PT-2023-24876 · Baker Hughes · Bently Nevada 3500 System Tdi Firmware

Name of the Vulnerable Software and Affected Versions: Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 Description: The issue concerns a vulnerability in the password retrieval functionality, which could allow an attacker to access passwords stored on the device. Recommendation...

PT-2023-29791 · Sourcecodester · Sourcecodester Best Courier Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Best Courier Management System version 1.0 Description: The issue concerns SQL Injection via the id parameter in the "/edit staff.php" API endpoint. This allows for potential exploitation. Recommendations: For Sourcecodester Be...

PT-2023-28057 · Sonicwall · Sonicos

Name of the Vulnerable Software and Affected Versions: SonicOS affected versions not specified Description: The issue is a post-authentication Stack-Based Buffer Overflow Vulnerability. It affects the "sonicwall.exp" and "prefs.exp" URL endpoints, leading to a firewall crash. Recommendations: As ...

PT-2023-20971 · Tsplus · Tsplus Remote Work

Name of the Vulnerable Software and Affected Versions: TSplus Remote Work version 16.0.0.0 Description: The issue is related to weak permissions for certain file types, including .exe, .js, and .html files, located under the %PROGRAMFILESX86%TSplus-RemoteWorkClientswww folder. This weakness may...

PT-2023-20970 · Tsplus · Tsplus Remote Work

Name of the Vulnerable Software and Affected Versions: TSplus Remote Work version 16.0.0.0 Description: The issue concerns the storage of a cleartext password in the HTML source code of the secure single sign-on web portal. Specifically, the password is placed on the var pass line. Recommendation...

PT-2023-25534 · Covesa +1 · Covesa +1

Name of the Vulnerable Software and Affected Versions: Connected Vehicle Systems Alliance COVESA versions up to 2.18.8 Description: The issue is related to a buffer overflow in the Connected Vehicle Systems Alliance COVESA software. This buffer overflow occurs via the component /shared/dlt...

PT-2023-29755 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A Cross-Site Request Forgery CSRF issue was discovered in the /admin/category/add component. This allows for unauthorized actions to be performed on behalf of a user. Recommendations: For Dreamer CMS...

PT-2023-29760 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A Cross-Site Request Forgery CSRF issue was discovered in Dreamer CMS via the component /admin/user/add. This allows for unauthorized actions to be performed on behalf of an authenticated user...

PT-2023-9835 · Apache · Apache Spark +1

Name of the Vulnerable Software and Affected Versions: Apache Hive versions 1.2.0 and later Apache Spark versions 2.0.0 and later Description: The issue is related to the exposure of digital signatures in cookie data, which can lead to security vulnerabilities and exploitation. The vulnerable...

Code injection

The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users...

CVE-2023-4800

Affected software: DoLogin Security WordPress plugin (before 3.7.1). Vulnerability: The widget displaying IPs of failed logins is accessible to low-privileged users, exposing potentially sensitive data. Impact (as stated): Sensitive data exposure (high confidentiality impact per the published CVS...

PT-2023-24738 · Easyuse · Easyuse Mailhunter Ultimate

Name of the Vulnerable Software and Affected Versions: EasyUse MailHunter Ultimate versions 2023 and earlier Description: The issue allows remote authenticated users to extract files into arbitrary directories via a crafted ZIP archive. This is due to a path traversal vulnerability in the create...

PT-2023-6414 · D Link · D-Link Di-7003Gv2 +4

Name of the Vulnerable Software and Affected Versions: D-Link DI-7003GV2 versions 23.08.25D1 and before D-Link DI-7100G+V2 versions 23.08.23D1 and before D-Link DI-7100GV2 version 23.08.23D1 D-Link DI-7200G+V2 versions 23.08.23D1 and before D-Link DI-7200GV2 versions 23.08.23E1 and before D-Link...

PT-2023-12691 · Ibm · Ibm Security Verify Privilege On-Premises

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Privilege On-Premises version 11.5 Description: IBM Security Verify Privilege On-Premises could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request...

PT-2023-30025 · WordPress · Enable Media Replace

Name of the Vulnerable Software and Affected Versions: Enable Media Replace WordPress plugin versions prior to 4.1.3 Description: The issue allows Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog, due to the unserialize of user input via the Remove...

PT-2023-6176 · D Link · Di-7300G +6

Name of the Vulnerable Software and Affected Versions: D-Link DI-7003GV2 versions 23.08.25D1 and earlier D-Link DI-7100G versions 23.08.23D1 and earlier D-Link DI-7100GV2 version 23.08.23D1 D-Link DI-7200G versions 23.08.23D1 and earlier D-Link DI-7200GV2 versions 23.08.23E1 and earlier D-Link...

PT-2023-6213 · South River Technologies · Titan Mft +1

Name of the Vulnerable Software and Affected Versions: South River Technologies' Titan MFT and Titan SFTP servers affected versions not specified Description: The issue is related to insufficient path validation when extracting a zip archive, allowing an authenticated attacker to write a file to...

PT-2023-29558 · Netis · Netis N3Mv2

Name of the Vulnerable Software and Affected Versions: Netis N3Mv2 version 1.0.1.865 Description: A command injection issue was discovered via the ntpServIP parameter in the Time Settings. This allows for potential exploitation. Recommendations: For Netis N3Mv2 version 1.0.1.865, consider...

PT-2023-22562 · Unknown +1 · Prestashop +1

Name of the Vulnerable Software and Affected Versions: AfterMail aftermailpresta for PrestaShop versions prior to 2.2.1 Description: The issue is related to multiple improper neutralization of SQL parameters, allowing remote attackers to perform SQL injection attacks. This can be done via...

PT-2023-29545 · Granding · Granding Utime Master

Name of the Vulnerable Software and Affected Versions: GRANDING UTime Master version 9.0.7-Build:Apr 4,2023 Description: The issue is related to an indirect object reference IDOR that allows authenticated attackers to access sensitive information. This is achieved via a crafted cookie...