7.8
SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information and escalate privileges via the /importexport.php component.
- Product
- management_platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors.CVE-2024-0560 · Other software · Red Hat · reported by Red HatMedium 6.3
A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Token Introspection policy discovers the Token Introspection endpoint from the token_introspection_endpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid.
- Product
- Red Hat 3scale API Management Platform 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Feb 27, 2024A vulnerability has been found in Byzoro Smart S42 Management Platform up to 20240219 and classified as critical.CVE-2024-1918 · Other software · Byzoro · reported by VulDBMedium 4.7
A vulnerability has been found in Byzoro Smart S42 Management Platform up to 20240219 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /useratte/userattestation.php. The manipulation of the argument hidwel leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254839. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S42 Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024Graylog is a free and open log management platform.CVE-2024-24824 · Other software · Graylog2 · reported by GitHubHigh 8.8
Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the `/api/system/cluster_config/` endpoint. Graylog's cluster config system uses fully qualified class names as config keys. To validate the existence of the requested class before using them, Graylog loads the class using the class loader. If a user with the appropriate permissions performs the request, arbitrary classes with 1-arg String constructors can be instantiated. This will execute arbitrary code that is run during class instantiation. In the specific use case of `java.io.File`, the behavior of the internal web-server stack will lead to information exposure by including the entire file content in the response to the REST request. Versions 5.1.11 and 5.2.4 contain a fix for this issue.
- Product
- graylog2-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024Graylog is a free and open log management platform.CVE-2024-24823 · Other software · Graylog2 · reported by GitHubMedium 5.7
Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing session cookie would re-use that session id, even if for different user credentials. In this case, the pre-existing session could be used to gain elevated access to an existing Graylog login session, provided the malicious user could successfully inject their session cookie into someone else's browser. The complexity of such an attack is high, because it requires presenting a spoofed login screen and injection of a session cookie into an existing browser, potentially through a cross-site scripting attack. No such attack has been discovered. Graylog 5.1.11 and 5.2.4, and any versions of the 6.0 development branch, contain patches to not re-use sessions under any circumstances. Some workarounds are available. Using short session expiration and explicit log outs of unused sessions can help limiting the attack vector. Unpatched this vulnerability exists, but is relatively hard to exploit. A proxy could be leveraged to clear the `authentication` cookie for the Graylog server URL for the `/api/system/sessions` endpoint, as that is the onl
- Product
- graylog2-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024A vulnerability, which was classified as critical, was found in Byzoro Smart S20 Management Platform up to 20231120.CVE-2024-1254 · Other software · Byzoro · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, was found in Byzoro Smart S20 Management Platform up to 20231120. This affects an unknown part of the file /sysmanage/sysmanageajax.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252993 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S20 Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024A vulnerability, which was classified as critical, has been found in Byzoro Smart S40 Management Platform up to 20240126.CVE-2024-1253 · Other software · Byzoro · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, has been found in Byzoro Smart S40 Management Platform up to 20240126. Affected by this issue is some unknown functionality of the file /useratte/web.php of the component Import Handler. The manipulation of the argument file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252992. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S40 Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2024A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical.CVE-2024-0939 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252184. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S210 Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024A vulnerability classified as problematic has been found in Byzoro Smart S150 Management Platform V31R02B15.CVE-2024-0716 · Other software · Byzoro · reported by VulDBLow 3.1
A vulnerability classified as problematic has been found in Byzoro Smart S150 Management Platform V31R02B15. This affects an unknown part of the file /log/download.php of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-251541 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S150 Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024A vulnerability was found in Byzoro Smart S150 Management Platform V31R02B15.CVE-2024-0712 · Other software · Byzoro · reported by VulDBHigh 7.3
A vulnerability was found in Byzoro Smart S150 Management Platform V31R02B15. It has been classified as critical. Affected is an unknown function of the file /useratte/inc/userattea.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-251538 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S150 Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024A vulnerability was found in Byzoro Smart S150 Management Platform up to 20240101.CVE-2024-0300 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability was found in Byzoro Smart S150 Management Platform up to 20240101. It has been rated as critical. Affected by this issue is some unknown functionality of the file /useratte/userattestation.php of the component HTTP POST Request Handler. The manipulation of the argument web_img leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249866 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S150 Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail deliver-related URL.CVE-2023-48382 · Other software · Softnext · reported by twcert@cert.org.twMedium 6.5
Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail deliver-related URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability.
