PT-2023-21887 · WordPress · Inpost Gallery

Name of the Vulnerable Software and Affected Versions: InPost Gallery WordPress plugin versions prior to 2.2.2 Description: The issue is a reflected cross-site scripting vulnerability. It affects the imgurl parameter to the add inpost gallery slide item action and can only be triggered by an...

Sentry 安全漏洞

Mobileiron Sentry is a smart gateway product from Mobileiron. A security vulnerability exists in Sentry versions prior to 1.14.0. An attacker could exploit this vulnerability to disclose sensitive cookie values...

PT-2023-20844 · Evolucare · Evolucare Ecsimaging

Name of the Vulnerable Software and Affected Versions: EVOLUCARE ECSIMAGING aka ECS Imaging versions prior to 6.21.5 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It can be exploited via the new movie.php file. Recommendations: For versions prior to 6.21.5, update to...

Code injection

Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file...

CVE-2023-27983

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow deletion of reports from the IGSS project report directory, this would lead to loss of data when an attacker abuses this functionality. Affected Products: IGSS Data...

CVE-2023-1542

Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6...

CVE-2023-1527

Cross-site Scripting XSS - Generic in GitHub repository tsolucio/corebos prior to 8.0...

PT-2023-14017 · Visam · Visam Vbase Automation Base

Name of the Vulnerable Software and Affected Versions: VISAM VBASE Automation Base versions prior to 11.7.5 Description: The issue may disclose information if a valid user opens a specially crafted file. This is related to XML External Entity Processing in the FB.XML file parsing. Recommendations...

PT-2023-16786 · Pacsrapor · Pacsrapor

Name of the Vulnerable Software and Affected Versions: Pacsrapor versions prior to 1.22 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. Recommendations: For versions prior to 1.22,...

CVE-2023-1537 Authentication Bypass by Capture-replay in answerdev/answer

Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6...

PT-2023-17064 · Answer +3 · Answer +2

Name of the Vulnerable Software and Affected Versions: answer versions prior to 1.0.6 Description: The issue concerns insufficient session expiration. Recommendations: For versions prior to 1.0.6, update to version 1.0.6 or later to resolve the issue...

CVE-2023-1517

Cross-site Scripting XSS - DOM in GitHub repository pimcore/pimcore prior to 10.5.19...

PT-2023-16593 · WordPress · Shortcodes Ultimate

Name of the Vulnerable Software and Affected Versions: Shortcodes Ultimate WordPress plugin versions prior to 5.12.8 Description: The issue allows any authenticated users, such as subscribers, to view draft, private, or even password-protected posts. It is also possible to leak the password of...

WordPress Plugin ProfileGrid 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2023-1515 Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting XSS - Stored in GitHub repository pimcore/pimcore prior to 10.5.19...

curl 授权问题漏洞

curl is libcurl is got is A security vulnerability exists in curl versions prior to 8.0 that stems from an authentication bypass vulnerability that could lead to unauthorized access to sensitive information...

PT-2023-7399 · WordPress · Groundhogg

Name of the Vulnerable Software and Affected Versions: Groundhogg WordPress plugin versions prior to 2.7.9.4 Description: The issue is related to the Groundhogg WordPress plugin, which does not properly sanitize and escape a parameter before using it in a SQL statement. This leads to a SQL...

CVE-2023-1496 Cross-site Scripting (XSS) - Reflected in imgproxy/imgproxy

Cross-site Scripting XSS - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0...

PT-2023-19958 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.0.1 of the stable branch Discourse versions prior to 3.1.0.beta2 of the beta and tests-passed branches Description: Discourse is an open-source discussion platform. A maliciously crafted URL can be included in a...

PT-2023-21564 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: Pimcore versions prior to 10.5.19 Description: Pimcore is an open source data and experience management platform. An attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Recommendations: For versions prior...