PT-2023-2738 · Adobe · Substance3D - Painter

Name of the Vulnerable Software and Affected Versions: Adobe Substance 3D Painter versions 8.3.0 and earlier Description: The issue is related to an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacke...

PT-2023-11488 · Nonecms · Nonecms

Name of the Vulnerable Software and Affected Versions: NoneCms version 1.3.0 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the feedback feature. This could potentially lead to unauthorized actions on the web application...

PT-2023-20023 · Azuracast · Azuracast

Name of the Vulnerable Software and Affected Versions: AzuraCast versions prior to 0.18.3 Description: The issue is related to improper restriction of excessive authentication attempts in the AzuraCast GitHub repository. Specifically, the request rate limiting feature on the login page can be...

PT-2023-3724 · Wp Engine · Wp Engine Advanced Custom Fields

Name of the Vulnerable Software and Affected Versions: WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins versions 6.1.5 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability in the WP Engine Advanced Custom Fields...

PT-2023-19233 · WordPress · Profilepress Membership Team Profilepress

Name of the Vulnerable Software and Affected Versions: ProfilePress Membership Team ProfilePress plugin versions = 4.5.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability requires authentication and affects users with contributor or higher...

PT-2023-22412 · Asus · Asus Rt-Ac51U

Name of the Vulnerable Software and Affected Versions: ASUS RT-AC51U wireless router firmware versions up to and including 3.0.0.4.380.8591 Description: A Cross-site scripting XSS vulnerability in the System Log/General Log page of the administrator web UI allows remote attackers to inject...

PT-2023-14673 · Acronis · Acronis Agent

Name of the Vulnerable Software and Affected Versions: Acronis Agent versions prior to build 30161 Description: The issue is related to a denial of service due to an unauthenticated API endpoint. Recommendations: For Acronis Agent versions prior to build 30161, update to build 30161 or later to...

PT-2023-19150 · Miniorange · Miniorange Wordpress Social Login/Register

Name of the Vulnerable Software and Affected Versions: miniOrange WordPress Social Login and Register plugin versions prior to 7.5.14 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject...

PT-2023-19266 · Unknown · Carlos Moreira Interactive Geo Maps

Name of the Vulnerable Software and Affected Versions: Carlos Moreira Interactive Geo Maps plugin versions 1.5.8 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or those with higher authenticatio...

PT-2023-15421 · WordPress · Wp Super Popup

Name of the Vulnerable Software and Affected Versions: WP Super Popup plugin versions = 1.1.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the WP Super Popup plugin. This vulnerability requires authentication with admin+ privileges...

PT-2023-15201 · Pakpobox · Pakpobox Alfred24 Click & Collect Plugin

Name of the Vulnerable Software and Affected Versions: Pakpobox alfred24 Click & Collect plugin versions = 1.1.7 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inject malicious scripts int...

Medium: pkgconf

Issue Overview: In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconftupleparse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes. CVE-2023-24056 Affected Packages: pkgconf...

PT-2023-2674 · Oracle · Oracle Graalvm Enterprise Edition

Name of the Vulnerable Software and Affected Versions: Oracle GraalVM Enterprise Edition versions 20.3.9, 21.3.5, and 22.3.1 Description: The issue is related to insufficient input validation in the Native Image component of Oracle GraalVM Enterprise Edition, allowing an unauthenticated attacker...

PT-2023-16966 · WordPress · Wp Vr

Name of the Vulnerable Software and Affected Versions: WP VR WordPress plugin versions prior to 8.2.9 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because some parameters are not properly sanitised and escaped before being outputted back in the page. Th...

PT-2023-16937 · WordPress · W4 Post List

Name of the Vulnerable Software and Affected Versions: W4 Post List WordPress plugin versions prior to 2.4.6 Description: The issue arises because the plugin does not properly check access to password-protected posts before displaying their content. This could allow any authenticated users to...

PT-2023-13526 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev30 Description: The issue allows for XSS via an upsell trigger. Recommendations: For versions prior to 7.10.6-rev30, update to version 7.10.6-rev30 or later to resolve the issue...

PT-2023-10698 · Slack +1 · Slack +2

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 11.1.7 and earlier, 11.2.x through 11.2.3, 11.3.x through 11.3.0 Description: The issue is related to Cross Site Request Forgery CSRF in the Slack integration for issuing slash commands. This...

PT-2023-21292 · Unknown · Auto Dealer Management System

Name of the Vulnerable Software and Affected Versions: Auto Dealer Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. Recommendations: For Auto Dealer Management System version 1.0, update to a version that includes a fix for the SQL injection...

PT-2023-5726 · Tightvnc · Tightvnc

Name of the Vulnerable Software and Affected Versions: TightVNC versions prior to 2.8.75 Description: The issue is related to errors in privilege management, allowing remote attackers to escalate their privileges on the host operating system. This can be achieved by replacing legitimate files wit...

PT-2023-21300

Name of the Vulnerable Software and Affected Versions Void Tools Everything versions prior to 1.4.1.1022 Description The issue is related to a Regular Expression Denial of Service ReDoS. No information is provided about the estimated number of potentially affected devices worldwide or real-world...