PT-2023-16687 · WordPress · Ai Chatbot

Name of the Vulnerable Software and Affected Versions: AI ChatBot WordPress plugin versions prior to 4.4.5 Description: The issue concerns the AI ChatBot WordPress plugin, which does not properly escape most of its settings before outputting them in the dashboard and lacks a proper CSRF check. Th...

PT-2023-18653 · Woocommerce · Chilidevs Return/Warranty Management System

Name of the Vulnerable Software and Affected Versions: chilidevs Return and Warranty Management System for WooCommerce plugin versions 1.2.3 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited without...

PT-2023-22545 · Unknown · Online Food Ordering System

Name of the Vulnerable Software and Affected Versions: Online Food Ordering System version 2.0 Description: The issue allows attackers to execute arbitrary code via uploading a crafted PHP file, exploiting an arbitrary file upload vulnerability in the component "/admin/ajax.php?action=save menu"...

Security Bulletin: IBM Virtualization Engine TS7700 is vulnerable to a privilege escalation threat (CVE-2023-24958)

Summary IBM Virtualization Engine TS7700 is vulnerable to a privilege escalation threat CVE-2023-24958. IBM Virtualization Engine TS7700 has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2023-24958 DESCRIPTION: A vulnerability in the IBM TS7700 Management Interface could allow an...

PT-2023-23308

Name of the Vulnerable Software and Affected Versions Kibana version 8.7.0 Description The issue is an arbitrary code execution flaw. An attacker with all privileges to the Uptime/Synthetics feature could send a request to execute JavaScript code, potentially leading to the execution of arbitrary...

PT-2023-18253 · Unknown · Mpos Tui Trustlet

Name of the Vulnerable Software and Affected Versions: mPOS TUI trustlet versions prior to SMR May-2023 Release 1 Description: The issue is an out-of-bounds write vulnerability in the TA Communication mpos encrypt pin function of the mPOS TUI trustlet. This allows local attackers to execute...

Input validation

An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are only locally accessible. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with Fire...

PT-2023-18636 · Tips Tricks Hq · Category Specific Rss Feed Subscription

Name of the Vulnerable Software and Affected Versions: Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin versions = 2.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user...

PT-2023-2754 · Fortinet · Fortinac-F +1

Name of the Vulnerable Software and Affected Versions: FortiNAC versions 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0, 8.7.0 FortiNAC-F version 7.2.0 Description: The issue is related to insufficient protection of registration data when handling the /etc/shadow password file, which ma...

PT-2023-22414 · Gl.Inet · Gl-Inet Mt3000

Name of the Vulnerable Software and Affected Versions: GL.iNET MT3000 version 4.1.0 Release 2 Description: The issue is related to OS Command Injection, which can be exploited via the /usr/lib/oui-httpd/rpc/logread endpoint. This allows for potential execution of system commands, posing a securit...

PT-2023-22674 · Aigital · Aigital Wireless-N Repeater Mini Router

Name of the Vulnerable Software and Affected Versions: Aigital Wireless-N Repeater Mini Router version 0.131229 Description: An issue in the time-based authentication mechanism allows attackers to bypass login by connecting to the web app after a successful attempt by a legitimate user...

Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.3.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...

PT-2023-23017 · Avideo · Avideo

Name of the Vulnerable Software and Affected Versions: AVideo versions prior to 12.4 Description: The issue arises from the failure to properly sanitize malicious characters when creating a Meeting Room in AVideo, allowing an attacker to insert malicious scripts. This can lead to cookie hijacking...

PT-2023-19108 · Sourcecodester · Sourcecodester Faculty Evaluation System

Name of the Vulnerable Software and Affected Versions: SourceCodester Faculty Evaluation System version 1.0 Description: A critical issue was found in the SourceCodester Faculty Evaluation System, affecting some unknown functionality of the file "ajax.php?action=delete class". The manipulation of...

PT-2023-11908 · Ibm · Ibm Counter Fraud Management For Safer Payments

Name of the Vulnerable Software and Affected Versions: IBM Counter Fraud Management for Safer Payments versions 5.7.0.00 through 5.7.0.10 IBM Counter Fraud Management for Safer Payments versions 6.0.0.00 through 6.0.0.07 IBM Counter Fraud Management for Safer Payments versions 6.1.0.00 through...

PT-2023-21746 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS previously concrete5 versions 9.0 through 9.1.3 Concrete CMS previously concrete5 versions prior to 9.2 Description: The issue is related to Stored XSS on Tags on uploaded files. This allows for malicious code to be stored and...

PT-2023-16558 · Hypr · Hypr Workforce Access

Name of the Vulnerable Software and Affected Versions: HYPR Workforce Access versions 6.12 through 8.1 Description: The issue is related to an Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on MacOS, allowing Privilege Escalation. Recommendations: For...

Access Restriction Bypass

org.springframework.boot:spring-boot-actuator-autoconfigure is vulnerable to Access Restriction Bypass. The vulnerability is due to improper wild card matching, which allows a remote attacker to bypass access restrictions and gain access to the system. Please note that the vulnerability is only...

PT-2023-20561

Name of the Vulnerable Software and Affected Versions Hyundai Gen5W L in-vehicle infotainment system version AE E PE EUR.S5W L001.001.211214 Description An issue was discovered in the Hyundai Gen5W L in-vehicle infotainment system where the AppUpgrade binary file can be modified by an attacker to...

CVE-2023-30845 ESPv2 vulnerable to JWT authentication bypass via `X-HTTP-Method-Override` header

ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 through 2.42.0 contains an authentication bypass vulnerability. API clients can craft a malicious X-HTTP-Method-Override header value to bypass JWT authentication in specific cases...