Low: libcap

Issue Overview: libcap is vulnerable to a denial of service caused by the error handling in wrappthreadcreate function, which will cause memory to be leaked in the case of an error. CVE-2023-2602 Affected Packages: libcap Issue Correction: Run dnf update libcap --releasever 2023.0.20230607 or dnf...

Medium: wayland

Issue Overview: An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wlshm buffer...

PT-2023-12477 · WordPress · Pwa For Wp & Amp

Name of the Vulnerable Software and Affected Versions: PWA for WP & AMP plugin for WordPress versions up to, and including, 1.7.32 Description: The issue is related to authorization bypass due to a missing capability check on the pwaforwp update features options function. This allows authenticate...

Medium: dnsmasq

Issue Overview: An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. CVE-2023-28450 Affected Packages: dnsmasq Issue Correction: Run dnf update dnsmasq --releasever 2023.0.20230607 or dnf update...

PT-2023-22855 · Mobatime · Mobatime

Name of the Vulnerable Software and Affected Versions: Mobatime mobile application AMXGT100 versions 1.3.20 and earlier Description: The issue allows a low-privileged user to impersonate anyone else, including administrators, due to an Incorrect Authorization vulnerability in the Mobatime mobile...

PT-2023-3017

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 114.0.5735.110 Description The issue is related to a type confusion in V8, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code...

PT-2023-22995 · Teampass · Teampass

Name of the Vulnerable Software and Affected Versions: teampass versions prior to 3.0.9 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input that contains malicious scripts and later displays this input without proper validatio...

PT-2023-16789 · WordPress · Bookly

Name of the Vulnerable Software and Affected Versions: Bookly plugin for WordPress versions up to, and including, 21.5 Description: The issue is related to Stored Cross-Site Scripting via service titles due to insufficient input sanitization and output escaping. This allows authenticated attacker...

PT-2023-3037 · Honeywell · Honeywell Onewireless

Name of the Vulnerable Software and Affected Versions: Honeywell OneWireless version 322.1 Description: The issue is related to the use of insufficiently random values in Honeywell OneWireless, which may allow a remote attacker to manipulate claims in a client's JWT token, potentially gaining...

Debian: Security Advisory (DLA-3436-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-3619 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 114.0.5735.90 Description: The issue is related to an out of bounds memory access in Mojo, a component of Google Chrome, which could allow a remote attacker to exploit heap corruption via a crafted HTML page...

PT-2023-6984 · WordPress · Social Share

Name of the Vulnerable Software and Affected Versions: Social Share, Social Login and Social Comments WordPress plugin versions prior to 7.13.52 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitized and escaped before being...

PT-2023-21960 · Yoast · Yoast Seo

Name of the Vulnerable Software and Affected Versions: Yoast SEO: Local plugin versions prior to 14.9 Description: A Stored Cross-Site Scripting XSS vulnerability exists, allowing contributors or higher-privileged users to inject malicious scripts. Recommendations: For versions prior to 14.9,...

PT-2023-24282 · WordPress · Crm Perks Contact Form Entries

Name of the Vulnerable Software and Affected Versions: CRM Perks Contact Form Entries plugin versions prior to 1.3.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. This type of vulnerability allows an...

PT-2023-18804 · Bottle · Bottle

Name of the Vulnerable Software and Affected Versions: Bottles versions prior to 51.0 Description: The issue is related to the mishandling of YAML load, which can be exploited for remote code execution via a crafted file. Recommendations: For versions prior to 51.0, update to version 51.0 or late...

PT-2023-23164 · Nextcloud · Nextcloud Cookbook

Name of the Vulnerable Software and Affected Versions: NextCloud Cookbook versions prior to commit a46d9855 on the master branch and commit 489bb744 on the main-0.9.x branch Description: The issue concerns a command injection vulnerability due to the use of an untrusted github.head ref field in t...

PT-2023-24487 · Tfdi Design · Tfdi Design Smartcars 3

Name of the Vulnerable Software and Affected Versions: TFDi Design smartCARS 3 versions 0.7.0 and below Description: A stored cross-site scripting issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the body of a news article. Recommendations: For...

Fedora 37 : python3.11 (2023-63c69aa712)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-63c69aa712 advisory. Fix for CVE-2023-24329 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

PT-2023-19885 · WordPress · Boliquan Wp Clean Up

Name of the Vulnerable Software and Affected Versions: BoLiQuan WP Clean Up plugin versions prior to 1.2.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a we...

PT-2023-20085 · WordPress · Resize At Upload Plus

Name of the Vulnerable Software and Affected Versions: Resize at Upload Plus plugin versions 1.3 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a...