PT-2023-23235 · WordPress · Wpbakery Page Builder

Name of the Vulnerable Software and Affected Versions: WPBakery Page Builder plugin versions prior to 6.13.0 Description: A Stored Cross-Site Scripting XSS vulnerability exists, affecting users with contributor or higher permissions. This issue allows for malicious script execution...

PT-2023-21783 · WordPress · Wp Job Portal

Name of the Vulnerable Software and Affected Versions: WP Job Portal plugin versions prior to 2.0.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into the website, which can then be...

PT-2023-21662 · WordPress · Bookit

Name of the Vulnerable Software and Affected Versions: BookIt plugin for WordPress versions up to, and including, 2.3.7 Description: The BookIt plugin for WordPress has an authentication bypass issue due to insufficient verification of the user being supplied during booking an appointment through...

PT-2023-21117 · WordPress · Jetpack Crm

Name of the Vulnerable Software and Affected Versions: Jetpack CRM plugin versions prior to 5.4.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For versions prior to 5.4.4, update...

PT-2023-3411 · Cloudflare · Cloudflare Warp Client For Windows

Name of the Vulnerable Software and Affected Versions: Cloudflare WARP client for Windows versions up to 2023.3.381.0 Description: The issue is related to insufficient access control policy on an IPC Named Pipe, allowing a malicious actor to remotely access the warp-svc.exe binary. This could...

KLA50365 ACE vulnerability in LibreOffice

Improper Input Validation vulnerability was found in LibreOffice. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories Arbitrary File Write in hsqldb 1.8.0 Exploitation Public exploits exist for this vulnerability. Related products LibreOffice CVE list...

PT-2023-19901 · Unknown · Amit Agarwal Google Xml Sitemap For Images

Name of the Vulnerable Software and Affected Versions: Amit Agarwal Google XML Sitemap for Videos plugin versions = 2.6.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

Home Assistant < 0.57 XSS Vulnerability

Home Assistant is prone to a cross-site scription XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Home Assistant < 0.67.0 Information Disclosure Vulnerability

Home Assistant is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2023-6089 · Adobe · Bridge

Name of the Vulnerable Software and Affected Versions: Adobe Bridge versions 12.0.4 and earlier Adobe Bridge versions 13.0.3 and earlier Description: The issue is related to a Use After Free vulnerability in Adobe Bridge, specifically when handling embedded fonts. This could lead to the disclosur...

PT-2023-3080

Name of the Vulnerable Software and Affected Versions VMware Tools versions prior to 12.2.5 VMware vCenter affected versions not specified Description A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity...

PT-2023-20992 · WordPress · Contact Form Email

Name of the Vulnerable Software and Affected Versions: Contact Form Email WordPress plugin versions prior to 1.3.38 Description: The issue is related to a Stored XSS vulnerability. It occurs because the plugin does not escape submitted values before displaying them in the HTML. There is no...

PT-2023-16265 · WordPress · File Away

Name of the Vulnerable Software and Affected Versions: File Away WordPress plugin versions 3.9.9.0.1 and earlier Description: The issue concerns a lack of validation and escaping of one of its shortcode attributes. This could allow users with a role as low as contributor to perform a Stored...

Important: kernel-livepatch-6.1.15-28.43

Issue Overview: In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. CVE-2022-48425 An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores an XFS image after failu...

PT-2023-20595 · Hewlett Packard · Hp Device Manager

Name of the Vulnerable Software and Affected Versions: HP Device Manager versions prior to 5.0.10 Description: The issue potentially allows command injection and/or elevation of privileges. Recommendations: For versions prior to 5.0.10, update to version 5.0.10 or later to resolve the issue...

PT-2023-25107 · Atos · Atos Unify Openscape 4000 Assistant +1

Name of the Vulnerable Software and Affected Versions: Atos Unify OpenScape 4000 Assistant versions V10 R0 through V10 R1.34.7 Atos Unify OpenScape 4000 Assistant versions V10 R1 through V10 R1.41.9 Atos Unify OpenScape 4000 Manager versions V10 R0 through V10 R1.34.7 Atos Unify OpenScape 4000...

Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs

Impact There are two separate security vulnerabilities here: 1 a security vulnerability that allows users to read arbitrary files on the machines that are running shared Gradio apps 2 the ability of users to use machines that are sharing Gradio apps to proxy arbitrary URLs Patches Both problems...

CVE-2023-34239 Unfiltered paths in gradio

Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly restrict file access to users. Additionally Gradio does not properly restrict the what URLs are proxied. These issues have been addressed in...

Medium: libldb

Issue Overview: Access controlled AD LDAP attributes can be discovered CVE-2023-0614 Affected Packages: libldb Issue Correction: Run dnf update libldb --releasever 2023.0.20230607 or dnf update --advisory ALAS2023-2023-187 --releasever 2023.0.20230607 to update your system. More information on ho...

PT-2023-12489 · WordPress · Wp Quick Frontend Editor

Name of the Vulnerable Software and Affected Versions: WP Quick FrontEnd Editor plugin for WordPress versions up to and including 5.5 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with minimal permissions to inject arbitra...