ALPINE-CVE-2023-38497

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local...

PT-2023-5504 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI versions 5.11.1 and below Description: A Cross-site scripting XSS vulnerability in the Custom Logo component allows authenticated attackers to inject arbitrary javascript or HTML via the alt-text field. This affects all pages...

PT-2023-26701 · Wbce Cms · Wbce Cms

Name of the Vulnerable Software and Affected Versions: WBCE CMS version 1.6.1 Description: An arbitrary file upload issue in the /languages/install.php component allows attackers to execute arbitrary code via a crafted PHP file. The "languages/install.php" component is specifically vulnerable,...

PT-2023-9267 · Rust +10 · Cargo +10

Name of the Vulnerable Software and Affected Versions: Cargo versions prior to 0.72.2 Rust versions prior to 1.71.1 Description: The issue is related to the Cargo package manager for the Rust programming language, which ignores umask when extracting archives created in UNIX-like systems. This cou...

PT-2023-23314 · Brocade · Brocade Fabric Os

Name of the Vulnerable Software and Affected Versions: Brocade Fabric OS versions prior to 9.1.1c Brocade Fabric OS versions prior to 8.2.3d Brocade Fabric OS versions prior to 9.2.0 Description: The issue concerns the Brocade Fabric OS Commands "configupload" and "configdownload" which print scp...

PT-2023-24390 · Phpjabbers · Php Jabbers Time Slots Booking Calendar

Name of the Vulnerable Software and Affected Versions: PHPJabbers Time Slots Booking Calendar version 3.3 Description: The issue is related to a Cross Site Scripting XSS vulnerability. This vulnerability is found in the theme parameter of the "preview.php" file. Recommendations: For PHPJabbers Ti...

PT-2023-4177 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: MLflow versions prior to 2.6.0 Description: The issue exists due to the failure to neutralize special elements used in an operating system command. This could allow an attacker to execute arbitrary commands or cause a denial of service. The...

PT-2023-11596 · Yunyecms · Yunyecms

Name of the Vulnerable Software and Affected Versions: yunyecms version 2.0.2 Description: The issue allows remote attackers to run arbitrary SQL commands via the XFF variable. This can potentially lead to unauthorized access and manipulation of database content. Recommendations: For yunyecms...

PT-2023-4159 · Webmin +1 · Webmin +1

Name of the Vulnerable Software and Affected Versions: Webmin version 2.021 Description: An issue was discovered in the download functionality, allowing an attacker to exploit a Cross-Site Scripting XSS vulnerability. By providing a crafted download path containing a malicious payload, an attacke...

PT-2023-26058 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SEMCMS version 1.5 Description: The issue is a SQL injection vulnerability. It can be exploited via the id parameter at the "/Ant Suxin.php" API endpoint. Recommendations: For SEMCMS version 1.5, as a temporary workaround, consider restrictin...

PT-2023-4160 · Webmin +1 · Webmin +1

Name of the Vulnerable Software and Affected Versions: Webmin version 2.021 Description: A Cross-site Scripting XSS Bypass vulnerability was discovered in the file upload functionality of Webmin. Normally, the application restricts the upload of certain file types such as .svg, .php, etc., and...

PT-2023-26173 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.0.6 of the stable branch Discourse versions prior to 3.1.0.beta7 of the beta and tests-passed branches Description: Discourse is an open source discussion platform. The issue allows more users than permitted to b...

PT-2023-27133 · Sourcecodester · Sourcecodester Online Jewelry Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Jewelry Store version 1.0 Description: A critical issue has been found in the login.php file, where the manipulation of the username and password arguments leads to sql injection. The attack can be initiated remotely...

PT-2023-26229 · WordPress · Wpkube Authors List

Name of the Vulnerable Software and Affected Versions: WPKube Authors List plugin versions = 2.0.2 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, potentiall...

PT-2023-24470 · Teleadapt · Teleadapt Roomcast Ta-2400

Name of the Vulnerable Software and Affected Versions: TeleAdapt RoomCast TA-2400 versions 1.0 through 3.1 Description: The issue concerns Improper Privilege Management. After establishing an adb connection, accessing the shell and entering the su command provides root access without requiring a...

PT-2023-20829 · Prestashop · Prestashop Sendinblue

Name of the Vulnerable Software and Affected Versions: PrestaShop sendinblue versions 4.0.15 and earlier Description: A SQL injection issue allows a remote attacker to gain privileges via the ajaxOrderTracking.php component. Recommendations: For PrestaShop sendinblue versions 4.0.15 and earlier,...

PT-2023-13039 · Trudesk · Trudesk

Name of the Vulnerable Software and Affected Versions: Truedesk version 1.2.2 Description: A cross-site scripting issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the team name parameter. Recommendations: For Truedesk version 1.2.2, avoid using t...

PT-2023-15100 · Vocera · Vocera Voice Server +1

Name of the Vulnerable Software and Affected Versions: Vocera Report Server and Voice Server versions 5.x through 5.8 Description: An issue was discovered that allows for Arbitrary File Upload. The BaseController class, which each of the service controllers derives from, permits the upload of...

PT-2023-26581 · Unknown · Campcodes Beauty Salon Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Beauty Salon Management System version 0.1.0 Description: A critical issue has been found in the system, affecting an unknown functionality of the file /admin/del feedback.php. The manipulation of the id argument leads to sql...

PT-2023-13040 · Rtx Trap · Rtx Trap

Name of the Vulnerable Software and Affected Versions: RTX TRAP version 1.0 Description: The issue allows attackers to perform a directory traversal via a crafted request sent to the endpoint "/data/". Recommendations: For RTX TRAP version 1.0, as a temporary workaround, consider restricting acce...