PT-2023-5189 · Unknown · Qms Automotive

Name of the Vulnerable Software and Affected Versions: QMS Automotive versions prior to V12.39 Description: The issue is related to the QMS.Mobile module of the QMS Automotive software, which does not properly invalidate session tokens upon logout. This could allow an attacker to perform session...

PT-2023-4798 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 116.0.5845.179 Description: The issue is related to a use after free in the Networks component, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. The severity o...

Multiple vulnerabilities in SHIRASAGI

Overview SHIRASAGI provided by SHIRASAGI Project contains multiple vulnerabilities listed below. Reflected cross-site scripting CWE-79 - CVE-2023-36492 Stored cross-site scripting CWE-79 - CVE-2023-38569 Path traversal CWE-22 - CVE-2023-39448 CVE-2023-36492, CVE-2023-38569 Taiga Shirakura of Mits...

PT-2023-5103 · Vim +10 · Vim +10

Name of the Vulnerable Software and Affected Versions: vim versions prior to 9.0.1858 Description: The issue is related to a use-after-free vulnerability in the vim text editor, specifically in the ins compl get exp function. This vulnerability is associated with the use of memory after it has be...

PT-2023-4937 · Mutt +9 · Mutt +9

Name of the Vulnerable Software and Affected Versions: Mutt versions 1.5.2 through 2.2.12 Description: The issue is related to a null pointer dereference when composing from a specially crafted draft message. This can potentially allow an attacker to cause a denial of service. The vulnerability i...

PT-2023-26259 · Ivanti · Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche Manager versions prior to 6.4.1 Description: A security vulnerability within Ivanti Avalanche Manager may allow an unauthenticated attacker to create a buffer overflow, potentially leading to service disruption or arbitrary...

"Skylark" App fails to restrict custom URL schemes properly

Overview "Skylark" App provided by SKYLARK HOLDINGS CO., LTD. provides the function to access a requested URL using Custom URL Scheme. The App does not restrict access to the function properly CWE-939, CVE-2023-40530, CVE-2024-54014 which may be exploited to direct the App to access any sites...

PT-2023-4502 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 116.0.5845.110 Description: The issue is related to a use after free in the Loader component, which could allow a remote attacker to exploit heap corruption via a crafted HTML page. This could potentially impac...

PT-2023-11515 · Ncurses +1 · Ncurses +1

Name of the Vulnerable Software and Affected Versions: ncurses version 6.1 Description: The issue is related to a Buffer Overflow vulnerability in the fmt entry function, located in progs/dump entry.c:1116, which allows remote attackers to cause a denial of service via crafted commands...

PT-2023-4447

Name of the Vulnerable Software and Affected Versions Ivanti MobileIron Sentry versions 9.18.0 and below Description A security vulnerability in the MICS Admin Portal of Ivanti MobileIron Sentry may allow an attacker to bypass authentication controls on the administrative interface due to an...

CVE-2023-40168 Malicious projects can read and upload arbitrary files from disk in TurboWarp Desktop

TurboWarp is a desktop application that compiles scratch projects to JavaScript. TurboWarp Desktop versions prior to version 1.8.0 allowed a malicious project or custom extension to read arbitrary files from disk and upload them to a remote server. The only required user interaction is opening th...

PT-2023-4542 · Mcafee · Mcafee Safe Connect

Name of the Vulnerable Software and Affected Versions: McAfee Safe Connect versions prior to 2.16.1.126 Description: The issue is related to an uncontrolled search path element, which may allow an adversary with system privileges to achieve privilege escalation by loading arbitrary DLLs. This can...

PT-2023-27178 · 1Panel · 1Panel

Name of the Vulnerable Software and Affected Versions: 1Panel versions 1.4.3 Description: An arbitrary file write vulnerability could lead to direct control of the server. In the api/v1/file.go file, there is a function called SaveContentthat,It that receives JSON data sent by users in the form o...

PT-2023-4677 · Unknown · Mxsecurity

Name of the Vulnerable Software and Affected Versions: MXsecurity versions prior to v1.0.1 Description: The issue is related to inadequate authentication measures in the MXSecurity platform, which can allow a remote attacker to gain unauthorized access to protected information. This can potential...

PT-2023-26475 · Unknown · Metersphere

Name of the Vulnerable Software and Affected Versions: MeterSphere versions prior to 2.10.4 LTS Description: MeterSphere is an open-source continuous testing platform. Some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attacker...

PT-2023-4107 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 115.0.5790.170 Description: The issue is related to a type confusion in the V8 JavaScript engine, allowing a remote attacker to perform arbitrary read/write operations via a crafted HTML page. This could...

PT-2023-26345 · Trustwave +1 · Modsecurity +1

Name of the Vulnerable Software and Affected Versions: Trustwave ModSecurity versions 3.0.0 through 3.0.9 Description: The issue is related to Inefficient Algorithmic Complexity. Recommendations: For Trustwave ModSecurity versions 3.0.0 through 3.0.9, update to version 3.0.10 or later to resolve...

PT-2023-25122

Name of the Vulnerable Software and Affected Versions Infodrom Software E-Invoice Approval System versions prior to 20230701 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

CLSA-2023-1688674589 mysql: Fix of 21 CVEs

Update to MySQL 8.0.33 - CVEs fixed: CVE-2023-21980 CVE-2023-21947 CVE-2023-21940 CVE-2023-21976 CVE-2023-21933 CVE-2023-21911 CVE-2023-21945 CVE-2023-21966 CVE-2023-21982 CVE-2023-21946 CVE-2023-21963 CVE-2023-21913 CVE-2023-21955 CVE-2023-21962 CVE-2023-21977 CVE-2023-21953 CVE-2023-21972...

PT-2023-22875 · Google · Android

Name of the Vulnerable Software and Affected Versions: Calendar application versions prior to 12.4.07.15 Description: The issue allows attackers to write arbitrary files due to a potential zip path traversal vulnerability in the Calendar application. This vulnerability is present in Android 13...