PT-2023-27503 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14 Description: This issue concerns a shortcut that may output sensitive user data without consent. The problem was addressed by adding an additional prompt for user consent. Recommendations: For versions prior to 14,...

PT-2023-27446 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14 Description: A permissions issue was addressed with additional restrictions. This issue allows an app to bypass certain Privacy preferences. Recommendations: For versions prior to 14, update to macOS Sonoma 14 to...

PT-2023-28356 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions prior to 0.3.10 Description: The abi decode function in Vyper does not validate input when it is nested in an expression, allowing for bounds checking to be bypassed and resulting in incorrect results. This can be triggered by...

PT-2023-8474 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14 Description: The issue is related to a lack of protection for service data in the FileProvider component of the macOS operating system. This may allow an attacker to disclose protected information. An app may be abl...

CVE-2023-43644 Improper authentication in the SOCKS5 inbound in sing-box

Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to...

PT-2023-28895 · Sing-Box · Sing-Box

Name of the Vulnerable Software and Affected Versions: Sing-box versions prior to 1.4.4 Sing-box versions prior to 1.5.0-rc.4 Description: The issue affects all SOCKS5 inbounds with user authentication in Sing-box, allowing an attacker to bypass authentication when specially crafted requests are...

PT-2023-29361 · WordPress · Gtranslate Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Translate WordPress with GTranslate WordPress plugin version 3.0.3 and earlier Description: The issue affects the Translate WordPress with GTranslate WordPress plugin, where it does not properly sanitise and escape some of its settings. This...

PT-2023-5441 · Docker · Docker Desktop

Name of the Vulnerable Software and Affected Versions: Docker Desktop versions prior to 4.12.0 Description: The issue is related to incorrect code generation management in Docker Desktop, allowing a remote attacker to execute arbitrary code via query parameters in the message-box route. This can...

PT-2023-27312 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 1.18.11 Description: DataEase is an open source data visualization and analysis tool. The program only uses the ImageIO.read method to determine whether the file is an image file or not. There is no whitelisting...

PT-2023-28848 · Jenkins · Jenkins Build Failure Analyzer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to delete Failure Causes. This issue arises because the plugin does not require POST requests for a...

Important: docker

Issue Overview: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

PT-2023-27452 · Apple · Xcode +1

Name of the Vulnerable Software and Affected Versions: Xcode versions prior to 15 Description: The issue allows an app to potentially access App Store credentials. It was addressed by enabling hardened runtime. Recommendations: For versions prior to 15, update to Xcode 15 to resolve the issue. As...

PT-2023-28385 · Withsecure · Withsecure Elements Endpoint Protection +5

Name of the Vulnerable Software and Affected Versions: WithSecure Client Security version 15 WithSecure Server Security version 15 WithSecure Email and Server Security version 15 WithSecure Elements Endpoint Protection versions 17 and later WithSecure Client Security for Mac version 15 WithSecure...

PT-2023-30751 · WordPress · File Manager Pro

Name of the Vulnerable Software and Affected Versions: File Manager Pro WordPress plugin versions prior to 1.8 Description: The issue arises from the improper checking of the CSRF nonce in the fs connector AJAX action. This allows attackers to perform highly privileged file system actions via CSR...

PT-2023-30797

Name of the Vulnerable Software and Affected Versions CF Software Oil Management Software versions prior to 20230912 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-30790

Name of the Vulnerable Software and Affected Versions Besttem Network Marketing Software versions prior to 1.0.2309.6 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-28145 · Shirasagi · Shirasagi

Name of the Vulnerable Software and Affected Versions: SHIRASAGI versions prior to 1.18.0 Description: The issue is related to a Post-Unicode normalization problem. This occurs when security checks are performed before Unicode normalization, allowing Unicode character equivalents to resurface aft...

PT-2023-12128 · Ericsson · Ericsson Mobile Switching Center Server

Name of the Vulnerable Software and Affected Versions: Ericsson Mobile Switching Center Server MSC-S versions BC 18A and IS 3.1 through IS 3.1 CP21 Description: The issue allows relative path traversal via a specific parameter in the https request after authentication, which enables access to fil...

PT-2023-31358 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: librenms versions prior to 23.9.0 Description: The issue is related to Cross-site Scripting XSS - Generic. Recommendations: For versions prior to 23.9.0, update to version 23.9.0 or later to resolve the issue...

PT-2023-25661 · Opswat · Opswat Metadefender Kiosk

Name of the Vulnerable Software and Affected Versions: OPSWAT MetaDefender KIOSK version 4.6.1.9996 Description: An issue was discovered in OPSWAT MetaDefender KIOSK. It has an unquoted service path that can be abused locally. Recommendations: For OPSWAT MetaDefender KIOSK version 4.6.1.9996,...