PT-2023-17168 · Hadsky · Hadsky

Name of the Vulnerable Software and Affected Versions: HadSky versions up to 7.11.8 Description: A critical issue has been found, affecting the Installation Interface component, specifically the /install/index.php file. This issue leads to command injection and can be initiated remotely. The...

PT-2023-15436 · Unknown · Quantumcloud Ai Chatbot Plugin

Name of the Vulnerable Software and Affected Versions: QuantumCloud AI ChatBot plugin versions prior to 4.3.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions prior to 4.3.0,...

PT-2023-17153 · Synopsys +1 · Coverity +1

Name of the Vulnerable Software and Affected Versions: Coverity versions prior to 2023.3.2 Description: The issue is related to forced browsing, which exposes authenticated resources to unauthorized actors due to an insecurely configured servlet mapping for the underlying Apache Tomcat server. Th...

PT-2023-13583 · WordPress +1 · Essential Plugin Popup Anything +1

Name of the Vulnerable Software and Affected Versions: WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin versions = 2.2.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user...

PT-2023-17046 · Robodk · Robodk

Name of the Vulnerable Software and Affected Versions: RoboDK versions 5.5.3 and prior Description: The issue is related to an insecure permission assignment to critical directories, which could allow a local user to escalate privileges and write files to the RoboDK process, achieving code...

PT-2023-18650 · WordPress · Wpsoul Greenshift

Name of the Vulnerable Software and Affected Versions: Wpsoul Greenshift – animation and page builder blocks plugin versions = 4.9.9 Description: The issue is related to an Authenticated Cross-Site Scripting XSS vulnerability. This means that an attacker who has authentication credentials for the...

PT-2023-21617 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.3 Description: A user may be able to cause a denial-of-service due to an issue that was addressed with improved state management. Recommendations: For versions prior to 13.3, update to macOS Ventura 13.3 to resolve...

PT-2023-16313 · WordPress · Wp Insurance

Name of the Vulnerable Software and Affected Versions: WP Insurance WordPress plugin versions prior to 2.1.4 Description: The issue concerns a lack of CSRF check when activating plugins, which could allow attackers to make logged-in admins activate arbitrary plugins present on the blog via a CSRF...

PT-2023-15071 · Unknown · Woocommerce Vietnam Checkout

Name of the Vulnerable Software and Affected Versions: Le Van Toan Woocommerce Vietnam Checkout plugin versions prior to 2.0.5 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

cifar-10-model (=7.4.0), gamornet-cpu (>=0.2.3 <=0.4.3) +8 more potentially affected by CVE-2023-27579 via tensorflow-cpu (>=1.15.0 <=2.11.0)

tensorflow-cpu PYPI version =1.15.0, =0.2.3, =0.0.5, =1.0.0, =1.8.2, =0.1.3, =0.3.0.dev221212, =0.7.0, =0.7.5 Source cves: CVE-2023-27579 Source advisory: OSV:GHSA-5W96-866F-6RM8...

PT-2023-17799 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to Android-13 Description: The issue is related to a missing bounds check in the p2p iface.cpp file, which could lead to an out of bounds read. This might result in local information disclosure, requiring System executi...

PT-2023-20227

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 and 2.11.1 Description The issue is related to a floating point exception in the AudioSpectrogram function. The exception occurs when the stride is set to 0. This can be exploited by passing a stride value o...

PT-2023-18858 · Dek-1705 · Dek-1705

Name of the Vulnerable Software and Affected Versions: DEK-1705 version 34.23.1 and earlier Description: A command execution issue was discovered in the device. Recommendations: For DEK-1705 version 34.23.1 and earlier, update to a version later than 34.23.1 to resolve the issue...

PT-2023-21709 · Magepeople · Magepeople Team Event Manager/Tickets Selling Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce versions 3.8.6 and earlier Description: The issue is related to a Stored Cross-site Scripting XSS vulnerability that requires authentication with admin+ privileges. This...

Important: httpd

Issue Overview: A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool heap memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier. CVE-2006-20001 Inconsistent...

Important: python-pillow

Issue Overview: A flaw was found in python-pillow. The vulnerability occurs due to improper initialization of image paths, leading to a buffer over-read and improper initialization. This flaw allows an attacker to unauthorized memory access that causes memory access errors, incorrect results, or...

Important: bcel

Issue Overview: Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllab...

Important: php8.1

Issue Overview: In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, passwordverify function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid...

Medium: harfbuzz

Issue Overview: HarfBuzz 2.9.0 has an out-of-bounds write in hbbitsetinvertiblet::set called from hbsparsesett::set and hbsetcopy. CVE-2021-45931 Affected Packages: harfbuzz Issue Correction: Run dnf update harfbuzz --releasever 2023.0.20230322 or dnf update --advisory ALAS2023-2023-036...

Critical: nss

Issue Overview: NSS Network Security Services up to and including 3.73 is vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS 7, or PKCS 12 are likely to be impacted. Applications using...