PT-2023-2666 · Oracle · Oracle Sql Developer

Name of the Vulnerable Software and Affected Versions: Oracle SQL Developer versions prior to 23.1.0 Description: The issue is related to insufficient input validation in the Installation component of Oracle SQL Developer, allowing a high-privileged attacker with logon to the infrastructure where...

PT-2023-2639 · Oracle · Oracle Banking Payments

Name of the Vulnerable Software and Affected Versions: Oracle Banking Payments versions 14.5 through 14.7 Description: The issue is related to insufficient input validation in the Book/Internal Transfer component of Oracle Banking Payments, allowing a remote attacker to gain read, modify, add, or...

SUSE-SU-2023:1867-1 Security update for gradle

This update for gradle fixes the following issues: - CVE-2021-29428: Fixed a local privilege escalation through system temporary directory. bsc1184807...

PT-2023-22058 · Juniper Networks +1 · Juniper Networks Paragon Active Assurance +1

Name of the Vulnerable Software and Affected Versions: Juniper Networks Paragon Active Assurance versions prior to 4.1.2 Description: An issue in the timescaledb feature of Juniper Networks Paragon Active Assurance allows an attacker to bypass existing firewall rules and limitations used to...

PT-2023-14539 · Unknown · Touchdown Timesheet Tracking Component For Jira

Name of the Vulnerable Software and Affected Versions: TouchDown Timesheet tracking component for Jira version 4.1.4 Description: The issue allows for XSS in the calendar view. Recommendations: For version 4.1.4, update to a version that fixes the XSS issue in the calendar view, as the current...

JVN#87559956: Joruri Gw vulnerable to cross-site scripting

Joruri Gw provided by SiteBridge Inc. is groupware. Message Memo function of Joruri Gw contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is accessing the specific page of the product. Solution Update the software...

PT-2023-16512 · Bestwebsoft · The Gallery

Name of the Vulnerable Software and Affected Versions: The Gallery by BestWebSoft WordPress plugin versions prior to 4.7.0 Description: The issue arises from improper sanitization of gallery information, leading to a Stored Cross-Site Scripting vulnerability. An attacker must have at least the...

PT-2023-22714 · WordPress · Kilian Evang Ultimate Noindex Nofollow Tool Ii

Name of the Vulnerable Software and Affected Versions: Kilian Evang Ultimate Noindex Nofollow Tool II plugin versions prior to 1.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-14289 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev30 Description: The issue allows for cross-site scripting XSS via an activity tracking adapter defined by jslob. This can potentially lead to malicious script execution on the client-side...

SUSE-SU-2023:1856-1 Security update for tftpboot-installation images

This update provides updated tftboot-installation images, rebuilt with current shim and kernels. bsc1209014 bsc1198581...

JVN#36340790: JB Inquiry form vulnerable to exposure of private personal information to an unauthorized actor

JB Inquiry form provided by Jubei Inc. contains an exposure of private personal information to an unauthorized actor vulnerability CWE-359 . Impact A remote attacker may obtain information entered from forms created using the affected product. Solution Update the Software Update to the latest...

PT-2023-14648 · Silkalns · Activello Theme

Name of the Vulnerable Software and Affected Versions: Silkalns Activello theme versions = 1.4.4 Description: The issue is related to an Authenticated Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker could potentially inject malicious scripts into the website, which...

PT-2023-22202 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions prior to 14.8RC1 Description: The HTML macro in XWiki does not properly neutralize script-related HTML tags, allowing any user who can use the HTML macro to introduce an XSS attack. This is particularly dangerous in a standard...

PT-2023-22201 · Xwiki · Xwiki Commons

Name of the Vulnerable Software and Affected Versions: XWiki Commons versions prior to 13.10.10 XWiki Commons versions prior to 14.4.4 XWiki Commons versions prior to 14.8RC1 Description: It is possible to bypass the existing security measures put in place to avoid open redirect by using a redire...

PT-2023-21993 · Siemens · Polarion Alm

Name of the Vulnerable Software and Affected Versions: Polarion ALM versions prior to V22R2 Polarion ALM versions prior to V2304.0 Description: A XML External Entity Injection XXE vulnerability has been identified in the application. This could allow an attacker to view files on the application...

PT-2023-6616 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension versions 3.4.8 and earlier Description: The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user...

PT-2023-6436 · Adobe · Acrobat 2020 +3

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat versions prior to 23.001.20094 Adobe Acrobat Reader versions 23.001.20093 and earlier Adobe Acrobat 2020 versions prior to 20.005.30442 Adobe Acrobat Reader 2020 versions 20.005.30441 and earlier Description: The issue is relate...

PT-2023-13514 · Hitachi Vantara · Pentaho Business Analytics Server

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.3.0.0 Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.2.0.4 Hitachi Vantara Pentaho Business Analytics Server versions prior to 8.3.0.27 Description:...

Medium: python-werkzeug

Issue Overview: Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =Host-test=bad for...

PT-2023-20043

Name of the Vulnerable Software and Affected Versions Allegro Tech BigFlow versions prior to 1.6.0 Description The issue is related to Missing SSL Certificate Validation. This means that the software may not properly verify the identity of the server it is connecting to, potentially allowing for...