PT-2023-21592 · Qualys +1 · Qualys Cloud Agent +1

Name of the Vulnerable Software and Affected Versions: Qualys Cloud Agent for macOS versions 2.5.1-75 through 3.7 Description: The Qualys Cloud Agent for macOS installer allows a local escalation of privilege, bounded only to the time of installation and only on older macOSX versions macOS 10.15...

PT-2023-18155 · Nuxtlabs · Nuxtlabs/Github-Module

Name of the Vulnerable Software and Affected Versions: nuxtlabs/github-module versions prior to 1.6.2 Description: The issue involves the use of hard-coded credentials in the GitHub repository nuxtlabs/github-module. A hardcoded GitHub token was found in the source code, which had access to...

PT-2023-16217 · Wpbakery · Pricing Tables For Wpbakery Page Builder

Name of the Vulnerable Software and Affected Versions: Pricing Tables For WPBakery Page Builder versions prior to 3.0 Description: The issue arises from the plugin's failure to validate and escape certain shortcode attributes before outputting them in a page or post, potentially allowing users wi...

PT-2023-16853 · Wpbakery · Pricing Tables For Wpbakery Page Builder

Name of the Vulnerable Software and Affected Versions: Pricing Tables For WPBakery Page Builder formerly Visual Composer versions prior to 3.0 Description: The issue allows any authenticated users, such as subscribers, to perform Local File Inclusion LFI attacks due to the lack of validation of...

PT-2023-16592 · WordPress · Themeflection Numbers

Name of the Vulnerable Software and Affected Versions: Themeflection Numbers WordPress plugin versions prior to 2.0.1 Description: The issue is related to a lack of authorisation and CSRF check in an AJAX action, which does not ensure that the options to be updated belong to the plugin. This coul...

PT-2023-13542 · Unknown · Access Management

Name of the Vulnerable Software and Affected Versions: Access Management versions 6.5.0 through 7.2.0 Description: The issue is related to an Improper Authorization vulnerability that allows Authentication Bypass in Access Management. Recommendations: For versions 6.5.0 through 7.2.0, update to a...

PT-2023-18708 · Arm · Arm Android Gralloc Module

Name of the Vulnerable Software and Affected Versions: Arm Android Gralloc Module versions r24p0 through r41p0 before r42p0 Description: An issue was discovered in the Arm Android Gralloc Module, allowing a non-privileged user to read a small portion of the allocator process memory...

Medium: wireshark

Issue Overview: ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via packet injection or crafted capture file CVE-2023-1161 Affected Packages: wireshark Issue Correction: Run dnf update wireshark --releasever 2023.0.20230329 or dnf...

PT-2023-22080

Name of the Vulnerable Software and Affected Versions Flask-AppBuilder versions prior to 4.3.0 Description The issue is related to the lack of rate limiting, which can allow an attacker to brute-force user credentials. This can be exploited by attackers to gain unauthorized access. The estimated...

PT-2023-16665 · WordPress · Stylish-Cost-Calculator-Premium

Name of the Vulnerable Software and Affected Versions: stylish-cost-calculator-premium WordPress plugin versions prior to 7.9.0 Description: The issue is related to a Stored Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted ba...

PT-2023-16395 · WordPress · Auto Rename Media On Upload

Name of the Vulnerable Software and Affected Versions: Auto Rename Media On Upload WordPress plugin versions prior to 1.1.0 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, f...

PT-2023-22697 · Redpanda · Redpanda

Name of the Vulnerable Software and Affected Versions: Redpanda versions prior to 23.1.2 Redpanda versions 22.2 and 22.3 before the backported fix Description: The issue arises from the mishandling of the redpanda.rpc server tls field by rpk in Redpanda, leading to situations where there is a dat...

PT-2023-19874 · Unknown · Saleswonder.Biz Webinar Ignition Plugin

Name of the Vulnerable Software and Affected Versions: Saleswonder.Biz Webinar ignition plugin versions = 2.14.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Saleswonder.Biz Webinar...

PT-2023-19882 · Kiboko · Kiboko Labs Arigato Autoresponder/Newsletter

Name of the Vulnerable Software and Affected Versions: Kiboko Labs Arigato Autoresponder and Newsletter plugin versions = 2.7.1 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inject...

PT-2023-20269 · Unknown · Gqevu6Bsiz Announce From The Dashboard

Name of the Vulnerable Software and Affected Versions: gqevu6bsiz Announce from the Dashboard plugin versions = 1.5.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability allows an attacker to inject malicious scripts into the website, which can...

PT-2023-22085 · Budibase · Budibase

Name of the Vulnerable Software and Affected Versions: Budibase versions prior to 2.4.3 Description: Budibase is a low code platform for creating internal tools, workflows, and admin panels. The issue can lead to an attacker gaining access to a Budibase AWS secret key due to Server-Side Request...

PT-2023-19228 · Unknown · Alan Jackson Multi-Column Tag Map Plugin

Name of the Vulnerable Software and Affected Versions: Alan Jackson Multi-column Tag Map plugin versions prior to 17.0.25 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher privileges. Ther...

PT-2023-15038 · Woocommerce · Adtribes.Io Product Feed Pro

Name of the Vulnerable Software and Affected Versions: AdTribes.Io Product Feed PRO for WooCommerce plugin versions = 12.4.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintend...

PT-2023-19326 · Codepeople · Codepeople Wp Time Slots Booking Form

Name of the Vulnerable Software and Affected Versions: CodePeople WP Time Slots Booking Form plugin versions = 1.1.81 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin or higher privileges can inject malicio...

PT-2023-11591 · Pfsense +1 · Pfsense +1

Name of the Vulnerable Software and Affected Versions: pfSense version 2.4.4 ACME package version 0.6.3 Description: A Cross Site Scripting issue allows attackers to execute arbitrary code via the RootFolder field of "acme certificates.php". Recommendations: For pfSense version 2.4.4, update the...