PT-2023-24843 · Unknown · Grandslambert Login Configurator

Name of the Vulnerable Software and Affected Versions: GrandSlambert Login Configurator plugin versions = 2.1 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin privileges can inject malicious scripts into th...

PT-2023-22596

Name of the Vulnerable Software and Affected Versions WP EasyCart plugin for WordPress versions up to, and including, 5.4.10 Description The issue is related to time-based SQL Injection via the orderby parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient...

PT-2023-17337

Name of the Vulnerable Software and Affected Versions PowerPress plugin for WordPress versions up to, and including, 10.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output escaping on user-supplied...

PT-2023-11846

Name of the Vulnerable Software and Affected Versions The Fruitful Theme for WordPress versions up to, and including, 3.8.1 Description The issue is related to Stored Cross-Site Scripting via several parameters stored via the "fruitful theme options action" AJAX action due to insufficient input...

PT-2023-20543 · Tibco Software · Tibco Ebx Add-Ons

Name of the Vulnerable Software and Affected Versions: TIBCO EBX Add-ons versions 4.5.16 and below Description: The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an issue that allows an attacker with low-privileged application access to read system files that are accessible...

PT-2023-19101 · WordPress · Team With Slider

Name of the Vulnerable Software and Affected Versions: Sk. Abul Hasan Team Member – Team with Slider plugin versions = 4.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website...

Use of Telnet in multiple SICK Flexi Soft and Flexi Classic Gateways

Several versions of the SICK Flexi Soft Gateways FX0-GENT, FX0-GMOD, FX0-GPNT and SICK Flexi Classic Gateway UE410 provide a Telnet interface for debugging, which is enabled by factory default. No password is set in the default configuration. If the password is not set by the customer, a remote...

GitHub: Smuggling content in PR with refs/replace in GitHub

An incorrect comparison vulnerability was found in GitHub Enterprise Server, allowing commit smuggling through the display of an incorrect diff in the GitHub pull request UI. This vulnerability required write access to the repository and affected versions 3.7.0 and above. It was fixed in versions...

PT-2023-15073 · Themeisle · Themeisle Visualizer

Name of the Vulnerable Software and Affected Versions: Themeisle Visualizer: Tables and Charts Manager for WordPress plugin versions = 3.9.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher permissions. There is no...

PT-2023-18627 · Pixedelic.Com · Pixedelic.Com Camera Slideshow Plugin

Name of the Vulnerable Software and Affected Versions: Manuel Masia | Pixedelic.Com Camera slideshow plugin versions = 1.4.0.1 Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into otherwise trusted websites,...

PT-2023-14975

Name of the Vulnerable Software and Affected Versions Logo Slider WordPress plugin versions prior to 3.6.0 Description The issue is related to the Logo Slider WordPress plugin not validating and escaping some of its shortcode attributes before outputting them back in a page or post where the...

Malicious Package

Overview site-speed-above-the-fold-timer is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable i...

PT-2022-26445 · Miniorange · Miniorange'S Google Authenticator Plugin

Name of the Vulnerable Software and Affected Versions: miniOrange's Google Authenticator plugin versions = 5.6.1 Description: The issue is related to a Broken Access Control vulnerability. This vulnerability affects miniOrange's Google Authenticator plugin on WordPress, potentially allowing...

PYSEC-2022-43188

Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict unhandledRejection exiting AND using next start or a custom server...

CVE-2022-36046 Unexpected server crash in Next.js version 12.2.3

Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict unhandledRejection exiting AND using next start or a custom server...

PT-2022-21917 · Dell · Dell Wyse Management Suite

Name of the Vulnerable Software and Affected Versions: Dell Wyse Management Suite versions 3.6.1 and below Description: The issue concerns a plain-text password storage vulnerability in the UI. An attacker with low privileges could potentially exploit this, leading to the disclosure of certain us...

PT-2022-22244 · Rizin · Rizin

Name of the Vulnerable Software and Affected Versions: Rizin versions 0.4.0 and below Description: The issue is related to an integer overflow via the function get long object. This allows attackers to cause a Denial of Service DoS via a crafted binary. Recommendations: For Rizin versions 0.4.0 a...

CVE-2022-26477

The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a...

CVE-2022-1303

The Slide Anything WordPress plugin before 2.3.44 does not sanitize and escape sliders' description, which could allow high privilege users such as editor and above to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

Kimai security vulnerabilities

Kimai is an open source, web-based, multi-user time tracking application. A security vulnerability exists in Kimai 2 1.14, which is caused by the description in the new timetable...