PT-2023-24273 · Ebankit · Ebankit

Name of the Vulnerable Software and Affected Versions: ebankIT version 6 Description: The issue concerns the public endpoints "/public/token/Email/generate" and "/public/token/SMS/generate" which allow generation of OTP messages to any e-mail address or phone number without validation. However, i...

CVE-2023-32315 Openfire administration console authentication bypass

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup...

PT-2023-24213 · Craft · Craft

Name of the Vulnerable Software and Affected Versions: Craft versions prior to 4.4.7 Description: Cross-site scripting XSS can be triggered by review volumes. The issue is related to the index.php?p=admin/actions/asset-indexes/process-indexing-session function, where the skippedEntries and...

PT-2023-24485 · Xxl-Job · Xxl-Job

Name of the Vulnerable Software and Affected Versions: XXL-Job version 2.4.1 Description: A lateral privilege escalation issue allows users to execute arbitrary commands on another user's account via a crafted POST request to the "/jobinfo/" API endpoint. Recommendations: For XXL-Job version 2.4....

PT-2023-6685 · Unknown · Jeecg-Boot

Name of the Vulnerable Software and Affected Versions: jeecg-boot versions 3.5.0 through 3.5.1 Description: The issue is related to a SQL injection vulnerability. It is associated with the lack of protection measures for the SQL query structure when processing the id parameter. This vulnerability...

PT-2023-3096 · D Link · D-Link Dir-842

Name of the Vulnerable Software and Affected Versions: D-Link DIR-842V2 version 1.0.3 Description: The issue is related to a command injection vulnerability in the iperf3 diagnostics function. This vulnerability is associated with a lack of data sanitization at the management level, which could...

PT-2023-22094 · Unknown · Nfine Rapid Development Platform

Name of the Vulnerable Software and Affected Versions: NFine Rapid Development Platform version 20230511 Description: A problematic vulnerability has been found in the NFine Rapid Development Platform, affecting an unknown part of the file "/SystemManage/Role/GetGridJson?keyword=&page=1&rows=20"...

PT-2023-24251 · Wftpd · Wftpd

Name of the Vulnerable Software and Affected Versions: WFTPD version 3.25 Description: The software stores usernames and password hashes in an openly viewable wftpd.ini configuration file within the WFTPD directory. This issue is noted in a product from 2006. Recommendations: For WFTPD version...

PT-2023-17441 · Ipekyolu · Ipekyolu Software Auto Damage Tracking

Name of the Vulnerable Software and Affected Versions: Ipekyolu Software Auto Damage Tracking Software versions prior to 4 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

PT-2023-24508 · Cloudogu Gmbh · Scm Manager

Name of the Vulnerable Software and Affected Versions: Cloudogu GmbH SCM Manager versions 1.2 through 1.60 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description text field. This enables...

PT-2023-19851 · WordPress · The Go Pricing - Wordpress Responsive Pricing Tables

Name of the Vulnerable Software and Affected Versions: The Go Pricing - WordPress Responsive Pricing Tables plugin versions up to, and including, 3.3.19 Description: The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping. This...

PT-2023-24309 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo version 13.6.0 Description: The issue is related to SQL Injection via the "/admin/permalinks.php" API endpoint. This allows for potential exploitation. No information is provided about the estimated number of potentially affected devic...

PT-2023-21701 · Unknown · Snow Monkey Forms

Name of the Vulnerable Software and Affected Versions: Snow Monkey Forms versions v5.0.6 and earlier Description: A directory traversal vulnerability allows a remote unauthenticated attacker to obtain sensitive information, alter the website, or cause a denial-of-service DoS condition...

PT-2023-19152 · WordPress · User Meta Manager

Name of the Vulnerable Software and Affected Versions: User Meta Manager plugin versions = 3.4.9 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

Debian DSA-5407-1 : cups-filters - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5407 advisory. - cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use the Backe...

Debian dla-3430 : cups-browsed - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3430 advisory. - ------------------------------------------------------------------------ Debian LTS Advisory DLA-3430-1 [email protected] https://www.debian.org/lts/security/...

PT-2023-21073 · WordPress · Groundhogg

Name of the Vulnerable Software and Affected Versions: Groundhogg plugin for WordPress versions up to, and including, 2.7.9.8 Description: The issue is related to Stored Cross-Site Scripting via the 'gh form' shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2023-23408 · Wso2 · Wso2 Api Manager

Name of the Vulnerable Software and Affected Versions: WSO2 API Manager versions prior to 4.2.0 Description: A reflected cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter in the...

PT-2023-21772 · Ibm · Ibm Mq

Name of the Vulnerable Software and Affected Versions: IBM MQ versions 8.0 through 9.1 Description: A local user could obtain sensitive credential information when a detailed technical error message is returned in a stack trace. Recommendations: For IBM MQ versions 8.0 through 9.1, consider...

Cisco IOS Denial-of-Service Vulnerability

Cisco IOS contains an unspecified vulnerability that may block further telnet, reverse telnet, Remote Shell RSH, Secure Shell SSH, and in some cases, Hypertext Transport Protocol HTTP access to the Cisco device...