PT-2023-18458 · Unknown · Command Centre

Name of the Vulnerable Software and Affected Versions: Command Centre versions vEL8.80 prior to vEL8.80.1192 MR2 Description: A stack-based buffer overflow in the Command Centre Server allows an attacker to cause a denial of service attack via assigning cardholders to an Access Group...

PT-2023-4047

Name of the Vulnerable Software and Affected Versions macOS Monterey versions prior to 12.6.8 iOS versions prior to 15.7.8 iPadOS versions prior to 15.7.8 iOS versions prior to 16.6 iPadOS versions prior to 16.6 tvOS versions prior to 16.6 macOS Big Sur versions prior to 11.7.9 macOS Ventura...

CVE-2023-37901

Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges such as a speaker and then someone...

PT-2023-26087 · Unknown · Webboss.Io Cms

Name of the Vulnerable Software and Affected Versions: WebBoss.io CMS versions prior to 3.7.0.1 Description: A reflected cross-site scripting XSS issue was found in the software. This type of issue occurs when an application takes user input and sends it back to the user without proper validation...

Important: kernel

Issue Overview: A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory. This flaw allows a local user with CAPNETADMIN capability to crash o...

Medium: python-requests

Issue Overview: A flaw was found in the Python-requests package, where it is vulnerable to potentially leaking Proxy-Authorization headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of how rebuildproxies is used to recompute and reattach the...

PT-2023-26083 · Unknown · Tduck-Platform

Name of the Vulnerable Software and Affected Versions: tduck-platform version 4.0 Description: The issue allows attackers to execute arbitrary code via a crafted HTML file, exploiting an arbitrary file upload vulnerability. Recommendations: For tduck-platform version 4.0, update to a version that...

Low: python3.11

Issue Overview: No CVE associated with this advisory Affected Packages: python3.11 Issue Correction: Run dnf update python3.11 --releasever 2023.1.20230719 or dnf update --advisory ALAS2023-2023-252 --releasever 2023.1.20230719 to update your system. More information on how to update your system...

Medium: cups

Issue Overview: A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data immediately before the connection closed, resulting in a use-after-free in cupsdAcceptClient in...

PT-2023-24297 · WordPress · Hijiri Custom Post Type Generator

Name of the Vulnerable Software and Affected Versions: Hijiri Custom Post Type Generator plugin versions = 2.4.2 Description: The issue is related to an Authenticated Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker could potentially inject malicious scripts into the...

PT-2023-25564 · Magepeople · Magepeople Team Event Manager/Tickets Selling Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin versions = 3.9.5 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated users with editor or higher...

PT-2023-3705 · Oracle · Oracle E-Business Suite

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.12 Description: The issue is related to insufficient input validation in the Reports Configuration component of Oracle Applications Technology in Oracle E-Business Suite. This can be...

PT-2023-19551 · Unknown · Wesecur Security Plugin

Name of the Vulnerable Software and Affected Versions: WeSecur Security plugin versions 1.2.1 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For WeSecur Security plugin versions...

Amazon Corretto Java 8.x < 8.382.05.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is prior to 8 8.382.05.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2023-Jul-18 advisory. - javafx/graphics CVE-2023-22043 - hotspot/compiler CVE-2023-22045 - core-libs/java.io CVE-2023-22049...

PT-2023-3912 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.33 and prior Description: The issue is related to errors in processing input data in the InnoDB component of the MySQL Server product of Oracle MySQL. Exploitation of this issue can allow a remote attacker to cause a...

PT-2023-20306 · WordPress · Inventorypress

Name of the Vulnerable Software and Affected Versions: InventoryPress WordPress plugin versions 1.7 and earlier Description: The issue allows users with the role of author and above to perform Stored Cross-Site Scripting attacks due to the plugin not sanitising and escaping some of its settings...

PT-2023-17320 · WordPress · Login Configurator

Name of the Vulnerable Software and Affected Versions: Login Configurator WordPress plugin versions through 2.1 Description: The issue is related to a reflected cross-site scripting vulnerability. It occurs because the plugin does not properly escape a URL parameter before outputting it to the...

PT-2023-26221 · Justin Klein · Wp Social Autoconnect

Name of the Vulnerable Software and Affected Versions: Justin Klein WP Social AutoConnect plugin versions = 4.6.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the use...

PT-2023-23098 · Ibm · Ibm I +1

Name of the Vulnerable Software and Affected Versions: IBM i versions 7.2 through 7.5 Description: The issue concerns a local privilege escalation vulnerability in the Facsimile Support for i product. A malicious actor with command line access to the host operating system can exploit this...

PT-2023-32994 · Unknown · Pocketmine

Name of the Vulnerable Software and Affected Versions: PocketMine versions prior to 4.22.3 PocketMine versions prior to 5.2.1 Description: A player can cause the server to crash by sending a packet with incorrect sign data in NBT in the BlockActorDataPacket. This can be achieved by sending an NBT...