PT-2023-16812 · WordPress · Advanced Custom Fields Pro

Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields ACF Free and Pro WordPress plugins versions 5.x through 5.12.4 Advanced Custom Fields ACF Free and Pro WordPress plugins versions 6.x through 6.0.x Description: The issue allows users with a role of Contributor and abov...

PT-2023-17053 · WordPress · Site Reviews

Name of the Vulnerable Software and Affected Versions: Site Reviews WordPress plugin versions prior to 6.7.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in ...

[SECURITY] Fedora 36 Update: thunderbird-102.10.0-1.fc36

Mozilla Thunderbird is a standalone mail and newsgroup client...

PT-2023-12732 · Ping Identity · Pingid Integration For Windows Login

Name of the Vulnerable Software and Affected Versions: PingID integration for Windows login versions prior to 2.9 Description: The issue arises from the PingID integration for Windows login not handling duplicate usernames. This can lead to a username collision when two people with the same...

PT-2023-14514 · Codebangers · Codebangers All In One Time Clock Lite

Name of the Vulnerable Software and Affected Versions: Codebangers All in One Time Clock Lite plugin versions prior to 1.3.321 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects administrative users. This type of vulnerability allows an attacker to...

Vulnerability fixed in Schneider Electric PowerLogic

Schneider Electric has fixed a vulnerability in PowerLogic HDPM6000. A malicious party could exploit the vulnerability to cause a denial-of-service DoS, or possibly to execute arbitrary execute arbitrary code on the vulnerable system, by sending specially prepared Ethernet packets. To send the...

PT-2023-18335 · WordPress · Taxopress

Name of the Vulnerable Software and Affected Versions: TaxoPress plugin for WordPress versions up to, and including, 3.6.4 Description: The issue is related to Stored Cross-Site Scripting via the Suggest Terms Title field due to insufficient input sanitization and output escaping. This allows...

PT-2023-15659 · WordPress · Wp Tiles

Name of the Vulnerable Software and Affected Versions: WP Tiles WordPress plugin versions 1.1.2 and earlier Description: The issue concerns the WP Tiles WordPress plugin, which does not properly validate and escape certain shortcode attributes before outputting them in a page or post. This could...

PT-2023-19327 · Wpdevart · Smplug-In Social Like Box/Page By Wpdevart

Name of the Vulnerable Software and Affected Versions: Smplug-in Social Like Box and Page by WpDevArt plugin versions 0.8.39 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For...

PT-2023-17305 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.3.3 Description: The issue is related to command injection in the GitHub repository microweber/microweber. Specifically, the "first name" field is vulnerable, allowing for server-side template...

PT-2023-17246 · Unknown · Firefly-Iii

Name of the Vulnerable Software and Affected Versions: Firefly III versions prior to 6.0.0 Description: The issue is related to insufficient session expiration in the Firefly III GitHub repository. This means that sessions are not properly closed after a certain period of inactivity or when a use...

PT-2023-17307 · Unknown · Thorsten/Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue is related to stored Cross-site Scripting XSS due to the failure to sanitize user input in the updatecategory parameter. This allows for the storage of malicious scripts that c...

PT-2023-17296 · WordPress · Yourchannel

Name of the Vulnerable Software and Affected Versions: YourChannel plugin for WordPress versions up to, and including, 1.2.3 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save function. This allows unauthenticated attackers to...

PT-2023-17180 · Rapid7 · Rapid7 Nexpose

Name of the Vulnerable Software and Affected Versions: Rapid7 Nexpose versions 6.6.186 and below Description: This issue allows an attacker to manipulate URLs to forcefully browse to and access administrative pages. The vulnerability is related to forced browsing, which enables unauthorized acces...

PT-2023-16551 · WordPress · Cookie Notice & Compliance For Gdpr / Ccpa

Name of the Vulnerable Software and Affected Versions: Cookie Notice & Compliance for GDPR / CCPA WordPress plugin versions prior to 2.4.7 Description: The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the plugin not validating and...

PT-2023-21897 · Jenkins · Jenkins Cppcheck Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Cppcheck Plugin versions 1.26 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability. This occurs because the plugin does not escape file names from Cppcheck report files before showing them on t...

PT-2023-5365 · Siemens · Tecnomatix Plant Simulation

Name of the Vulnerable Software and Affected Versions: Tecnomatix Plant Simulation versions prior to V2201.0006 Description: A vulnerability has been identified in the affected application, which contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted...

PT-2023-1945 · Adobe · Photoshop

Name of the Vulnerable Software and Affected Versions: Adobe Photoshop versions 23.5.3 and earlier Adobe Photoshop versions 24.1.1 and earlier Description: The issue is related to a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user...

PT-2023-15187 · WordPress · Seerox Wp Dynamic Keywords Injector

Name of the Vulnerable Software and Affected Versions: Seerox WP Dynamic Keywords Injector plugin versions 2.3.15 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-35469 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.232 Description: A potential issue exists in the ASoC: SOF: Intel: hda-dai component of the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kerne...