PT-2023-8483 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14 Description: The issue is related to a lack of protection for service data in the printing component of the macOS operating system. This could allow an attacker to disclose protected information. An app may be able ...

PT-2023-28132 · Poll Maker Team · Poll Maker Plugin

Name of the Vulnerable Software and Affected Versions: Poll Maker Team Poll Maker plugin versions = 4.7.0 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...

PT-2023-5659 · Apple · Ipados +4

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.6 macOS versions prior to 12.7 macOS versions prior to 14 tvOS versions prior to 17 iOS versions prior to 16.7 iOS versions prior to 17 iPadOS versions prior to 16.7 iPadOS versions prior to 17 watchOS versions prio...

‘ThemeBleed’ flaw in Windows 11 Enables Code Execution

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary The CVE-2023-38146 vulnerability in Windows 11 allows remote attackers to execute arbitrary code, potentially compromising the affected systems security and integrity, and posing a significant...

CVE-2023-4972

Incorrect Use of Privileged APIs vulnerability in Yepas Digital Yepas allows Collect Data as Provided by Users.This issue affects Digital Yepas: before 1.0.1...

PT-2023-31310

Name of the Vulnerable Software and Affected Versions Digital Yepas version 1.0.0 Description The issue is related to an Improper Privilege Management vulnerability, allowing the collection of data as provided by users. This can be exploited due to the incorrect use of privileged APIs...

Yepas Digital Yepas Security Breach

Yepas Digital Yepas is an online trading portal from Yepas Digital. A security vulnerability exists in Yepas Digital Yepas that stems from a mismanagement of privileges that allows an attacker to collect user-supplied data...

Microsoft Exchange Project Deserialization of Untrusted Data Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Microsoft Exchange. Authentication is required to exploit this vulnerability. The specific flaw exists within the lack of protection against deserialization of the Project class. The issue...

Sensitive Data Exposure

nilsteampassnet/teampass is vulnerable to Sensitive Data Exposure. The vulnerability is due to not restricting/limiting directory listing for various end points. The leads to disclosing application-specific user data and files...

CVE-2023-32432

A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Ventura 13.4, tvOS 16.5, iOS 16.5 and iPadOS 16.5, watchOS 9.5. An app may be able to access user-sensitive data...

highlight.php - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-043

Provides highlight.php integration to Drupal, allowing blocks to be automatically highlighted with the correct language. The module's Twig function doesn't sufficiently filter user-entered data...

Apple macOS Ventura Security Vulnerability

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Ventura version 13.4, which stems from an application that may be able to access sensitive user data...

Out-Of-Bounds Write

7zip is vulnerable to Out-Of-Bounds Write. The vulnerability exists due to the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer, allowing an attacker to leverage this vulnerability to execute code in the context of the current proces...

CVE-2023-4587

CVE-2023-4587 describes an insecure direct object reference (IDOR) in the ZKTeco ZEM800, version 6.60. A local attacker can obtain registered user backup files or device configuration files over a local network or via VPN. The vulnerability is rooted in access to sensitive object data without pro...

PT-2023-27331 · Vathemes · Vathemes Business Pro

Name of the Vulnerable Software and Affected Versions: Vathemes Business Pro theme versions = 1.10.4 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to steal...

PT-2023-27153 · Unknown · Saasproject Booking Package

Name of the Vulnerable Software and Affected Versions: SAASPROJECT Booking Package plugin versions = 1.6.01 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...

PT-2023-27323 · Pixelgrade · Pixtypes

Name of the Vulnerable Software and Affected Versions: Pixelgrade PixTypes plugin versions 1.4.15 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them t...

LG LED Assistant Path Traversal Vulnerability

LG LED Assistant is a software from Luckin LG Korea. It is used to set up LED lights. A security vulnerability exists in LG LED Assistant that originates from failure to properly validate a user-supplied path before using it in a file operation, allowing remote attackers to disclose information...

PT-2023-22730 · Imagerecycle · Imagerecycle Pdf & Image Compression Plugin

Name of the Vulnerable Software and Affected Versions: ImageRecycle ImageRecycle pdf & image compression plugin versions = 3.1.10 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

PT-2023-27197 · Blindside Networks · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: Blindside Networks BigBlueButton plugin versions = 3.0.0-beta.4 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowi...