PT-2023-22751 · Jenkins · Jenkins Report Portal Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Report Portal Plugin versions 0.5 and earlier Description: The Jenkins Report Portal Plugin stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These tokens can...

PT-2023-22759 · Hashicorp +1 · Hashicorp Consul +2

Name of the Vulnerable Software and Affected Versions: Jenkins Consul KV Builder Plugin versions 2.0.13 and earlier Description: The issue concerns the storage of the HashiCorp Consul ACL Token in the global configuration file on the Jenkins controller. This token is stored unencrypted and can be...

PT-2023-20908 · Prestashop · Prestashop Advancedpopupcreator

Name of the Vulnerable Software and Affected Versions: Prestashop advancedpopupcreator versions 1.1.21 through 1.1.24 Description: The issue is related to a SQL injection vulnerability. It affects the component AdvancedPopup::getPopups. Recommendations: For versions 1.1.21 through 1.1.24, conside...

PT-2023-2949 · Schneider Electric · Easergy Builder Installer

Name of the Vulnerable Software and Affected Versions: Easergy Builder Installer versions 1.7.23 and prior Description: The issue is related to an uncontrolled search path element in the installer, which could allow an attacker with a local privileged account to execute arbitrary code during the...

PT-2023-17327 · Sap · Sap Hcm Fiori App My Forms

Name of the Vulnerable Software and Affected Versions: SAP HCM Fiori App My Forms Fiori 2.0 version 605 Description: The issue concerns the lack of necessary authorization checks for authenticated users, resulting in exposure of restricted header data. Recommendations: For SAP HCM Fiori App My...

PT-2023-2430 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows versions 2008 R2 SP1 through 2019 Description: The issue is related to insufficient input validation in the Windows DHCP server service, allowing remote attackers to execute arbitrary code. This can be achieved through remote procedur...

PT-2023-22190 · Sap · Sapsetup

Name of the Vulnerable Software and Affected Versions: SapSetup version 9.0 Description: A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup, resulting in a privilege escalation running code as administrator of the same Windows PC. A successful attack depen...

Siemens SCALANCE W1750D Improper Limitation of a Pathname to a Restricted Directory (CVE-2021-37734)

A remote unauthorized read access to files vulnerability was discovered in Aruba Instant versions: 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.19 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 a...

PT-2023-5118 · Luci +1 · Luci +1

Name of the Vulnerable Software and Affected Versions: OpenWrt versions prior to the version with the fixed LuCI openwrt-22.03 branch LuCI openwrt-22.03 branch git-22.361.69894-438c598 Description: The issue is related to a stored cross-site scripting XSS vulnerability in the sshkeys.js component...

Information disclosure

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16. A person with physical access to a device may be able to use Siri to access private calendar information...

PT-2023-17369 · Unknown · Sourcecodester Online Computer/Laptop Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Computer and Laptop Store version 1.0 Description: A critical vulnerability was found in the Image Handler component of the affected software, specifically in the /classes/Master.php file, where the path argument is...

PT-2023-21358 · H3C · H3C Magic R100

Name of the Vulnerable Software and Affected Versions: H3C Magic R100 version R100V100R005.bin Description: A stack overflow issue was discovered via the DeltriggerList interface at the "/goform/aspForm" API endpoint. This issue allows attackers to cause a Denial of Service DoS by sending a craft...

PT-2023-20993 · Unknown · Gdidees Cms

Name of the Vulnerable Software and Affected Versions: GDidees CMS version 3.9.1 Description: A source code disclosure issue was found in the backup feature of GDidees CMS, accessible via the "/ admin/backup.php" endpoint. This allows for potential access to sensitive information. Recommendations...

PT-2023-2447

Name of the Vulnerable Software and Affected Versions Novi Survey versions prior to 8.9.43676 Description The issue is related to insecure deserialization, allowing remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stor...

PT-2023-19285 · Oceanwp · Oceanwp Ocean Extra +1

Name of the Vulnerable Software and Affected Versions: OceanWP Ocean Extra plugin versions = 2.1.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with contributor or higher privileges. It affects the OceanWP Ocean Extra plugin whe...

CVE-2023-0319

CVE-2023-0319 affects GitLab: an information disclosure allows reading environment names that are supposed to be restricted to project members. Affected ranges are: 13.6 up to 15.8.4 (since 15.8.5 is patched), 15.9.0 up to 15.9.3 (since 15.9.4 is patched), and 15.10.0 (before 15.10.1). The connec...

PT-2023-20825 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 4.5.3 Description: The hashing algorithm utilizes a non-random salt value, allowing attackers to use precomputed hash tables or dictionary attacks to crack the hashed passwords. Recommendations: For ChurchCRM version 4.5.3,...

PT-2023-20948 · Unknown · Xiaobingby Teacms

Name of the Vulnerable Software and Affected Versions: XiaoBingby TeaCMS version 2.3.3 Description: An unauthorized access issue allows attackers to escalate privileges via the id and keywords parameters. Recommendations: For XiaoBingby TeaCMS version 2.3.3, consider restricting access to the id...

PT-2023-20778 · Unknown · Yii 2 Framework

Name of the Vulnerable Software and Affected Versions: Yii 2 Framework versions prior to 2.0.47 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via the runAction function. The software maintainer disputes that the vulnerability is in the framework itself,...

PT-2023-17168 · Hadsky · Hadsky

Name of the Vulnerable Software and Affected Versions: HadSky versions up to 7.11.8 Description: A critical issue has been found, affecting the Installation Interface component, specifically the /install/index.php file. This issue leads to command injection and can be initiated remotely. The...