- Product
- Mail SQR Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 15, 2023Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a special URL.CVE-2023-48381 · Other software · Softnext · reported by twcert@cert.org.twMedium 6.5
Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a special URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability.
- Product
- Mail SQR Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 15, 2023Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function.CVE-2023-48380 · Other software · Softnext · reported by twcert@cert.org.twHigh 7.4
Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A remote attacker authenticated as a localhost can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service.
- Product
- Mail SQR Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 15, 2023Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function.CVE-2023-48379 · Other software · Softnext · reported by twcert@cert.org.twMedium 5.3
Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.
- Product
- Mail SQR Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 15, 2023Pimcore is an Open Source Data & Experience Management Platform.CVE-2023-47637 · Other software · pimcore · reported by GitHubHigh 8.8
Pimcore is an Open Source Data & Experience Management Platform. In affected versions the `/admin/object/grid-proxy` endpoint calls `getFilterCondition()` on fields of classes to be filtered for, passing input from the request, and later executes the returned SQL. One implementation of `getFilterCondition()` is in `Multiselect`, which does not normalize/escape/validate the passed value. Any backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level. This vulnerability has been addressed in version 11.1.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2023A vulnerability, which was classified as problematic, was found in Byzoro Smart S85F Management Platform V31R02B10-01.CVE-2023-5959 · Other software · Byzoro · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in Byzoro Smart S85F Management Platform V31R02B10-01. Affected is an unknown function of the file /login.php. The manipulation of the argument txt_newpwd leads to weak password recovery. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-244992. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S85F Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2023A flaw was found In 3Scale Admin Portal.CVE-2023-4910 · Other software · Red Hat · reported by Red HatMedium 5.5
A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache.
- Product
- Red Hat 3scale API Management Platform 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 30, 2023CloudExplorer Lite is an open source, lightweight cloud management platform.CVE-2023-44397 · Other software · CloudExplorer-Dev · reported by GitHubHigh 7.5
CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller with path starting with `matching/API/`, which can cause a permission bypass. Version 1.4.1 contains a patch for this issue.
- Product
- CloudExplorer-Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick.CVE-2023-5349 · Other software · Red Hat · reported by Red HatMedium 5.3
A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion.
- Product
- Red Hat 3scale API Management Platform 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 25, 2023iTop is an open source, web-based IT service management platform.CVE-2023-34447 · Other software · Combodo · reported by GitHubHigh 8.8
iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on `pages/UI.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023iTop is an open source, web-based IT service management platform.CVE-2023-34446 · Other software · Combodo · reported by GitHubHigh 8.8
iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying `pages/preferences.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.
- Product
- iTop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2023A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231012.CVE-2023-5684 · Other software · Byzoro · reported by VulDBMedium 4.7
A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /importexport.php. The manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243061 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S85F Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2023A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231010 and classified as critical.CVE-2023-5683 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btn_file_renew leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243059. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S85F Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2023A vulnerability exists which allows an authenticated attacker to access sensitive information on the AirWave Management Platform web-based management interface.CVE-2023-4896 · Other software · HewarHewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.8
A vulnerability exists which allows an authenticated attacker to access sensitive information on the AirWave Management Platform web-based management interface. Successful exploitation allows the attacker to gain access to some data that could be further exploited to laterally access devices managed and monitored by the AirWave server.
- Product
- Aruba AirWave Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Oct 10, 2023A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928 and classified as critical.CVE-2023-5494 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928 and classified as critical. Affected by this issue is some unknown functionality of the file /log/download.php. The manipulation of the argument file leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-241646 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023A vulnerability has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928 and classified as critical.CVE-2023-5493 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /useratte/web.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-241645 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928.CVE-2023-5492 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. Affected is an unknown function of the file /sysmanage/licence.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241644. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023A vulnerability, which was classified as critical, has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 202309CVE-2023-5491 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This issue affects some unknown processing of the file /sysmanage/updatelib.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-241643. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023A vulnerability classified as critical was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928.CVE-2023-5490 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This vulnerability affects unknown code of the file /useratte/userattestation.php. The manipulation of the argument web_img leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-241642 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023A vulnerability classified as critical has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928.CVE-2023-5489 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This affects an unknown part of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-241641 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928.CVE-2023-5488 · Other software · Byzoro · reported by VulDBMedium 6.3
A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. It has been rated as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updatelib.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241640. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.