Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1172PUBLISHED: 2023-03-17
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that w...
CVE-2023-1469PUBLISHED: 2023-03-17
The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenti...
CVE-2023-1466PUBLISHED: 2023-03-17
A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as critical. This issue affects the function view_student of the file admin/?page=students/view_student. The manipulation of the argument id with the input 3' AND (SELECT 2100 FROM (SELECT(...
CVE-2023-1467PUBLISHED: 2023-03-17
A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file Master.php?f=delete_img of the component POST Parameter Handler. The manipulation of the argument path with the input C%3A%2Ffoo.txt le...
CVE-2023-1468PUBLISHED: 2023-03-17
A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=reports&date_from=2023-02-17&date_to=2023-03-17 of the component Report Handler. The manipula...
User Rank: Ninja
7/15/2021 | 1:21:20 PM
Was this a supply chain issue or was this a flaw in a program that is part of the application that Solarwinds happen to select (not sure why they did not use WinSCP or OpenSSH but that is for another conversation)? In addition, the software has a peer-to-peer file sharing capability and folder synchronization (that is your problem right there), not sure why this was allowed to be part of the application stack, OpenSSH gives you that capability over an encrypted tunnel or WinSCP does the same thing.
In addition, since this uses SSH and Key-Mgmt capabilities, this should have not been compromised because the key should have been unique during its creation process or unless someone created a backdoor in the key creation process, not sure there but not sure why they did not remove the "P2P" file-sharing process.
Oh well, too late to cry over spilled milk, the damage has already been done.
Todd