Important: kernel

Issue Overview: A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in tableclear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component. CVE-2023-2269 In the Linux kernel through 6.3.1, a use-after-free in...

PT-2023-15018 · WordPress · Osm Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: OSM WordPress plugin versions through 6.01 Description: The issue concerns the OSM WordPress plugin, where it fails to validate and escape certain shortcode attributes. This could allow users with a role as low as contributor to perform a...

PT-2023-19138 · Unknown · Chris Reynolds Progress Bar Plugin

Name of the Vulnerable Software and Affected Versions: Chris Reynolds Progress Bar plugin versions = 2.2.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. Recommendations: For Chris Reynolds Progress B...

PT-2023-24222 · André Bräkling · André Bräkling Wp-Matomo Integration

Name of the Vulnerable Software and Affected Versions: André Bräkling WP-Matomo Integration WP-Piwik plugin versions prior to 1.0.28 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For André...

PT-2023-24295 · Unknown · Eventprime

Name of the Vulnerable Software and Affected Versions: EventPrime plugin versions = 2.8.6 Description: The issue is related to an Unauth. Reflected XSS Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to ste...

CVE-2023-33184 Blind SSRF in the Nextcloud Mail app on avatar endpoint

Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3...

PT-2023-5353 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 7.0.1 Description: The issue is related to incorrect code generation management in the OpenEMR software, which can be exploited by a remote attacker to redirect users to an arbitrary URL. Recommendations: For version...

PT-2023-14004 · Woocommerce · Zorem Advanced Shipment Tracking

Name of the Vulnerable Software and Affected Versions: Zorem Advanced Shipment Tracking for WooCommerce plugin versions = 3.5.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to perform unintended actions on a we...

PT-2023-14224 · Unknown · Xwp Stream

Name of the Vulnerable Software and Affected Versions: XWP Stream plugin versions prior to 3.9.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2023-15323 · WordPress · Wp-Advanced-Search

Name of the Vulnerable Software and Affected Versions: WP-Advanced-Search plugin versions 3.3.8 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the WP-Advanced-Search plugin. This allows an attacker to perform unintended actions on a user's account. Recommendations: For...

PT-2023-20975 · WordPress · Groundhogg

Name of the Vulnerable Software and Affected Versions: Groundhogg plugin for WordPress versions up to, and including, 2.7.9.8 Description: The issue is due to a missing capability check on the submit ticket function, allowing authenticated attackers to create a support ticket that sends the...

PT-2023-23750 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.4 Description: A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue allows an app to bypass Privacy preferences. Recommendations: For versions prior to 13.4, update ...

PT-2023-23416 · Videogo · Videogo

Name of the Vulnerable Software and Affected Versions: Videogo version 6.8.1 Description: The issue is related to incorrect access control, allowing attackers to access images from other devices by modifying the Device Id parameter. Recommendations: For Videogo version 6.8.1, update to a version...

PT-2023-16692 · WordPress · The Help Desk Wp

Name of the Vulnerable Software and Affected Versions: The Help Desk WP WordPress plugin version 1.2.0 and earlier Description: The issue is related to the lack of sanitization and escaping of certain parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting...

CVE-2023-2512 Buffer under-read in workerd

Prior to version v1.20230419.0, the FormData API implementation was subject to an integer overflow. If a FormData instance contained more than 2^31 elements, the forEach method could end up reading from the wrong location in memory while iterating over elements. This would most likely lead to a...

PT-2023-20632 · Digitalpersona · Digitalpersona Fpsensor

Name of the Vulnerable Software and Affected Versions: DigitalPersona FPSensor version 1.0.0.1 Description: A problematic issue has been found in the processing of the file C:Program Files x86FPSensorbinDpHost.exe, leading to an unquoted search path. This issue requires local attacking to be...

PT-2023-20764 · Xpdf +1 · Xpdf +1

Name of the Vulnerable Software and Affected Versions: Xpdf versions 4.04 and earlier Description: A PDF object loop in the page label tree leads to infinite recursion and a stack overflow. Recommendations: For Xpdf versions 4.04 and earlier, consider updating to a newer version to mitigate the...

PT-2023-18456 · Unknown · Skybridge Mb-A100/110

Name of the Vulnerable Software and Affected Versions: SkyBridge MB-A100/110 firmware versions 4.2.0 and earlier Description: The issue is related to improper privilege management, allowing a remote authenticated attacker to alter the WebUI password of the product. This can be exploited by an...

PT-2023-14981 · Intel · Intel Nuc Pro Software Suite

Name of the Vulnerable Software and Affected Versions: IntelR NUC Pro Software Suite versions prior to 2.0.0.3 Description: The issue concerns insecure inherited permissions that may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations: For...

PT-2023-14002 · Intel · Intel Nuc P14E Laptop Element

Name of the Vulnerable Software and Affected Versions: IntelR NUC P14E Laptop Element software for Windows 10 versions prior to 1.1.44 Description: The issue is related to an uncontrolled search path element in the HotKey Services, which may allow an authenticated user to potentially enable...