PT-2023-22021 · Ncp · Ncp Secure Enterprise Client

Name of the Vulnerable Software and Affected Versions: NCP Secure Enterprise Client versions prior to 12.22 Description: The issue allows attackers to read registry information of the operating system by creating a symbolic link. This is possible due to a flaw in the Support Assistant component o...

PT-2023-22017 · Ncp · Ncp Secure Enterprise Client

Name of the Vulnerable Software and Affected Versions: NCP Secure Enterprise Client versions prior to 12.22 Description: The issue allows attackers to delete arbitrary files on the operating system by creating a symbolic link. This is possible due to a flaw in the Support Assistant component of t...

PT-2023-9320 · Oracle · Jd Edwards Enterpriseone Tools

Name of the Vulnerable Software and Affected Versions: JD Edwards EnterpriseOne Tools versions prior to 9.2.8.2 Description: The issue is related to insufficient input validation in the Web Runtime SEC component. It allows an unauthenticated attacker with network access via HTTP to compromise JD...

PT-2023-30980 · Unknown · Car Rental Script

Name of the Vulnerable Software and Affected Versions: Car Rental Script version 3.0 Description: The issue concerns Multiple HTML Injection problems. These issues can be exploited via the SMS API Key or Default Country Code. Recommendations: For Car Rental Script version 3.0, update the software...

PT-2023-9650 · Oracle · Oracle Database Server

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 19.3 through 19.23 Oracle Database Server versions 21.3 through 21.14 Oracle Database Server version 23.4 Description: The issue is related to the Java VM component of Oracle Database Server, where an incorrect...

PT-2023-31322 · Unknown · Speedycache

Name of the Vulnerable Software and Affected Versions: SpeedyCache – Cache, Optimization, Performance versions n/a through 1.1.2 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability. This type of vulnerability allows an attacker to trick the server into making...

PT-2023-32672 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue concerns the /metrics endpoint, which is grouping calls by id and reporting this id in the response. Since this id corresponds to the channelID, the public /metrics endpoint is...

Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass

Summary When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates the RFC because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another fronte...

GHSA-FVHJ-4QFH-Q2HM Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass

Summary When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates the RFC because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another fronte...

PT-2023-7545 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Cisco Firepower Threat Defense FTD Software affected versions not specified Description: A vulnerability in the AnyConnect SSL VPN feature could allow an...

PT-2023-7502 · Apache · Apache Struts

Name of the Vulnerable Software and Affected Versions: Apache Struts versions 2.0.0 through 2.5.32 Apache Struts versions 6.0.0 through 6.3.0.1 Description: A critical vulnerability has been identified in Apache Struts, allowing attackers to manipulate file upload parameters and enable path...

PT-2023-32666 · Icecms · Icecms

Name of the Vulnerable Software and Affected Versions: IceCMS version 2.0.1 Description: A vulnerability has been found in IceCMS, affecting an unknown function of the file /WebArticle/articles/ of the component Like Handler. This issue leads to improper enforcement of a single, unique action and...

PT-2023-32640 · Unknown · Phpgurukul Nipah Virus Testing Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Nipah Virus Testing Management System version 1.0 Description: A critical issue was found in the PHPGurukul Nipah Virus Testing Management System. This issue affects the file add-phlebotomist.php and allows for SQL injection throug...

PT-2023-29562 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version US AC10V4.0si V16.03.10.13 cn Description: A stack overflow issue was discovered via the list parameter in the sub 49E098 function. Recommendations: For Tenda AC10 version US AC10V4.0si V16.03.10.13 cn, consider restricting...

PT-2023-29564 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version US AC10V4.0si V16.03.10.13 cn Description: A stack overflow issue was discovered via the shareSpeed parameter in the fromSetWifiGuestBasic function. Recommendations: For Tenda AC10 version US AC10V4.0si V16.03.10.13 cn,...

PT-2023-28293 · Unknown · Chamilo Lms

Name of the Vulnerable Software and Affected Versions: Chamilo LMS versions prior to 1.11.24 Description: The issue concerns improper neutralisation of special characters, allowing command injection in the main/lp/openoffice presentation.class.php file. This enables users who are permitted to...

PT-2023-31035 · Tenda · Tenda Ax1803

Name of the Vulnerable Software and Affected Versions: Tenda AX1803 version 1.0.0.1 Description: The issue allows a remote attacker to execute arbitrary code via the schedStartTime parameter or the schedEndTime parameter in the function setSchedWifi. This enables the attacker to potentially gain...

PT-2023-32566 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue is related to improper authorization in the "/plugins/focalboard/api/v2/users" endpoint, allowing an attacker who is a guest user and knows the ID of another user to obtain the...

PT-2023-31036 · Tenda · Tenda Ax1803

Name of the Vulnerable Software and Affected Versions: Tenda AX1803 version 1.0.0.1 Description: The issue allows a remote attacker to execute arbitrary code via the wpapsk crypto parameter in the fromSetWirelessRepeat function. This enables the attacker to potentially gain control over the syste...

PT-2023-23578 · Unknown · Orocommerce

Name of the Vulnerable Software and Affected Versions: OroCommerce versions prior to 5.0.11 OroCommerce versions prior to 5.1.1 Description: The issue allows back-office users to access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient...