PT-2023-30062 · Pwncyn · Yxbookcms

Name of the Vulnerable Software and Affected Versions: PwnCYN YXBOOKCMS version 1.0.2 Description: A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code via the reader management and book input modules. Recommendations: For version 1.0.2, update to a newer version th...

PT-2023-28148 · Unknown · Flyteadmin

Name of the Vulnerable Software and Affected Versions: FlyteAdmin versions prior to 1.1.124 Description: The issue concerns a SQL vulnerability in list endpoints on FlyteAdmin, where a malicious user can send a REST request with custom SQL statements as list filters. This requires the attacker to...

PT-2023-29895 · Unknown · Eric Teubert Archivist – Custom Archive Templates

Name of the Vulnerable Software and Affected Versions: Eric Teubert Archivist – Custom Archive Templates plugin versions 1.7.5 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website...

PT-2023-30005 · FFmpeg · Ffmpeg

Name of the Vulnerable Software and Affected Versions: FFmpeg versions prior to commit bf814 Description: The issue is related to an out of bounds read via the dist-alphabet size variable in the read vlc prefix function. Recommendations: For versions prior to commit bf814, consider applying a pat...

PT-2023-32109

Name of the Vulnerable Software and Affected Versions EDM Informatics E-invoice versions prior to 2.1 Description The issue is related to improper protection for outbound error messages and alert signals, allowing account footprinting. This can potentially reveal sensitive information about user...

PT-2023-30026 · Unknown · Sourcecodester Packers/Movers Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Packers and Movers Management System version 1.0 Description: The issue is related to SQL Injection, which can be exploited via the "mpms/?p=services/view service&id" endpoint. The id variable is vulnerable to injection attacks...

PT-2023-20987 · Xpand It · Xpand It Write-Back Manager

Name of the Vulnerable Software and Affected Versions: Xpand IT Write-back manager version 2.3.1 Description: The issue allows attackers to perform a directory traversal via modification of the siteName parameter. This enables unauthorized access to sensitive files and directories. Recommendation...

PT-2023-26363 · Unknown · Egroupware

Name of the Vulnerable Software and Affected Versions: eGroupWare version 17.1.20190111 Description: An issue affects the setup panel under setup/manageheader.php, allowing authenticated remote attackers with administrator credentials to read a cleartext database password due to improper password...

PT-2023-9034 · Unknown +5 · Browserify-Sign +5

Name of the Vulnerable Software and Affected Versions: browserify-sign versions prior to 4.2.2 Description: The issue is related to an upper bound check problem in the dsaVerify function, which allows an attacker to construct signatures that can be successfully verified by any public key. This...

PT-2023-8180 · Abo.Cms · Abo.Cms

Name of the Vulnerable Software and Affected Versions: ABO.CMS version 5.9.3 Description: The issue is related to a SQL Injection vulnerability in the Documents module of ABO.CMS, which allows remote attackers to execute arbitrary code via the d parameter. This vulnerability is due to the lack of...

PT-2023-30144 · Cloudbees +1 · Jenkins Cloudbees Cd Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins CloudBees CD Plugin versions 1.1.32 and earlier Description: The issue allows attackers who can configure jobs to publish arbitrary files from the Jenkins controller file system to the previously configured CloudBees CD server. This i...

PT-2023-30008 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version 9.4.0cu.652 B20230116 Description: A command execution issue was discovered via the sub 416F60 function, allowing for potential exploitation. Recommendations: For TOTOLINK X6000R version 9.4.0cu.652 B20230116, consider...

PT-2023-21033 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue is related to an unauthenticated SQL injection in the GetRoomChanges method, allowing unauthenticated attackers to extract or modify all data. Recommendations: For versions...

PT-2023-30001 · Audimex · Audimex

Name of the Vulnerable Software and Affected Versions: Audimex version 15.0.0 Description: The issue concerns Cross Site Scripting XSS in the /audimex/cgi-bin/wal.fcgi endpoint via the company parameter in search filters. Recommendations: For Audimex version 15.0.0, as a temporary workaround,...

PT-2023-30151 · Elastic · Fleet Server

Name of the Vulnerable Software and Affected Versions: Fleet Server versions 8.10.0 through 8.10.2 Description: An issue was discovered where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into...

PT-2023-30103 · Weborf +1 · Weborf +1

Name of the Vulnerable Software and Affected Versions: Weborf versions 0.17 through 0.20 Itworf versions prior to 88 Description: The issue is related to a null termination flaw in the cgi.c file of Weborf, where the path for CGI scripts lacks '0' termination due to the misuse of strncpy. This...

PT-2023-20744 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application version 3.1.013 Description: The issue allows authenticated attackers to upload arbitrary files to the web root, including dangerous files such as ASP or ASPX, which can lead to command execution on the affected server...

PT-2023-29821 · WordPress · Osmansorkar Ajax Archive Calendar Plugin

Name of the Vulnerable Software and Affected Versions: Osmansorkar Ajax Archive Calendar plugin versions = 2.6.7 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher privileges. There is no...

PT-2023-29817 · Lenovo · Thinksystem

Name of the Vulnerable Software and Affected Versions: ThinkSystem versions v2 and v3 Description: An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This issue affects ThinkSystem servers with XCC. Recommendations: For...

PT-2023-29666 · Unknown · Posimyth Nexter Extension

Name of the Vulnerable Software and Affected Versions: POSIMYTH Nexter Extension plugin versions = 2.0.3 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be injected into a website, potentially leading to...