PT-2023-26556 · Unknown · Matrix-Appservice-Bridge

Name of the Vulnerable Software and Affected Versions: matrix-appservice-bridge versions 4.0.0 through 8.1.1 matrix-appservice-bridge versions 9.0.0 Description: A malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the...

PT-2023-13413 · Dell · Dell Xtremio X2 Xms

Name of the Vulnerable Software and Affected Versions: Dell XtremIO X2 XMS versions prior to 6-4-1.11 Description: The issue is related to improper access control, allowing a remote read-only user to potentially exploit it and perform actions such as adding or deleting QoS policies, which are...

PT-2023-27869 · Answerdev · Answer

Name of the Vulnerable Software and Affected Versions: answerdev/answer versions prior to 1.1.0 Description: The issue concerns weak password requirements in the GitHub repository answerdev/answer. Recommendations: For versions prior to 1.1.0, update to version 1.1.0 or later to resolve the issue...

PT-2023-26365 · Oxid · Oxid Eshop Enterprise Edition

Name of the Vulnerable Software and Affected Versions: OXID eShop Enterprise Edition versions 6.5.0 through 6.5.2 Description: The issue allows uploading files with modified headers in the administration area, enabling an attacker to create a HTTP Response Splitting attack by uploading a file wit...

PT-2023-26563 · Mindsdb +1 · Mindsdb +1

Name of the Vulnerable Software and Affected Versions: MindsDB versions prior to 23.7.4.0 Description: The issue concerns the MindsDB's AI Virtual Database, which allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with verify=False disabl...

PT-2023-25043 · Poppler +5 · Poppler +5

Name of the Vulnerable Software and Affected Versions: Poppler versions prior to 23.06.0 Description: A vulnerability in Outline.cc for Poppler allows a remote attacker to cause a Denial of Service DoS crash via a crafted PDF file in OutlineItem::open. Recommendations: For versions prior to...

PT-2023-26395 · Saturday Drive · Ninja Forms

Name of the Vulnerable Software and Affected Versions: Ninja Forms versions 3.6.25 and earlier Description: The issue is related to a Missing Authorization vulnerability in Saturday Drive Ninja Forms. Recommendations: For versions 3.6.25 and earlier, update to a version later than 3.6.25 to resol...

PT-2023-23787 · Apple · Music

Name of the Vulnerable Software and Affected Versions: Apple Music versions prior to 4.2.0 for Android Description: The issue allows an attacker in a privileged network position to intercept network traffic. This was addressed by using HTTPS when sending information over the network...

PT-2023-26224 · WordPress · Wpfunnels

Name of the Vulnerable Software and Affected Versions: WPFunnels Team Drag & Drop Sales Funnel Builder for WordPress – WPFunnels plugin versions = 2.7.16 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker...

PT-2023-26484 · Node.Js · Sails

Name of the Vulnerable Software and Affected Versions: Sails versions prior to 1.5.7 Description: Sails is a realtime MVC Framework for Node.js. An attacker can send a virtual request that will cause the node process to crash. Recommendations: For versions prior to 1.5.7, update to version 1.5.7 ...

PT-2023-26222 · WordPress · Radiustheme Variation Swatches For Woocommerce

Name of the Vulnerable Software and Affected Versions: RadiusTheme Variation Swatches for WooCommerce plugin versions prior to 2.3.8 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the...

PT-2023-26045 · Netdisco · Netdisco

Name of the Vulnerable Software and Affected Versions: Netdisco versions prior to 2.063000 Description: A cross-site scripting XSS issue was found in the /Web/TypeAhead.pm component. Recommendations: For versions prior to 2.063000, update to version 2.063000 or later to resolve the issue...

PT-2023-26811 · Jenkins · Jenkins Qualys Web App Scanning Connector Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Qualys Web App Scanning Connector Plugin versions 2.0.10 and earlier Description: The issue arises from incorrect permission checks in the Jenkins Qualys Web App Scanning Connector Plugin, allowing attackers with global Item/Configure...

PT-2023-26959 · Mcafee · Epo

Name of the Vulnerable Software and Affected Versions: ePO versions prior to 5.10 SP1 Update 1 Description: A reflected cross-site scripting XSS vulnerability allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated eP...

PT-2023-19243 · Steven Henty · Drop Shadow Boxes

Name of the Vulnerable Software and Affected Versions: Steven Henty Drop Shadow Boxes plugin versions 1.7.10 and earlier Description: The issue is related to an Authenticated Cross-Site Scripting XSS vulnerability. This means that an attacker with contributor or higher privileges can inject...

PT-2023-25597 · Cththemes · Cththemes Balkon

Name of the Vulnerable Software and Affected Versions: cththemes Balkon plugin versions 1.3.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for malicious scripts to be injected into web...

PT-2023-25112 · WordPress · Neha Goel Recent Posts Slider

Name of the Vulnerable Software and Affected Versions: Neha Goel Recent Posts Slider plugin versions = 1.1 Description: The issue is related to an Unauth. Stored Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be stored on the server and executed when a user accesses...

PT-2023-5946

Name of the Vulnerable Software and Affected Versions: copyparty versions prior to 1.8.7 Description: The application contains a reflected cross-site scripting vulnerability via URL-parameters ?k304=... and ?setck=.... This could allow an attacker to execute malicious javascript code by tricking...

PT-2023-25596 · WordPress · Teachpress

Name of the Vulnerable Software and Affected Versions: teachPress plugin versions = 9.0.2 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, potentially leading...

PT-2023-4209 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.5 Description: The issue is related to insufficient access control in the Voice Memos component of the macOS operating system. It may allow an attacker to gain unauthorized access to sensitive information. The...