PT-2023-26271 · Sourcecodester · Sourcecodester House Rental/Property Listing

Name of the Vulnerable Software and Affected Versions: SourceCodester House Rental and Property Listing System version 1.0 Description: A critical vulnerability was found in the system, affecting an unknown function of the file btn functions.php. This issue leads to unrestricted upload and can be...

CVE-2023-32265

A potential security vulnerability has been identified in the Enterprise Server Common Web Administration ESCWA component used in Enterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server. An attacker would need to be authenticated into ESCWA to attempt to...

CVE-2023-32265

Summary (CVE-2023-32265): The vulnerability affects the Enterprise Server Common Web Administration (ESCWA) component used across Enterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server. An authenticated ESCWA user could exploit conditions described in the ...

PT-2023-26038 · Unknown · Office Suite Premium

Name of the Vulnerable Software and Affected Versions: Office Suite Premium Version v10.9.1.42602 Description: A reflected cross-site scripting XSS issue was found, which can be exploited via the id parameter at the "/api?path=profile" API endpoint. Recommendations: For Office Suite Premium Versi...

The vulnerability of the SpiderControl SCADA Web Server arises from an incorrect restriction on the path to the restricted access catalog. This allows a intruder to cause a service failure.

The vulnerability of the SpiderControl SCADA Web Server exists due to an incorrect restriction on the path to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2023-26056 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: eyoucms version 1.6.3 Description: The issue is related to an information disclosure vulnerability. It is exploited via the "/custom model path/recruit.filelist.txt" component. Recommendations: For eyoucms version 1.6.3, consider restricting...

PT-2023-25813 · Unknown · Diafan Cms

Name of the Vulnerable Software and Affected Versions: Diafan CMS version 6.0 Description: The issue is related to a reflected cross-site scripting vulnerability. It occurs via the cat id parameter at the "/shop/?module=shop&action=search" API endpoint. Recommendations: For Diafan CMS version 6.0...

PT-2023-26060 · Unknown · Cockpit Cms

Name of the Vulnerable Software and Affected Versions: Cockpit CMS version 2.5.2 Description: A Cross-Site Request Forgery CSRF in the Admin portal allows attackers to execute arbitrary Administrator commands. Recommendations: For Cockpit CMS version 2.5.2, consider disabling access to the Admin...

PT-2023-7027 · Unknown · Intergard Sgs

Name of the Vulnerable Software and Affected Versions: Intergard SGS version 8.7.0 Description: The issue is related to the transmission of sensitive information in cleartext due to a vulnerability in the SQL Query Handler component. This can be exploited remotely, potentially allowing an attacke...

PT-2023-3875

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS versions prior to 6.49.7 MikroTik RouterOS long-term versions prior to 6.48.7 Description The issue is related to a privilege escalation problem in the Winbox and HTTP interfaces of MikroTik RouterOS. A remote and authenticat...

PT-2023-3697 · Oracle · Application Express Administration

Name of the Vulnerable Software and Affected Versions: Application Express Administration versions 18.2 through 22.2 Description: The issue is related to insufficient input validation in the Application Express Administration product of Oracle Application Express. It allows an unauthenticated...

PT-2023-25800 · WordPress · Profilegrid

Name of the Vulnerable Software and Affected Versions: ProfileGrid plugin for WordPress versions up to, and including, 5.5.2 Description: The issue is related to a missing capability check on the 'edit group' handler, allowing authenticated attackers with group ownership to update group options,...

Design/Logic Flaw

CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit 705bf1f...

CVE-2023-37266 Weak json web token (JWT) secrets in CasaOS

CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit 705bf1f...

PT-2023-22340

Name of the Vulnerable Software and Affected Versions Oliva Expertise EKS versions prior to 1.2 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations For...

PT-2023-26216 · WordPress · Faboba Falang Multilanguage

Name of the Vulnerable Software and Affected Versions: Faboba Falang multilanguage for WordPress plugin versions = 1.3.39 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that...

PT-2023-24009 · Unknown · Archer Platform

Name of the Vulnerable Software and Affected Versions: Archer Platform versions prior to 6.13 Description: The issue allows an authenticated attacker to obtain sensitive information via API calls related to data feeds and data publication. Recommendations: For versions prior to 6.12.0.6, update t...

PT-2023-26371 · Rswag · Rswag

Name of the Vulnerable Software and Affected Versions: rswag versions prior to 2.10.1 Description: The issue allows remote attackers to read arbitrary JSON and YAML files via directory traversal. This occurs because rswag-api can expose a file that is not the OpenAPI or Swagger specification file...

PT-2023-9043 · Tenda · Tenda Fh1202

Name of the Vulnerable Software and Affected Versions: Tenda F1202 version V1.0BR V1.2.0.20408 Tenda FH1202 version V1.2.0.19 EN Description: A stack overflow issue was discovered in the frmL7ProtForm function, related to the page parameter. This could allow a remote attacker to impact the...

PT-2023-17403

Name of the Vulnerable Software and Affected Versions Vision1210 version 4.3 build 5 Description The issue allows a remote attacker to store base64-encoded malicious code in the device's data tables via the PCOM protocol. This malicious code can then be retrieved by a client and executed on the...