PT-2023-18257 · Unknown · Factorytest

Name of the Vulnerable Software and Affected Versions: FactoryTest application prior to SMR May-2023 Release 1 Description: The issue is related to improper input validation in the FactoryTest application, allowing local attackers to achieve privilege escalation through debugging commands...

PT-2023-18238 · Google · Android

Name of the Vulnerable Software and Affected Versions: Call Settings versions prior to SMR May-2023 Release 1 Description: The issue allows physical attackers to access some media data stored in sandbox due to an improper export of android application components vulnerability in...

PT-2023-19199 · Unknown · Dgcult Exquisite Paypal Donation Plugin

Name of the Vulnerable Software and Affected Versions: DgCult Exquisite PayPal Donation plugin versions prior to 2.0.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions prior to...

PT-2023-19272 · Metaphor Creations · Ditty

Name of the Vulnerable Software and Affected Versions: Metaphor Creations Ditty plugin versions prior to 3.0.33 Description: A Stored Cross-Site Scripting XSS issue exists, allowing contributors or higher-privileged users to inject malicious scripts. Recommendations: For versions prior to 3.0.33,...

PT-2023-18656 · WordPress · Wordpress Download Manager Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: WordPress Download Manager Gutenberg Blocks by WordPress Download Manager plugin versions = 2.1.8 Description: The issue is related to an Authenticated Cross-Site Scripting XSS vulnerability. This means that an attacker with contributor or...

PT-2023-20404 · Totalsoft · Video Gallery

Name of the Vulnerable Software and Affected Versions: Video Gallery by Total-Soft Video Gallery plugin versions 1.7.6 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: Fo...

PT-2023-17291 · WordPress · Limit Login Attempts

Name of the Vulnerable Software and Affected Versions: Limit Login Attempts WordPress plugin versions 1.7.2 and earlier Description: The issue concerns the Limit Login Attempts WordPress plugin, where it fails to sanitize and escape usernames when outputting them back in the logs dashboard. This...

PT-2023-23323 · Evasys · Evasys

Name of the Vulnerable Software and Affected Versions: evasys versions prior to 8.2 Build 2286 evasys versions 9.x prior to 9.0 Build 2401 Description: The issue concerns the lack of input validation for certain parameters in evasys, specifically nutzer titel, nutzer vn, nutzer nn, langID, and...

PT-2023-19784 · Unknown · Appium-Desktop

Name of the Vulnerable Software and Affected Versions: appium-desktop versions prior to 1.22.3-4 Description: The issue is an OS Command Injection, which affects the GitHub repository appium/appium-desktop. Recommendations: For versions prior to 1.22.3-4, update to version 1.22.3-4 or later to...

PT-2023-23015 · Triton +2 · Triton +2

Name of the Vulnerable Software and Affected Versions: Triton versions prior to 3.8.4 Description: The issue affects the Triton Minecraft plugin for Spigot and BungeeCord, allowing execution of commands on the spigot/bukkit console through the CustomPayload packet. When bungee mode is enabled in...

PT-2023-21201 · Ibm · Ibm Counter Fraud Management For Safer Payments

Name of the Vulnerable Software and Affected Versions: IBM Counter Fraud Management for Safer Payments versions 6.1.0.00 through 6.1.1.02 IBM Counter Fraud Management for Safer Payments versions 6.2.0.00 through 6.2.2.02 IBM Counter Fraud Management for Safer Payments versions 6.3.0.00 through...

Code injection

Wasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined behavior was found to cause runtime-level issues when compiled...

PT-2023-18931 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.21 Description: This issue is related to Cross-site Scripting XSS - Reflected, which has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cook...

PT-2023-23001 · Unknown · Typed-Rest-Client

Name of the Vulnerable Software and Affected Versions: typed-rest-client versions 1.7.3 and earlier Description: The typed-rest-client library is vulnerable to leaking authentication data to third parties. This occurs when a request is sent with BasicCredentialHandler, BearerCredentialHandler, or...

PT-2023-22615 · Cltphp · Cltphp

Name of the Vulnerable Software and Affected Versions: CLTPHP versions prior to 6.1 Description: The issue allows for Directory Traversal. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited...

PT-2023-15430 · Fullworks · Fullworks Quick Contact Form

Name of the Vulnerable Software and Affected Versions: Fullworks Quick Contact Form plugin versions = 8.0.3.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions = 8.0.3.1, update t...

PT-2023-02: Auth Path Traversal and Command Injection in account_print.cgi in Zyxel products

An issue was identified in Zyxel products affecting: USG FLEX ZLD V4.50-V5.35 и VPN ZLD V4.30-V5.35. Discovered vulnerability in accountprint.cgi can be exploited by an authenticated attacker with administrator privileges to execute unauthorized OS commands in the tmp directory if hotspot functio...

PT-2023-20103 · WordPress · Oliver Schlöbe Simple Yearly Archive

Name of the Vulnerable Software and Affected Versions: Oliver Schlöbe Simple Yearly Archive plugin versions = 2.1.8 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Oliver Schlöbe Simple...

PT-2023-03: Unauth Buffer Overflow in fbwifi_forward.cgi in Zyxel products

An issue was identified in Zyxel products affecting: USG FLEX ZLD V4.50V5.35; USG FLEX 50W/ USG20W-VPN ZLD V4.30V5.35; VPN ZLD V4.30V5.35. Discovered vulnerability of Buffer Overflow in fbwififorward.cgi can be exploited by an unauthenticated attacker to cause a denial of service DoS conditions b...

PT-2023-20097 · Podlove · Podlove Subscribe Button

Name of the Vulnerable Software and Affected Versions: Podlove Podlove Subscribe button plugin versions 1.3.7 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions 1.3.7 a...