Discourse 3.1.x < 3.1.0.beta6 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

PT-2023-7155 · Adobe · Acrobat Reader

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader versions 23.006.20360 and earlier Adobe Acrobat Reader versions 20.005.30524 and earlier Description: The issue is related to an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read...

PT-2023-3958 · Adobe · Indesign

Name of the Vulnerable Software and Affected Versions: Adobe InDesign versions ID18.3 and earlier Adobe InDesign versions ID17.4.1 and earlier Description: The issue is related to an out-of-bounds write vulnerability in memory. Exploitation of this issue could allow an attacker to execute arbitra...

PT-2023-4181 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 115.0.5790.170 Description: The issue is related to a use after free in Blink Task Scheduling, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead...

PT-2023-3804

Name of the Vulnerable Software and Affected Versions SonicWall GMS versions 9.3.2-SP1 and earlier SonicWall Analytics versions 2.5.0.4-R7 and earlier Description The issue is related to improper neutralization of special elements used in an SQL command, allowing an unauthenticated attacker to...

PT-2023-23410 · WordPress · Email Queue

Name of the Vulnerable Software and Affected Versions: Mail Queue plugin for WordPress versions up to, and including, 1.1 Description: The issue arises from insufficient input sanitization and output escaping, allowing Stored Cross-Site Scripting attacks. This enables unauthenticated attackers to...

PT-2023-23061 · WordPress · Yaysmtp

Name of the Vulnerable Software and Affected Versions: YaySMTP plugin for WordPress versions up to and including 2.4.5 Description: The issue arises from insufficient input sanitization and output escaping in email contents, allowing unauthenticated attackers to inject arbitrary web scripts in...

PT-2023-3953 · Adobe · Indesign

Name of the Vulnerable Software and Affected Versions: Adobe InDesign versions ID18.3 and earlier Adobe InDesign versions ID17.4.1 and earlier Description: The issue is related to an out-of-bounds read in memory, which could allow an attacker to access sensitive information. This could potentiall...

PT-2023-3957 · Adobe · Indesign

Name of the Vulnerable Software and Affected Versions: Adobe InDesign versions ID18.3 and earlier Adobe InDesign versions ID17.4.1 and earlier Description: The issue is related to an out-of-bounds read that could lead to disclosure of sensitive memory. An attacker could leverage this to bypass...

PT-2023-25617 · Zoom · Zoom Rooms For Windows

Name of the Vulnerable Software and Affected Versions: Zoom Rooms for Windows versions prior to 5.15.0 Description: The issue is related to improper access control, which may allow an authenticated user to enable an escalation of privilege via local access. Recommendations: For versions prior to...

PT-2023-4088 · Siemens · Ruggedcom Rox Mx5000 +8

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM ROX MX5000 versions prior to V2.16.0 RUGGEDCOM ROX MX5000RE versions prior to V2.16.0 RUGGEDCOM ROX RX1400 versions prior to V2.16.0 RUGGEDCOM ROX RX1500 versions prior to V2.16.0 RUGGEDCOM ROX RX1501 versions prior to V2.16.0...

PT-2023-19577 · Unknown · Tiggerswelt.Net Worthy

Name of the Vulnerable Software and Affected Versions: tiggersWelt.Net Worthy plugin versions = 1.6.5-6497609 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is...

PT-2023-25113 · WordPress · Securimage-Wp

Name of the Vulnerable Software and Affected Versions: Drew Phillips Securimage-WP plugin versions = 3.6.16 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a w...

PT-2023-18618 · Magenet · Magenet Website Monetization

Name of the Vulnerable Software and Affected Versions: MageNet Website Monetization by MageNet plugin versions = 1.0.29.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions ...

PT-2023-20946 · WordPress · An Gradebook

Name of the Vulnerable Software and Affected Versions: AN GradeBook WordPress plugin versions through 5.0.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape...

PT-2023-19219 · Hasthemes · Ht Feed

Name of the Vulnerable Software and Affected Versions: HasThemes HT Feed plugin versions 1.2.7 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a we...

PT-2023-6480

Name of the Vulnerable Software and Affected Versions Redis versions 2.6.0 through 6.0.19 Redis versions 6.2.0 through 6.2.12 Redis versions 7.0.0 through 7.0.11 Description A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, resulting in heap...

PT-2023-4103 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions prior to 7100 Description: The issue is related to a lack of protection in the web page structure of Zoho ManageEngine ADAudit Plus, allowing for a remote attacker to conduct a cross-site scripting XSS...

PT-2023-25759 · Unknown · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.17 Description: A Cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the File Upload function. Recommendations: For CMS Made Simple version 2.2.17, update to a version...

PT-2023-25798 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: eyoucms version 1.6.3 Description: A stored cross-site scripting issue in the Basic Website Information module allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations: For eyoucms version 1.6.3, update...