PT-2023-29060 · Unknown · Dm Concept Configurator

Name of the Vulnerable Software and Affected Versions: DM Concept configurator versions prior to 4.9.4 Description: The issue is related to a SQL injection vulnerability via the component ConfiguratorAttachment::getAttachmentByToken. Recommendations: For versions prior to 4.9.4, update to version...

PT-2023-6237 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX, and Windows includes Db2 Connect Server version 11.5 Description: The issue is related to errors in processing input data, which can be exploited by a remote attacker to cause a denial of service with a specially...

PT-2023-27634 · Icewarp · Icewarp Mail Server Deep Castle 2

Name of the Vulnerable Software and Affected Versions: IceWarp Mail Server Deep Castle 2 version 13.0.1.2 Description: An issue in IceWarp Mail Server Deep Castle 2 allows a remote attacker to execute arbitrary code via a crafted request to the URL. Recommendations: For IceWarp Mail Server Deep...

PT-2023-27640 · Phicomm · Phicomm K2

Name of the Vulnerable Software and Affected Versions: Phicomm k2 version 22.6.529.216 Description: The Phicomm k2 router contains a command injection vulnerability via the luci.sys.call function. This issue allows for remote command execution. Recommendations: For Phicomm k2 version 22.6.529.216...

PT-2023-4762 · Vim +1 · Vim +1

Name of the Vulnerable Software and Affected Versions: vim version 8.2.2348 Description: The issue is related to a null pointer dereference in the ex buffer all method, which allows local attackers to cause a denial of service DoS. Recommendations: For vim version 8.2.2348, consider disabling the...

PT-2023-22882 · Samsung · Samsung Telecom

Name of the Vulnerable Software and Affected Versions: Samsung Telecom versions prior to SMR Aug-2023 Release 1 Description: The issue is related to improper access control, allowing local attackers to call the "acceptRingingCall" API without permission. Recommendations: For versions prior to SMR...

PT-2023-26736 · Duke · Duke

Name of the Vulnerable Software and Affected Versions: Duke versions 1.2 and below Description: The issue is related to a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.init. Recommendations: For Duke versions 1.2 and below, consider disabling the...

Ivanti Releases Urgent Patch for EPMM Zero-Day Vulnerability Under Active Exploitation

Ivanti is warning users to update their Endpoint Manager Mobile EPMM mobile device management software formerly MobileIron Core to the latest version that fixes an actively exploited zero-day vulnerability. Dubbed CVE-2023-35078, the issue has been described as a remote unauthenticated API access...

PT-2023-12517 · WordPress · Elasticpress

Name of the Vulnerable Software and Affected Versions: ElasticPress plugin for WordPress versions up to, and including, 3.5.3 Description: The issue is due to missing or incorrect nonce validation on the epio send autosuggest allowed function, making it possible for unauthenticated attackers to...

PT-2023-15713 · Google · Widevine Trusted Application

Name of the Vulnerable Software and Affected Versions: Widevine Trusted Application TA versions 5.0.0 through 5.1.1 Description: The issue is related to an integer overflow and resultant buffer overflow in the drm verify keys function, specifically with the total len+file name len calculation. Th...

PT-2023-22402 · Twilight · Twilight

Name of the Vulnerable Software and Affected Versions: Twilight version 13.3 Description: The issue allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference files. This can lead to unauthorized access and control. Recommendations: For Twilight version...

PT-2023-24601

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 12.5.6 Description OpenProject is web-based project management software. A robots.txt file is generated to denote which routes shall or shall not be accessed by crawlers, containing project identifiers of all publ...

PT-2023-23366 · Altenergy · Altenergy Power Control

Name of the Vulnerable Software and Affected Versions: Altenergy Power Control Software version C1.2.5 Description: The issue is related to a remote code execution RCE vulnerability. It affects the component /models/management model.php, allowing for potential exploitation. Recommendations: For...

PT-2023-23511 · Unknown · Jerryscript

Name of the Vulnerable Software and Affected Versions: Jerryscript version 3.0.0 Description: A heap-buffer-overflow issue was discovered in Jerryscript via the component scanner literal is created at /jerry-core/parser/js/js-scanner-util.c. Recommendations: For Jerryscript version 3.0.0, conside...

PT-2023-23621 · Sap · S4Core +1

Name of the Vulnerable Software and Affected Versions: SAP APPL versions 500 through 618 S4CORE version 100 Description: The Vendor Master Hierarchy does not perform necessary authorization checks for an authenticated user to access some of its functions. This could lead to modification of data...

PT-2023-12929 · Tooljet · Tooljet

Name of the Vulnerable Software and Affected Versions: ToolJet version 1.6.0 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component. Recommendations: For ToolJet version 1.6.0, consider...

PT-2023-17437 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: novel-plus version 3.6.2 Description: A critical issue was found in the software, affecting an unknown functionality of the file "/category/list?limit=10&offset=0&order=desc". The manipulation of the sort argument leads to SQL injection. This...

PT-2023-22742 · Jenkins · Jenkins Kubernetes Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Kubernetes Plugin versions 3909.v1f2c633e8590 and earlier Description: The issue arises from the Jenkins Kubernetes Plugin not properly masking credentials in the build log when push mode for durable task logging is enabled. This...

PT-2023-2623 · Nexx · Nexx Garage Door Controller +3

Name of the Vulnerable Software and Affected Versions: Nexx Smart Home devices affected versions not specified Nexx Garage Door Controller NXG-100B, NXG-200 Nexx Smart Plug NXPG-100W Nexx Smart Alarm NXAL-100 Description: The issue is related to weaknesses in the authentication procedure of Nexx...

PT-2023-17019 · Hkcms · Hkcms

Name of the Vulnerable Software and Affected Versions: HkCms version 2.2.4.230206 Description: A problematic issue was found in the External Plugin Handler component, affecting an unknown part of the file /admin.php/appcenter/local.html?type=addon. This issue leads to code injection and can be...