PT-2023-6636 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 119.0.6045.105 Description: The issue is related to incorrect security UI in the Downloads component of Google Chrome, which can be exploited by a remote attacker to perform domain spoofing via a crafted domain...

PT-2023-23234 · Wpforms +1 · Wpforms +2

Name of the Vulnerable Software and Affected Versions: Database for Contact Form 7, WPforms, Elementor forms versions 1.3.0 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQ...

PT-2023-31975 · WordPress · Grid Plus

Name of the Vulnerable Software and Affected Versions: The Grid Plus plugin for WordPress versions up to, and including, 1.3.2 Description: The issue allows unauthorized modification of data and loss of data due to a missing capability check on the grid plus save layout callback and grid plus...

PT-2023-31866 · WordPress · Bellows Accordion Menu

Name of the Vulnerable Software and Affected Versions: The Bellows Accordion Menu plugin for WordPress versions up to, and including, 1.4.2 Description: The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied...

PT-2023-13518 · Lenovo · Lenovo Vantage Hardwarescan Plugin

Name of the Vulnerable Software and Affected Versions: Lenovo Vantage HardwareScan Plugin versions 1.3.0.5 and earlier Description: A denial of service issue was reported that could allow a local attacker to delete contents of an arbitrary directory under certain conditions. Recommendations: For...

PT-2023-29950 · WordPress · Wpdiscuz

Name of the Vulnerable Software and Affected Versions: wpDiscuz versions 7.6.10 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions 7.6.10 and earlier,...

PT-2023-29898 · Triberr · Triberr

Name of the Vulnerable Software and Affected Versions: Triberr plugin versions = 4.1.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the Triberr plugin. This vulnerability requires authentication with admin+ privileges. Recommendations: For...

PT-2023-28148 · Unknown · Flyteadmin

Name of the Vulnerable Software and Affected Versions: FlyteAdmin versions prior to 1.1.124 Description: The issue concerns a SQL vulnerability in list endpoints on FlyteAdmin, where a malicious user can send a REST request with custom SQL statements as list filters. This requires the attacker to...

PT-2023-30234 · Ispconfig · Ispconfig

Name of the Vulnerable Software and Affected Versions: ISPConfig versions prior to 3.2.11p1 Description: An issue was discovered that allows PHP code injection in the language file editor by an admin if admin allow langedit is enabled. This issue can be exploited to achieve PHP code injection...

PT-2023-23985 · Alkaweb · Alkaweb Eonet Manual User Approve Plugin

Name of the Vulnerable Software and Affected Versions: Alkaweb Eonet Manual User Approve plugin versions = 2.1.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the Alkaweb Eonet Manual User Approve plugin. This vulnerability requires authenticati...

PT-2023-29843 · Lionscripts.Com · Lionscripts.Com Webmaster Tools

Name of the Vulnerable Software and Affected Versions: LionScripts.Com Webmaster Tools plugin versions = 2.0 Description: The issue is related to an Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with administrative access can inject malicious...

PT-2023-22083 · Cakephp +2 · Cakephp +2

Name of the Vulnerable Software and Affected Versions: baserCMS versions prior to 4.8.0 Description: The issue is a XSS Vulnerability in the Favorites Feature of baserCMS, a website development framework that runs on PHP8 and CakePHP4. This vulnerability allows malicious code to be executed in th...

CVE-2023-41721

Instances of UniFi Network Application that i are run on a UniFi Gateway Console, and ii are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to t...

CVE-2023-41721

Instances of UniFi Network Application that i are run on a UniFi Gateway Console, and ii are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to t...

PT-2023-29679 · WordPress · Gopi Ramasamy Scroll Post Excerpt Plugin

Name of the Vulnerable Software and Affected Versions: Gopi Ramasamy Scroll post excerpt plugin versions = 8.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated administrators. This type of vulnerability allows an attacker to inject...

PT-2023-23397 · Dromara · Dromara Sureness

Name of the Vulnerable Software and Affected Versions: Dromara Sureness versions prior to 1.0.8 Description: The issue is related to the use of a hardcoded key in Dromara Sureness. Recommendations: For versions prior to 1.0.8, update to version 1.0.8 or later to resolve the issue...

PT-2023-28678 · Dell · Dell Unity

Name of the Vulnerable Software and Affected Versions: Dell Unity versions prior to 5.3 Description: The issue is related to an XML External Entity injection vulnerability. This could potentially be exploited by an XXE attack, which may disclose local files in the file system. Recommendations: Fo...

PT-2023-29838 · Userback · Userback

Name of the Vulnerable Software and Affected Versions: Userback plugin versions 1.0.13 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is...

PT-2023-6348

Name of the Vulnerable Software and Affected Versions VMware Workstation versions prior to 17.5 and VMware Fusion versions prior to 13.5 Description A flaw exists in the functionality for sharing host Bluetooth devices with virtual machines in VMware Workstation and VMware Fusion. This issue...

PT-2023-29943 · Nagvis +1 · Nagvis +1

Name of the Vulnerable Software and Affected Versions: NagVis versions prior to 1.9.38 Description: The issue exists due to a cross-site scripting XSS flaw in the select function located in share/server/core/functions/html.php. This allows for potential XSS attacks. Recommendations: For versions...