ParaSiteSnatcher A Silent Threat to Latin America

Summary: Multiple vulnerabilities have been discovered in Google Chrome, including a zero-day vulnerability CVE-2023-6345 actively exploited for remote code execution. Users are advised to update Chrome to version 119.0.6045.199/.200 Windows or 119.0.6045.199 Mac and Linux promptly to safeguard...

PT-2023-30782 · Unknown · Amp For Wp – Accelerated Mobile Pages

Name of the Vulnerable Software and Affected Versions: AMP for WP – Accelerated Mobile Pages versions 1.0.88.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

PT-2023-32339 · WordPress · The Business Directory Plugin

Name of the Vulnerable Software and Affected Versions: Business Directory Plugin – Easy Listing Directories for WordPress versions n/a through 6.3.10 Description: A Cross-Site Request Forgery CSRF issue affects the Business Directory Plugin, allowing unauthorized requests. The estimated number of...

PT-2023-27111 · Gnu +5 · Gnu Tar +5

Name of the Vulnerable Software and Affected Versions: GNU tar versions prior to 1.35 Description: The issue arises from mishandled extension attributes in a PAX archive, which can cause an application crash in xheader.c. Recommendations: For GNU tar versions prior to 1.35, update to version 1.35...

PT-2023-25204 · Unknown · Chamilo Lms

Name of the Vulnerable Software and Affected Versions: Chamilo LMS versions prior to 1.11.20 Description: The issue concerns a path traversal vulnerability in the file upload functionality, specifically in the /main/webservices/additional webservices.php endpoint. This allows unauthenticated...

PT-2023-8886 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 25.0.0 through 25.0.12 Nextcloud Server versions 26.0.0 through 26.0.7 Nextcloud Server versions 27.0.0 through 27.1.2 Description: The issue is related to improper neutralization of input during web page generation,...

PT-2023-30692 · WordPress · Wp Post Popup

Name of the Vulnerable Software and Affected Versions: WP Post Popup WordPress plugin versions prior to 3.7.4 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed,...

PT-2023-32336 · WordPress · Wp Hotel Booking

Name of the Vulnerable Software and Affected Versions: WP Hotel Booking WordPress plugin versions prior to 2.0.8 Description: The issue concerns a lack of proper authorization in the deletion of packages. This allows users with Contributor and above roles to delete posts that do not belong to the...

PT-2023-30686

Name of the Vulnerable Software and Affected Versions PyPinkSign version 0.5.1 Description The issue concerns the use of a non-random or static Initialization Vector IV in Cipher Block Chaining CBC mode for Advanced Encryption Standard AES encryption. This can potentially lead to the disclosure o...

PT-2023-30581 · Cksource +1 · Ckeditor +1

Name of the Vulnerable Software and Affected Versions: CKEditor versions 4.15.1 and earlier CKEditor versions prior to 4.24.0-lts Description: A Cross-Site scripting issue has been found in CKSource CKEditor. An attacker could send malicious javascript code through the "samples/old/ajax.html" fil...

PT-2023-7366 · Adobe · After Effects

Name of the Vulnerable Software and Affected Versions: Adobe After Effects versions 24.0.2 and earlier Adobe After Effects versions 23.6 and earlier Description: The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curren...

PT-2023-7365 · Adobe · After Effects

Name of the Vulnerable Software and Affected Versions: Adobe After Effects versions 24.0.2 and earlier Adobe After Effects versions 23.6 and earlier Description: The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could levera...

PT-2023-30497 · Wpfactory · Wpfactory Products

Name of the Vulnerable Software and Affected Versions: WPFactory Products, Order & Customers Export for WooCommerce plugin versions = 2.0.7 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts in...

PT-2023-23228 · Intel · Openvino Model Server

Name of the Vulnerable Software and Affected Versions: OpenVINO Model Server versions prior to 2022.3 Description: The issue is related to improper input validation in the OpenVINO Model Server software, which may allow an unauthenticated user to potentially enable denial of service via network...

PT-2023-7146 · Adobe · Acrobat Reader

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader versions 23.006.20360 and earlier Adobe Acrobat Reader versions 20.005.30524 and earlier Description: The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An...

PT-2023-24850 · WordPress · Wp Hide Post

Name of the Vulnerable Software and Affected Versions: WP Hide Post plugin versions = 2.0.10 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web application...

PT-2023-24639 · WordPress · Guillemant David Wp Full Auto Tags Manager

Name of the Vulnerable Software and Affected Versions: Guillemant David WP Full Auto Tags Manager plugin versions = 2.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a...

PT-2023-23835 · E4J S.R.L. · Vikbooking Hotel Booking Engine & Pms

Name of the Vulnerable Software and Affected Versions: E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin versions = 1.6.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web applicatio...

PT-2023-9800 · Asyncssh +3 · Asyncssh +3

Name of the Vulnerable Software and Affected Versions: AsyncSSH versions prior to 2.14.1 Description: The issue in AsyncSSH allows attackers to control the extension info message via a man-in-the-middle attack, enabling them to conduct algorithm downgrade attacks during user authentication. This...

PT-2023-7827 · Perforce · Helix Core

Name of the Vulnerable Software and Affected Versions: Helix Core versions prior to 2023.2 Description: An arbitrary code execution issue was discovered, resulting in privilege escalation. This issue allows a remote attacker to execute arbitrary code with system account privileges. The...