PT-2023-26671 · Unknown · Online Shopping Portal Project

Name of the Vulnerable Software and Affected Versions: Online Shopping Portal Project version 3.1 Description: The issue allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This arises due to...

PDF-XChange Editor TIF File Parsing Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

PT-2023-4622 · Unknown · Tn-5900 Series +1

Name of the Vulnerable Software and Affected Versions: TN-4900 Series firmware versions v1.2.4 and prior TN-5900 Series firmware versions v3.3 and prior Description: The issue stems from insufficient input validation in the certificate-generation function, which could potentially allow malicious...

CVE-2023-39949 Improper validation of sequence numbers leading to remotely reachable assertion failure

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.9.1 and 2.6.5, improper validation of sequence numbers may lead to remotely reachable assertion failure. This can remotely crash any Fast-DDS process. Versions...

CVE-2023-30696

An improper input validation in IpcTxGetVerifyAkey in libsec-ril prior to SMR Aug-2023 Release 1 allows attacker to cause out-of-bounds write...

PT-2023-28577 · WordPress · Absolute Privacy

Name of the Vulnerable Software and Affected Versions: Absolute Privacy plugin for WordPress versions up to, and including, 2.1 Description: The issue is due to missing nonce validation on the abpr profileShortcode function, making it possible for unauthenticated attackers to change user email an...

PT-2023-22895 · Unknown · Libsec-Ril

Name of the Vulnerable Software and Affected Versions: libsec-ril versions prior to SMR Aug-2023 Release 1 Description: The issue is caused by improper input validation in the IpcTxGetVerifyAkey function, allowing an attacker to cause an out-of-bounds write. Recommendations: For versions prior to...

SUSE-SU-2023:3207-1 Security update for libqt5-qtbase

This update for libqt5-qtbase fixes the following issues: - CVE-2023-34410: Fixed certificate validation does not always consider whether the root of a chain is a configured CA certificate bsc1211994. - CVE-2023-33285: Fixed buffer overflow in QDnsLookup bsc1211642. - CVE-2023-32762: Fixed Qt...

PT-2023-27982 · Omeka-S · Omeka-S

Name of the Vulnerable Software and Affected Versions: omeka/omeka-s versions prior to 4.0.3 Description: The issue concerns improper input validation in the omeka/omeka-s GitHub repository. This can lead to injection attacks, where special elements are not properly neutralized in output used by...

PT-2023-5009 · 3S Smart Software Solutions · Codesys

Name of the Vulnerable Software and Affected Versions: CODESYS versions affected versions not specified Description: The issue is related to insufficient input validation in the CMPappBP component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of servic...

DEBIAN-CVE-2021-4323

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension to access local files via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2023-38565

A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.6.8, iOS 16.6 and iPadOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to gain root privileges...

CVE-2023-38060

Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType header of the attachment. This issue...

KeySight N6841A RF Sensor deleteFirmwarePackage Directory Traversal Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of KeySight N6841A RF Sensor. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

PT-2023-3701 · Oracle · Oracle Essbase

Name of the Vulnerable Software and Affected Versions: Oracle Essbase version 21.4.3.0.0 Description: The issue is related to insufficient input validation in the Security and Provisioning component of Oracle Essbase. Exploitation of this issue can allow an attacker to gain unauthorized access to...

PT-2023-25987 · 1Panel · 1Panel

Name of the Vulnerable Software and Affected Versions: 1Panel versions prior to 1.4.3 Description: An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP...

CVE-2023-2507 CleverTap Cordova Plugin 2.6.2 - Reflected XSS

CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them...

NETGEAR ProSAFE Network Management System MFileUploadController Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within th...

PT-2023-12529 · WordPress · The Forminator Forms

Name of the Vulnerable Software and Affected Versions: The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress versions up to, and including, 1.13.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the...

PT-2023-26211 · Jenkins · Jenkins Benchmark Evaluator Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Benchmark Evaluator Plugin versions 1.0.1 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb...