PT-2023-22256 · Cththemes · Cththemes Theroof Theme +1

Name of the Vulnerable Software and Affected Versions: CTHthemes TheRoof theme versions 1.0.3 and earlier CTHthemes TheRoof plugin versions 1.0.3 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject...

PT-2023-24524 · WordPress · Lana Text To Image

Name of the Vulnerable Software and Affected Versions: Lana Text to Image plugin for WordPress versions up to, and including, 1.0.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the lana text to image and lana text to img...

PT-2023-25542 · Unknown · Pos Codekop

Name of the Vulnerable Software and Affected Versions: POS Codekop version 2.0 Description: A Cross-Site Request Forgery CSRF issue allows attackers to escalate privileges. Recommendations: For POS Codekop version 2.0, consider implementing proper CSRF token validation to prevent unauthorized...

PT-2023-25512 · Webkul · Webkul Qloapps

Name of the Vulnerable Software and Affected Versions: Webkul QloApps version 1.6.0 Description: An unauthenticated Cross-Site Scripting XSS issue allows an attacker to obtain a user's session cookie, which can then be used to impersonate the user. This is achieved via the POST controller...

PT-2023-5205 · Fortinet · Fortisiem

Name of the Vulnerable Software and Affected Versions: Fortinet FortiSIEM versions 6.7.0 through 6.7.5 Description: The issue is related to insufficient protection of service data in the security management system, allowing an attacker to disclose sensitive information via crafted HTTP requests...

PT-2023-22363 · Gbcom · Gbcom Lac Web Control Center

Name of the Vulnerable Software and Affected Versions: GBCOM LAC WEB Control Center version lac-1.3.x Description: The issue allows attackers to create an arbitrary device through a Cross Site Scripting XSS vulnerability. Recommendations: For GBCOM LAC WEB Control Center version lac-1.3.x, consid...

PT-2023-20941 · Pluck Cms · Pluck Cms

Name of the Vulnerable Software and Affected Versions: Pluck CMS versions 4.7.15 through 4.7.16-dev5 Description: A remote code execution issue was found in the /admin.php file of Pluck CMS, allowing attackers to execute arbitrary code through the manage file functionality. Recommendations: For...

PT-2023-21482 · Hcl · Hcl Bigfix Osd Bare Metal Server

Name of the Vulnerable Software and Affected Versions: HCL BigFix OSD Bare Metal Server versions 311.12 or lower Description: The issue allows an attacker to supply invalid input, causing the server to perform a redirect to an attacker-controlled domain. This is achieved through a Host Header...

PT-2023-25003 · Sliver · Sliver

Name of the Vulnerable Software and Affected Versions: Sliver versions 1.5.x through 1.5.39 Description: The issue is related to an improper cryptographic implementation, allowing attackers to execute a man-in-the-middle attack via intercepted and crafted responses. This enables attackers to...

PT-2023-18600 · Suse · Suse Manager Server Module +1

Name of the Vulnerable Software and Affected Versions: SUSE Manager Server Module 4.2 versions prior to 4.2.50-150300.3.66.5 SUSE Manager Server Module 4.3 versions prior to 4.3.58-150400.3.46.4 NeuVector affected versions not specified Description: A user can reverse engineer the JSON Web Token...

CVE-2023-26436

Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary code could be injected that is being executed when processin...

PT-2023-4128 · Abb · Abb Ability Zenon

Name of the Vulnerable Software and Affected Versions: ABB Ability zenon versions 11 build through 11 build 106404 Description: A vulnerability exists in the zenon system, allowing low-privileged users to read and update data in various directories. This issue can be exploited by attackers using...

PT-2023-24196 · Unknown · Sourcecodester Record Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Resort Management System version 1.0 Description: A vulnerability was found in the system, declared as problematic, affecting an unknown functionality. The manipulation of the page argument leads to cross-site scripting. The...

PT-2023-6575 · WordPress · Companion Sitemap Generator

Name of the Vulnerable Software and Affected Versions: Companion Sitemap Generator WordPress plugin versions prior to 4.5.3 Description: The issue is related to the lack of protection of the web page structure, allowing for potential exploitation. Specifically, the plugin does not sanitize and...

PT-2023-24168 · Minical · Minical

Name of the Vulnerable Software and Affected Versions: miniCal version 1.0.0 Description: A critical issue affects the processing of the file /booking/show bookings/. The manipulation of the search query argument leads to SQL injection. The attack may be initiated remotely. The exploit has been...

PT-2023-25015 · Fdkaac +4 · Fdkaac +4

Name of the Vulnerable Software and Affected Versions: fdkaac versions prior to 1.0.5 Description: A heap buffer overflow was discovered in the caf info function in caf reader.c. Recommendations: For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary...

PT-2023-4274 · Unknown · Cp-8050 Master Module +1

Name of the Vulnerable Software and Affected Versions: CP-8031 MASTER MODULE versions prior to CPCI85 V05 CP-8050 MASTER MODULE versions prior to CPCI85 V05 Description: A vulnerability has been identified that involves the use of hard-coded credentials in the firmware of the affected devices. Th...

CVE-2023-34965

SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can lead to a leak of user information...

PT-2023-3748 · Sap · Sap Netweaver

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Change and Transport System versions 702 through 757 Description: The issue is related to a lack of resource control mechanism in the Change and Transport System component of SAP NetWeaver. This allows an authenticated user with...

CVE-2023-34965

SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can lead to a leak of user information...