PT-2023-22874 · Samsung · Samsung Pass

Name of the Vulnerable Software and Affected Versions: Samsung Pass versions prior to 4.2.03.1 Description: The issue is related to improper access control in Samsung Pass, allowing physical attackers to access Samsung Pass data on an unlocked device under certain conditions. Recommendations: For...

PT-2023-22837 · Samsung · Galaxy Themes Service

Name of the Vulnerable Software and Affected Versions: Galaxy Themes Service versions prior to SMR Jul-2023 Release 1 Description: A missing authentication issue allows local attackers to delete arbitrary non-preloaded applications. Recommendations: For versions prior to SMR Jul-2023 Release 1,...

PT-2023-22871 · Samsung · Samsung Internet

Name of the Vulnerable Software and Affected Versions: Samsung Internet versions prior to 21.0.0.41 Description: The issue is related to an improper configuration that allows an attacker to bypass SameSite Cookie restrictions. This could potentially lead to security breaches, although specific...

PT-2023-8825

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 12.5 Description The issue is related to the upload of attachments to test plans and test cases in Kiwi TCMS. Earlier versions of Kiwi TCMS had changes to serve all uploaded files as plain text to prevent browsers...

PT-2023-23296

Name of the Vulnerable Software and Affected Versions: Protect WP Admin WordPress plugin versions prior to 4.0 Description: The issue allows an attacker to disclose the URL of the admin panel via a redirection of a crafted URL, effectively bypassing the protection offered by the plugin...

PT-2023-18911 · WordPress · Ninja Forms Google Sheet Connector +1

Name of the Vulnerable Software and Affected Versions: Ninja Forms Google Sheet Connector WordPress plugin versions prior to 1.2.7 gsheetconnector-ninja-forms-pro WordPress plugin versions prior to 1.2.7 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a...

PT-2023-11888 · WordPress · Dokan

Name of the Vulnerable Software and Affected Versions: Dokan plugin for WordPress versions up to, and including, 3.0.8 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the handle order export function. This allows unauthenticated...

PT-2023-4738

Name of the Vulnerable Software and Affected Versions tough-cookie versions prior to 4.1.3 Description The issue arises from improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode, leading to Prototype Pollution. This vulnerability is related to insufficient control...

PT-2023-11876 · Cartflows · Woocommerce Checkout & Funnel Builder By Cartflows

Name of the Vulnerable Software and Affected Versions: WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress versions up to, and including, 1.5.15 Description: The issue is due to missing or incorrect nonce validation on the export json, import json, and status logs file...

PT-2023-11875 · WordPress · Wp Erp

Name of the Vulnerable Software and Affected Versions: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress versions up to, and including, 1.6.3 Description: The issue is due to missing or incorrect nonce validation on the handle leave...

PT-2023-23911 · Unknown · Wl-Wn531Ax2

Name of the Vulnerable Software and Affected Versions: WL-WN531AX2 versions prior to 2023526 Description: The issue is related to the exposure of resources to the wrong sphere, potentially allowing a network-adjacent attacker to access functions that are originally available only after login,...

PT-2023-25930 · Pacparser +1 · Pacparser +1

Name of the Vulnerable Software and Affected Versions: Pacparser versions prior to 1.4.2 Description: The issue allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL, which may be realistic within enterprise security products. Recommendations: For...

PT-2023-4626 · Joplin · Joplin

Name of the Vulnerable Software and Affected Versions: Joplin versions prior to 2.11.5 Description: The issue is related to the lack of protection of the web page structure in the Joplin note-taking application, which can be exploited by a remote attacker to conduct a cross-site scripting XSS...

PT-2023-18712 · Western Digital · My Cloud Os 5

Name of the Vulnerable Software and Affected Versions: My Cloud OS 5 versions prior to 5.26.202 Description: An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonation attack. Recommendations: F...

PT-2023-8458

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.4.12 Description The issue is related to a use-after-free error in the amdgpu cs wait all fences function, located in drivers/gpu/drm/amd/amdgpu/amdgpu cs.c. This error can occur due to a race condition,...

PT-2023-21673

Name of the Vulnerable Software and Affected Versions Rails versions prior to 7.0.5.1 Rails versions prior to 6.1.7.4 Description The redirect to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream...

PT-2023-35505 · Xonotic · Xonotic

Name of the Vulnerable Software and Affected Versions: xonotic versions prior to 0.8.6 Description: A bug was discovered in xonotic that is believed to be exploitable by malicious server admins to crash clients or, if they defeat mitigations, execute arbitrary code. Recommendations: Update to...

CVE-2023-3389 Use after free in io_uring in the Linux Kernel

A use-after-free vulnerability in the Linux Kernel iouring subsystem can be exploited to achieve local privilege escalation. Racing a iouring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59...

PT-2023-12078 · Emby · Emby Server

Name of the Vulnerable Software and Affected Versions: Emby Server versions prior to 4.7.12.0 Description: The issue allows for a login bypass attack by setting the X-Forwarded-For header to a local IP address. This enables unauthorized access without proper credentials. Recommendations: For...

PT-2023-20513 · Unknown · Git-Commit-Info

Name of the Vulnerable Software and Affected Versions: git-commit-info versions prior to 2.0.2 Description: The issue arises from the gitCommitInfo method failing to sanitize its commit parameter, which later flows into a sensitive command execution API. This allows attackers to inject malicious...