Important: libxml2

Issue Overview: libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can...

Important: openssl

Issue Overview: A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. A truncation in the IV can result in non-uniqueness, which could result in loss of...

Important: samba

Issue Overview: Samba is vulnerable to path traversal due to insufficient sanitization of clients incoming pipe names. This can lead to the client connecting to as root to a Unix domain socket outside of the Samba private directory. CVE-2023-3961 SMB client can truncate files to 0 bytes by openin...

PT-2023-32409 · Pkp · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository pkp/pkp-lib. Recommendations: For versions prior to 3.3.0-16, update to version 3.3.0-16 or later to resolve...

PT-2023-32406 · Pkp · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository pkp/pkp-lib. CSRF is an attack that tricks the victim into performing unintended actions on a web application...

PT-2023-32397 · Pkp-Lib · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository pkp/pkp-lib. Recommendations: For versions prior to 3.3.0-16, update to version 3.3.0-16 or lat...

PT-2023-29753 · Idnovate · Idnovate Superuser

Name of the Vulnerable Software and Affected Versions: idnovate superuser versions prior to 2.4.2 Description: The issue allows attackers to bypass authentication via a crafted HTTP call, specifically targeting the SuperUserSetuserModuleFrontController:init component. Recommendations: For version...

PT-2023-32114 · WordPress · Cits Support Svg

Name of the Vulnerable Software and Affected Versions: CITS Support svg, webp Media and TTF,OTF File Upload WordPress plugin versions prior to 3.0 Description: The issue concerns the failure to sanitise uploaded SVG files, potentially allowing users with a role as low as Author to upload maliciou...

PT-2023-31965 · WordPress · Memberlite Shortcodes

Name of the Vulnerable Software and Affected Versions: Memberlite Shortcodes WordPress plugin versions prior to 1.3.9 Description: The issue allows users with a role as low as contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admi...

PT-2023-32399 · Pkp · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation, allowing attackers to inject...

PT-2023-28763 · Click Studios · Passwordstate

Name of the Vulnerable Software and Affected Versions: Click Studios SA Pty Ltd Passwordstate versions Build 9785 and before Description: A Cross Site Request Forgery vulnerability allows a local attacker to execute arbitrary code via a crafted request. Recommendations: For versions Build 9785 an...

PT-2023-31276 · Opentext · Opentext Asset Management X +1

Name of the Vulnerable Software and Affected Versions: opentext Service Management Automation X SMAX versions 2020.05 through 2022.11 opentext Asset Management X AMX versions 2021.08 through 2022.11 Description: The issue is an open redirect vulnerability that could allow attackers to redirect a...

PT-2023-7245

Name of the Vulnerable Software and Affected Versions aiohttp versions prior to 3.9.0 Description The issue is related to improper validation in the aiohttp HTTP client/server framework, allowing an attacker to modify the HTTP request or create a new one if they control the HTTP method. This can...

PT-2023-9032 · Unknown +8 · Exfatprogs +8

Name of the Vulnerable Software and Affected Versions: exfatprogs versions prior to 1.2.2 Description: The issue is related to the read file dentry set function in the exfatprogs utility, which is associated with out-of-bounds memory access. This could allow an attacker to impact data integrity...

PT-2023-29893 · Unknown · Internet Marketing Ninjas Internal Link Building Plugin

Name of the Vulnerable Software and Affected Versions: Internet Marketing Ninjas Internal Link Building plugin versions 1.2.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability...

PT-2023-29150 · Sonicwall · Sonicwall Directory Services Connector

Name of the Vulnerable Software and Affected Versions: SonicWall Directory Services Connector Windows MSI client versions 4.1.21 and earlier Description: A local privilege escalation issue allows a local low-privileged user to gain system privileges through running the recovery feature...

PT-2023-29827 · Wpdevart · Wpdevart Contact Form Builder +1

Name of the Vulnerable Software and Affected Versions: wpdevart Contact Form Builder, Contact Widget plugin versions 2.1.6 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the website,...

PT-2023-26180 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 9.4-rc-1 through 14.10.7 XWiki Platform versions 15.3-rc-1 and earlier Description: The issue arises when a document has been deleted and re-created, allowing users with view rights on the re-created document but not o...

PT-2023-8359 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.1 Description: A permissions issue was addressed with additional restrictions. This issue may allow an app to access user-sensitive data. The vulnerability is related to insufficient access restrictions in th...

PT-2023-29897 · Scientech It Solution · Scientech It Solution Appointment Calendar

Name of the Vulnerable Software and Affected Versions: Scientech It Solution Appointment Calendar plugin versions = 2.9.6 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...