PT-2023-23836 · WordPress · Sybre Waaijer Pro Mime Types

Name of the Vulnerable Software and Affected Versions: Sybre Waaijer Pro Mime Types – Manage file media types plugin versions = 1.0.7 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-24844 · Didier Stevens · Spamreferrerblock

Name of the Vulnerable Software and Affected Versions: Didier Sampaolo SpamReferrerBlock plugin versions = 2.22 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on...

PT-2023-24721 · Peter Shaw · Lh Password Changer Plugin

Name of the Vulnerable Software and Affected Versions: Peter Shaw LH Password Changer plugin versions = 1.55 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a...

PT-2023-32475 · Lanaccess · Lanaccess Onsafe Monitorhm

Name of the Vulnerable Software and Affected Versions: Lanaccess ONSAFE MonitorHM version 3.7.0 Description: An improper input validation issue has been found, which could allow a remote attacker to exploit the checkbox element and perform remote code execution, potentially compromising the entir...

PT-2023-9645 · Cisco · Cisco Industrial Ethernet 5000 +3

Name of the Vulnerable Software and Affected Versions: Cisco Industrial Ethernet 4000, 4010, and 5000 Series Switches affected versions not specified Description: The issue is related to the incorrect handling of IPv4 access control lists ACLs on switched virtual interfaces when an administrator...

PT-2023-28488 · Ipswitch · Ws Ftp Server

Name of the Vulnerable Software and Affected Versions: WS FTP Server versions prior to 8.7.6 WS FTP Server versions prior to 8.8.4 Description: An issue has been identified in WS FTP Server where an authenticated Ad Hoc Transfer user can upload a file to a specified location on the underlying...

PT-2023-14762 · WordPress · Icegram Express

Name of the Vulnerable Software and Affected Versions: Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce versions through 5.5.2 Description: The issue is related to the improper neutralization of formula elements in a CSV file, which affects Icegram Express...

PT-2023-14588 · Solwin Infotech · User Blocker

Name of the Vulnerable Software and Affected Versions: Solwin Infotech User Blocker versions 1.5.5 and earlier Description: The issue is related to the improper neutralization of formula elements in a CSV file, which affects the User Blocker software. Recommendations: For versions 1.5.5 and...

PT-2023-32029 · Puppet · Puppet Enterprise

Name of the Vulnerable Software and Affected Versions: Puppet Enterprise versions prior to 2021.7.6 Puppet Enterprise versions prior to 2023.5 Description: The issue results in broken session management for SAML implementations. Recommendations: For versions prior to 2021.7.6, update to version...

ALSA-2023:6667 Moderate: samba security, bug fix, and enhancement update

Samba is an open-source implementation of the Server Message Block SMB protocol and the related Common Internet File System CIFS protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have been upgraded to a later upstream version:...

PT-2023-6926 · Freebsd · Freebsd

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 12.4-RELEASE prior to 12.4-RELEASE-p7 FreeBSD versions 13.2-RELEASE prior to 13.2-RELEASE-p5 Description: The sflush stdio function in libc does not correctly update FILE objects' write space members for write-buffered stream...

JVN#29195731: EC-CUBE 3 series and 4 series vulnerable to arbitrary code execution

EC-CUBE 3 series and 4 series provided by EC-CUBE CO.,LTD. contain an arbitrary code execution vulnerability CWE-94 due to improper settings of the product's template engine "Twig". Impact Arbitrary code may be executed on the server where the product is running by a user with an administrative...

CVE-2023-23369 QTS, Multimedia Console, and Media Streaming add-on

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 2023/05/04 and...

Low: vim

Issue Overview: The severity level was changed from Medium to Low. NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960. CVE-2023-5441 Use After Free in GitHub repository vim/vim prior to v9.0.2010. CVE-2023-5535 Affected Packages: vim Issue...

Improper restriction of XML external entity references (XXE) in e-Tax software

Overview e-Tax software provided by National Tax Agency improperly restricts XML external entity references XXE CWE-611 due to the configuration of the embedded XML parser. Toyama Taku of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Informatio...

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Access VPN Denial of Service Vulnerability

A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to imprope...

Cisco Firepower Threat Defense Software and Firepower Management Center Software Code Injection Vulnerability

A vulnerability in the inter-device communication mechanisms between devices that are running Cisco Firepower Threat Defense FTD Software and devices that are running Cisco Firepower Management FMC Software could allow an authenticated, local attacker to execute arbitrary commands with root...

Cisco Firepower Threat Defense Software SMB Protocol Snort 3 Detection Engine Bypass and Denial of Service Vulnerability

A vulnerability in the interaction between the Server Message Block SMB protocol preprocessor and the Snort 3 detection engine for Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass the configured policies or cause a denial of service DoS conditi...

Cisco Firepower Threat Defense Software Snort 3 Detection Engine Denial of Service Vulnerability

A vulnerability in the TLS 1.3 implementation of the Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to unexpectedly restart. This vulnerability is due to a logic error in how memory allocations are handled during a...

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SAML Assertion Hijack Vulnerability

A vulnerability in the implementation of Security Assertion Markup Language SAML 2.0 single sign-on SSO for remote access VPN in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to intercept the SAML...