PT-2023-30533 · WordPress · Registrationmagic

Name of the Vulnerable Software and Affected Versions: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login versions n/a through 5.2.2.6 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions. The estimated...

PT-2023-31052 · Unknown · Symbolicator

Name of the Vulnerable Software and Affected Versions: Symbolicator versions prior to 23.11.2 Description: The issue allows an attacker to make Symbolicator send arbitrary GET HTTP requests to internal IP addresses by using a specially crafted HTTP endpoint. The response could be reflected to the...

PT-2023-32667 · Zentaopms · Zentaopms

Name of the Vulnerable Software and Affected Versions: ZenTao PMS version 18.8 Description: A problematic vulnerability was found in the software, affecting an unknown functionality, which leads to cross-site scripting. The attack can be launched remotely. The exploit has been disclosed to the...

PT-2023-30932 · Woocommerce · License Manager For Woocommerce

Name of the Vulnerable Software and Affected Versions: License Manager for WooCommerce versions 2.2.10 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-8992 · Gl.Inet · Gl-Inet Ax1800

Name of the Vulnerable Software and Affected Versions: GL.iNet AX1800 versions 4.0.0 through 4.4.x Description: The issue is related to insecure permissions, allowing a remote attacker to execute arbitrary code via the "upload API function". This can be achieved by sending a request to the "uploa...

PT-2023-30759 · Woocommerce · Decorator – Woocommerce Email Customizer

Name of the Vulnerable Software and Affected Versions: Decorator – WooCommerce Email Customizer versions 1.2.7 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Decorator – WooCommerce Email Customizer, allowing unauthorized actions. This can be exploited through Cross...

PT-2023-31017 · Openlink +1 · Openlink Virtuoso-Opensource +1

Name of the Vulnerable Software and Affected Versions: openlink virtuoso-opensource version 7.2.11 Description: An issue in the box deserialize reusing function allows attackers to cause a Denial of Service DoS after running a SELECT statement. Recommendations: For openlink virtuoso-opensource...

PT-2023-32607 · Unknown · Jeecgboot Jimureport

Name of the Vulnerable Software and Affected Versions: jeecgboot JimuReport versions up to 1.6.1 Description: A critical vulnerability was found in jeecgboot JimuReport, affecting an unknown functionality of the file /download/image. The manipulation of the imageUrl argument leads to relative pat...

PT-2023-32232 · WordPress · Martins Free & Easy Seo Backlink Link Building Network

Name of the Vulnerable Software and Affected Versions: The Martins Free & Easy SEO BackLink Link Building Network WordPress plugin versions prior to 1.2.30 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitized and escaped before...

PT-2023-7504 · D Link · D-Link Dar-7000

Name of the Vulnerable Software and Affected Versions: D-Link DAR-7000 up to 20231126 Description: A critical vulnerability has been found in the D-Link DAR-7000, affecting the file /user/inc/workidajax.php. The issue is related to the lack of protection against SQL injection when handling the id...

PT-2023-31143 · Unknown · Uptime Kuma

Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.23.7 Description: The Google Analytics element in Uptime Kuma is vulnerable to Attribute Injection, leading to Cross-Site-Scripting XSS attacks. This occurs because the custom status interface can set an...

PT-2023-30775 · Unknown · Capsule-Proxy

Name of the Vulnerable Software and Affected Versions: capsule-proxy versions prior to 0.4.6 Description: The issue is a privilege escalation vulnerability based on a missing check if the user is authenticated based on the TokenReview result. This affects clusters running with the anonymous-auth...

PT-2023-7469 · Openssl · Openssl

Name of the Vulnerable Software and Affected Versions: openssl aka node-openssl versions through 2.0.0 Description: The issue is related to the absence of input data sanitization in the openssl package of the NPM package manager. This allows a remote attacker to execute arbitrary commands by...

PT-2023-7273 · Sysaid · Sysaid

Name of the Vulnerable Software and Affected Versions: SysAid versions prior to 23.2.15 Description: The issue allows for Indirect Object Reference IDOR attacks, enabling unauthorized access to protected information. This can be achieved by modifying the sid parameter to EmailHtmlSourceIframe.jsp...

PT-2023-28688 · Dell · Powerprotect Agent For File System

Name of the Vulnerable Software and Affected Versions: PowerProtect Agent for File System versions 19.14 and prior Description: The issue is related to incorrect default permissions in the ddfscon component, allowing a low-privileged local attacker to potentially overwrite log files...

PT-2023-31056 · 7 Zip · 7Za

Name of the Vulnerable Software and Affected Versions: NZBGet version 21.1 Description: The issue allows authenticated remote code execution due to the unarchive programs 7za and unrar preserving executable file permissions. An attacker with Control capability can execute a file by setting the...

PT-2023-32557 · Unknown · Getsimple Cms

Name of the Vulnerable Software and Affected Versions: GetSimpleCMS versions 3.3.16 through 3.4.0a Description: A critical issue affects the processing of the file /admin/theme-edit.php, leading to code injection. The attack can be initiated remotely. Recommendations: For versions 3.3.16 through...

PT-2023-30726 · Grocy · Grocy

Name of the Vulnerable Software and Affected Versions: Grocy version 4.0.3 Description: The issue allows a local attacker to execute arbitrary code and obtain sensitive information via the equipment description component within the "/equipment/" component. Recommendations: For Grocy version 4.0.3...

PT-2023-30695 · Unknown · Xxl-Job-Admin

Name of the Vulnerable Software and Affected Versions: xxl-job-admin version 2.4.0 Description: The issue allows for Remote Code Execution RCE via the /xxl-job-admin/jobcode/save API endpoint. Recommendations: For xxl-job-admin version 2.4.0, as a temporary workaround, consider restricting access...

PT-2023-7288 · Unknown · Weston Embedded Uc-Http

Name of the Vulnerable Software and Affected Versions: Weston Embedded uC-HTTP version 3.01.01 Description: A memory corruption issue exists in the HTTP Server header parsing functionality. This can be exploited by sending specially crafted network packets, potentially leading to code execution. ...