PT-2023-21748 · Tigergraph · Tigergraph Enterprise

Name of the Vulnerable Software and Affected Versions: Tigergraph Enterprise version 3.7.0 Description: An issue was discovered in the TigerGraph platform, which installs a full development toolchain within every TigerGraph deployment. This allows an attacker to compile new executables on each...

PT-2023-22971 · Blubrry · Blubrry Powerpress Podcasting Plugin

Name of the Vulnerable Software and Affected Versions: Blubrry PowerPress Podcasting plugin versions = 10.0.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the Blubrry PowerPress Podcasting plugin. This vulnerability can be exploited by...

PT-2023-27129 · Unknown · Suleve 5-In-1 Smart Door Lock

Name of the Vulnerable Software and Affected Versions: Suleve 5-in-1 Smart Door Lock version v1.0 Description: The issue is related to missing encryption in the RFID tag of the Suleve 5-in-1 Smart Door Lock, which allows attackers to create a cloned tag via brief physical proximity to the origina...

PT-2023-28928 · Phprecdb · Phprecdb

Name of the Vulnerable Software and Affected Versions: phpRecDB version 1.3.1 Description: A vulnerability was found in the file /index.php of phpRecDB, where the manipulation of the argument r/view leads to cross-site scripting. The attack may be launched remotely. The vendor was contacted early...

PT-2023-26645 · Comfast · Comfast Cf-Xr11

Name of the Vulnerable Software and Affected Versions: COMFAST CF-XR11 version 2.7.2 Description: An issue in COMFAST CF-XR11 allows an attacker to execute arbitrary code via the protal delete picname parameter in the sub 41171C function at bin/webmgnt. Recommendations: For COMFAST CF-XR11 versio...

CVE-2023-39950 Insufficient input validation in efibootguard

efibootguard is a simple UEFI boot loader with support for safely switching between current and updated partition sets. Insufficient or missing validation and sanitization of input from untrustworthy bootloader environment files can cause crashes and probably also code injections into bgsetenv or...

PT-2023-18796 · Audiocodes · Audiocodes Voip Desk Phones

Name of the Vulnerable Software and Affected Versions: AudioCodes VoIP desk phones versions through 3.4.4.1000 Description: An issue was discovered where the validation of firmware images only consists of simple checksum checks for different firmware components. This allows an attacker, by knowin...

PT-2023-26898 · Snow · Software License Manager

Name of the Vulnerable Software and Affected Versions: Snow Software License Manager versions 9.0.0 through 9.30.1 Description: The issue is a cross site scripting vulnerability in the web portal of Snow Software License Manager. This allows an authenticated user with high privileges to trigger a...

PT-2023-12080 · Supermicro · Pcmt Supermicro-Cms

Name of the Vulnerable Software and Affected Versions: pcmt superMicro-CMS version 3.11 Description: An issue was discovered that allows attackers to delete files via a crafted image file in the images.php file. Recommendations: For pcmt superMicro-CMS version 3.11, consider restricting access to...

PT-2023-5309 · Salt +3 · Salt +3

Name of the Vulnerable Software and Affected Versions: Salt masters versions prior to 3005.2 or 3006.2 Description: The issue is related to Git Providers in Salt masters, where they can read from the wrong environment due to the same cache directory base name. This can lead to garbage data or the...

PT-2023-19552 · Spider Teams · Spider Teams Applyonline Plugin

Name of the Vulnerable Software and Affected Versions: Spider Teams ApplyOnline plugin versions = 2.5 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the Spider Teams ApplyOnline...

PT-2023-21991 · Intel · Intel Oneapi Toolkit

Name of the Vulnerable Software and Affected Versions: IntelR oneAPI Toolkit versions prior to 4.3.1.493 Description: The issue is related to an uncontrolled search path in some IntelR oneAPI Toolkit and component software installers. This may allow an authenticated user to potentially enable...

PT-2023-22879 · Unknown · Hal Vaultkeeper

Name of the Vulnerable Software and Affected Versions: HAL VaultKeeper versions prior to SMR Aug-2023 Release 1 Description: The issue is related to an improper input validation vulnerability within the initialize function. This vulnerability allows an attacker to cause an out-of-bounds write...

HPE MSA Storage Session Reuse (HPESBST03940)

The version of HPE MSA Storage installed on the remote host is prior to GL225P002-02, VE270P002-02, or VL270P002-02. It is, therefore, affected by a vulnerability as referenced in the HPESBST03940 advisory. - A remote session reuse vulnerability leading to access restriction bypass was discovered...

PT-2023-23705 · Getbutton.Io · Getbutton Chat Button

Name of the Vulnerable Software and Affected Versions: GetButton Chat Button by GetButton.Io plugin versions 1.8.9.4 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin privileges can inject...

PT-2023-26069 · Unknown · Judging Management System

Name of the Vulnerable Software and Affected Versions: Judging Management System version 1.0 Description: A SQL injection issue was found in the Judging Management System. The vulnerability can be exploited via the id parameter at the "/php-jms/deductScores.php" API endpoint. Recommendations: For...

PT-2023-27232 · Totolink · Totolink T10 V2

Name of the Vulnerable Software and Affected Versions: TOTOLINK T10 v2 version 5.9c.5061 B20200511 Description: The issue is a stack-based buffer overflow in the setWiFiWpsConfig function, located in /lib/cste modules/wps.so. Attackers can exploit this by sending crafted data in an MQTT packet,...

PT-2023-26075 · Unknown · Maid Hiring Management System

Name of the Vulnerable Software and Affected Versions: Maid Hiring Management System version 1.0 Description: The issue is related to a SQL injection vulnerability found in the Admin page of the system. Recommendations: For Maid Hiring Management System version 1.0, consider restricting access to...

PT-2023-25612

Name of the Vulnerable Software and Affected Versions Digital Ant E-Commerce Software versions prior to 11 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker ca...

PT-2023-27233 · Totolink · Totolink T10 V2

Name of the Vulnerable Software and Affected Versions: TOTOLINK T10 v2 version 5.9c.5061 B20200511 Description: The issue is a stack-based buffer overflow in the setStaticDhcpConfig function located in /lib/cste modules/lan.so. Attackers can exploit this by sending crafted data in an MQTT packet,...