PT-2023-2167 · Hitachi Energy · Sdm600

Name of the Vulnerable Software and Affected Versions: Hitachi Energy System Data Manager SDM600 versions prior to 1.2 FP3 HF4 Build Nr. 1.2.23000.291 Description: A vulnerability exists in the SDM600 endpoint, where an attacker could exploit this issue by running multiple parallel requests,...

CVE-2023-28640 Permissions bypass in Apiman could enable authenticated attacker to unpermitted API Key

Apiman is a flexible and open source API Management platform. Due to a missing permissions check, an attacker with an authenticated Apiman Manager account may be able to gain access to API keys they do not have permission for if they correctly guess the URL, which includes Organisation ID, Client...

CVE-2023-28640 Permissions bypass in Apiman could enable authenticated attacker to unpermitted API Key

Apiman is a flexible and open source API Management platform. Due to a missing permissions check, an attacker with an authenticated Apiman Manager account may be able to gain access to API keys they do not have permission for if they correctly guess the URL, which includes Organisation ID, Client...

PT-2023-20953 · Unknown · Opengoofy Hippo4J

Name of the Vulnerable Software and Affected Versions: OpenGoofy Hippo4j version 1.4.3 Description: The issue allows an attacker to obtain sensitive information via the ConfigVerifyController function of the Tenant Management module. Recommendations: For OpenGoofy Hippo4j version 1.4.3, consider...

PT-2023-20006 · Stimulsoft · Stimulsoft Designer +1

Name of the Vulnerable Software and Affected Versions: Stimulsoft Designer Desktop versions 2023.1.4 through 2023.1.5 Description: The issue allows an attacker to decrypt connection strings stored in .mrt files by decompiling the Stimulsoft.report.dll, as it uses a static secret that does not...

PT-2023-21860 · Gocd · Gocd

Name of the Vulnerable Software and Affected Versions: GoCD versions prior to 23.1.0 Description: The issue is a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An...

Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file existence check exploit if they are not limiting who can query their server for...

PT-2023-17701 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-11 through Android-13 Description: The issue is related to a possible failure to persist permission settings due to resource exhaustion in the addPermission method of PermissionManagerServiceImpl.java. This could lead...

PT-2023-17763 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android version Android-13 Description: In the getAvailabilityStatus function of EnableContentCapturePreferenceController.java, there is a possible way to bypass DISALLOW CONTENT CAPTURE due to a permissions bypass. This could lead to local...

PT-2023-7429 · Unknown · Osprey Pump Controller

Name of the Vulnerable Software and Affected Versions: Osprey Pump Controller version 1.01 Description: The issue is related to an unauthenticated OS command injection vulnerability. This vulnerability can be exploited to inject and execute arbitrary shell commands through a HTTP POST parameter...

PT-2023-17116 · Rebuild · Rebuild

Name of the Vulnerable Software and Affected Versions: Rebuild versions up to 3.2.3 Description: A critical issue has been found in Rebuild, affecting some unknown functionality of the file /project/tasks/list. The manipulation leads to sql injection. The attack may be launched remotely...

PT-2023-17104 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: novel-plus version 3.6.2 Description: A critical issue has been found in an unknown functionality of the file common/log/list. The manipulation of the sort argument leads to SQL injection. The attack can be launched remotely. Recommendations:...

PT-2023-20074 · Klaviyo · Klaviyo

Name of the Vulnerable Software and Affected Versions: Klaviyo plugin versions 3.0.7 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject malicious scripts into the application,...

PT-2023-21895 · Jenkins · Jenkins Octoperf Load Testing Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OctoPerf Load Testing Plugin Plugin versions 4.5.2 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials. T...

PT-2023-20215 · Basercms · Basercms

Name of the Vulnerable Software and Affected Versions: baserCMS versions prior to 4.7.5 Description: The issue allows any file to be uploaded on the management system of baserCMS. This poses a risk, especially when the management system is used by multiple users. The vulnerability enables malicio...

PT-2023-2257 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software versions prior to the fixed version Cisco Firepower Threat Defense FTD Software versions prior to the fixed version Description: The issue is related to the deterministic random bit generator DRB...

PT-2023-21885 · WordPress · Formidable Pro2Pdf Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Formidable PRO2PDF WordPress Plugin versions prior to 3.11 Description: The issue is an authenticated SQL injection vulnerability. It affects the fieldmap parameter in the fpropdf export file action. Recommendations: For versions prior to 3.1...

PT-2023-21881

Name of the Vulnerable Software and Affected Versions The Waiting: One-click Countdowns WordPress Plugin version = 0.6.2 Description The issue is an authenticated SQL injection vulnerability. It affects the pbc downmetaid parameter of the pbc save downs action. Recommendations For versions = 0.6....

PT-2023-2196 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions prior to 1.0.5 Description: The issue is related to a deserialization vulnerability in the Device-gateway service, which could allow deserialization of requests prior to authentication,...

PT-2023-20244 · Ibm · Ibm Security Guardium Key Lifecycle Manager

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium Key Lifecycle Manager versions 3.0 through 4.1.1 Description: The issue allows a local user to read user credentials stored in plain clear text. Recommendations: For versions 3.0 through 4.1.1, consider restricting acces...