PT-2023-20717 · Amember · Amember

Name of the Vulnerable Software and Affected Versions: asMember plugin versions = 1.5.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For asMember plugin versions = 1.5.4, update ...

PT-2023-3645 · D Link · D-Link Dsl-G256Dg +1

Name of the Vulnerable Software and Affected Versions: D-Link DSL-224 version 3.0.10 D-Link DSL-G256DG affected versions not specified Description: The issue is related to a command execution vulnerability that can be exploited after authentication. It is associated with deficiencies in the...

PT-2023-21293 · WordPress +1 · Wordpress +2

Name of the Vulnerable Software and Affected Versions: WordPress File Upload and WordPress File Upload Pro plugins for WordPress versions up to, and including, 4.19.1 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and...

PT-2023-23096 · Kylinsoft · Youker-Assistant

Name of the Vulnerable Software and Affected Versions: KylinSoft youker-assistant versions prior to 3.0.2-0kylin6k70-23 Description: A critical issue has been found in the restore all sound file function, allowing for path traversal manipulation, such as '../filedir'. This issue requires local...

PUB-A-260569414

In btmreadlinkqualitycomplete of btmacl.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure over Bluetooth with System execution privileges needed. User interaction is not needed for exploitation...

Vulnerabilities fixed in Microsoft Developer Tools

Microsoft has fixed vulnerabilities in two Developer Tools. In order to exploit the vulnerabilities, the malicious party must have local access to the development environment. SysInternals: |----------------|------|-------------------------------------| | CVE-ID | CVSS | Impact |...

CVE-2023-26058

An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as...

CVE-2022-44594

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Codebangers All in One Time Clock Lite plugin = 1.3.320 versions...

PT-2023-19548 · Wpdevart · Wpdevart Organization Chart Plugin

Name of the Vulnerable Software and Affected Versions: WPdevart Organization chart plugin versions prior to 1.4.5 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with admin+ authentication. This type of vulnerability allows an attacker to...

Vulnerabilities fixed in Cisco Prime Infrastructure and Evolved Programmable Network Manager (EPNM)

Cisco has fixed vulnerabilities in the web management interface of Prime Infrastructure and Evolved Programmable Network Manager EPNM. A malicious person with access to the management interface can exploit the exploit vulnerabilities to obtain system information, or to execute commands in the...

PYSEC-2023-56

Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and documents, files are loaded into memory during upload for additional processing. A use...

ABB AC500 Allocation of Resources Without Limits or Throttling (CVE-2020-24685)

An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service DoS vulnerability. Vulnerability allows attacker to stop the PLC. After stopping ERR LED flashing red, physical access to the PLC is required in order to restart the application. This...

PT-2023-17140 · Iobit · Iobit Malware Fighter

Name of the Vulnerable Software and Affected Versions: IObit Malware Fighter version 9.4.0.776 Description: A problematic vulnerability was found in the IOCTL Handler component of the library ObCallbackProcess.sys, affecting the function 0x222034/0x222038/0x22203C/0x222040. This leads to denial o...

CVE-2023-21010

In multiple locations of p2piface.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...

CVE-2023-1491

A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1. It has been classified as critical. This affects the function 0x220020 in the library MaxCryptMon.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. Local access is required to approach...

PT-2023-17028 · Max Secure · Max Secure Anti Virus Plus

Name of the Vulnerable Software and Affected Versions: Max Secure Anti Virus Plus version 19.0.2.1 Description: A critical issue has been found, affecting the 0x220020 function in the MaxCryptMon.sys library of the IoControlCode Handler component. This leads to improper access controls, requiring...

CVE-2023-1452

A vulnerability was found in GPAC 2.3-DEV-rev35-gbbca86917-master. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file filters/loadtext.c. The manipulation leads to buffer overflow. Local access is required to approach this attack. The exploit...

CVE-2023-25147

An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection by using a specifically crafted DLL during a specific update process. Please note: an attacker must first obtain administrative access on t...

CVE-2023-1048

A vulnerability, which was classified as critical, has been found in TechPowerUp Ryzen DRAM Calculator 1.2.0.5. This issue affects some unknown processing in the library WinRing0x64.sys. The manipulation leads to improper initialization. Local access is required to approach this attack. The explo...

PT-2023-13991 · Tibco Software · Tibco Product/Service Catalog +1

Name of the Vulnerable Software and Affected Versions: TIBCO EBX versions 5.9.21 and below TIBCO EBX versions 6.0.11 and below TIBCO Product and Service Catalog powered by TIBCO EBX versions 1.2.0 and below Description: The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO...