PT-2023-25124 · Unknown · Bma Personnel Tracking System

Name of the Vulnerable Software and Affected Versions: BMA Personnel Tracking System versions before 20230904 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. The...

PT-2023-26517 · Unknown · Vi Web Client

Name of the Vulnerable Software and Affected Versions: VI Web Client versions prior to 7.9.6 Description: The issue allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL. This can lead to users being redirected t...

CVE-2023-41057

Hyper-bump-it contains a Path Traversal vulnerability due to not checking that the globbed files reside under the project root. The code joins project root with a config-supplied string to build the target path, which can cause edits to files outside the project. The issue is fixed in release v0....

Hyper Bump It Path Traversal Vulnerability

Hyper Bump It is a command line tool used to update the version in the project file required for the next release. A path traversal vulnerability exists in versions of Hyper Bump It prior to 0.5.1, which stems from not checking files in the project root directory...

PT-2023-28406 · WordPress · Ai Chatbot

Name of the Vulnerable Software and Affected Versions: AI ChatBot WordPress plugin versions prior to 4.7.8 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a...

PT-2023-19188 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.10.0 Description: An authorization/sensitive information disclosure issue was identified in GitHub Enterprise Server, allowing a fork to retain read access to an upstream repository after its...

PT-2023-20095 · WordPress · Yotuwp Video Gallery

Name of the Vulnerable Software and Affected Versions: Yotuwp Video Gallery plugin versions prior to 1.3.13 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Yotuwp Video Gallery plugin...

PT-2023-26164 · Unknown · Chop-Chop Coming Soon Chop Chop

Name of the Vulnerable Software and Affected Versions: Chop-Chop Coming Soon Chop Chop plugin versions 2.2.4 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...

Design/Logic Flaw

Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single socket for outgoing DNS queries and while that socket is bound to a random port number it is never changed again. This goes against recommended practice sin...

PT-2023-30069 · Instantsoft · Icms2

Name of the Vulnerable Software and Affected Versions: instantsoft/icms2 versions prior to 2.16.1-git Description: The issue is related to Cross-site Scripting XSS - Stored. This means that an attacker can inject malicious scripts into a website, which are then stored on the server and executed b...

PT-2023-21977 · Zscaler · Zscaler Admin Ui

Name of the Vulnerable Software and Affected Versions: Zscaler Admin UI versions 6.2 before 6.2r Description: The issue is related to an improper verification of cryptographic signature in the SAML authentication of the Zscaler Admin UI, allowing a privilege escalation. Recommendations: For...

PT-2023-5398 · Schweitzer Engineering Laboratories · Sel-5033 Acselerator Rtac

Name of the Vulnerable Software and Affected Versions: Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software versions prior to 1.35.151.21000 Description: The issue is related to incorrect permission assignment for a critical resource, allowing an attacker to manipulate data in...

PT-2023-23525 · Brocade · Brocade Sannav

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.3.0 Brocade SANnav version 2.2.2a Description: The issue allows a privileged user to retrieve SNMPv3 Authentication passwords stored in plaintext, given knowledge and access to log files. This could occur wh...

PT-2023-30070 · Unknown · Instantsoft/Icms2

Name of the Vulnerable Software and Affected Versions: instantsoft/icms2 versions prior to 2.16.1 Description: The issue concerns a sensitive cookie in an HTTPS session that lacks the 'Secure' attribute. This problem is identified in the GitHub repository instantsoft/icms2. Recommendations: For...

PT-2023-23312 · Brocade · Brocade Sannav

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.3.0 Brocade SANnav version 2.2.2 and earlier, excluding 2.2.2a Description: The issue allows remote unauthenticated users to bypass web authentication and authorization. Recommendations: For Brocade SANnav...

PT-2023-20073 · WordPress · Ian Sadovy Wordpress Tables Plugin

Name of the Vulnerable Software and Affected Versions: Ian Sadovy WordPress Tables plugin versions = 1.3.9 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website without proper authentication,...

PT-2023-24845 · Didier Sampaolo · Spamreferrerblock

Name of the Vulnerable Software and Affected Versions: Didier Sampaolo SpamReferrerBlock plugin versions = 2.22 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the Didier Sampaolo SpamReferrerBlock plugin. This vulnerability requires authenticatio...

PT-2023-24385 · WordPress · Subscribers Text Counter

Name of the Vulnerable Software and Affected Versions: Subscribers Text Counter WordPress plugin versions prior to 1.7.1 Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. This...

PT-2023-27960 · WordPress · User Activity Tracking/Log

Name of the Vulnerable Software and Affected Versions: User Activity Tracking and Log WordPress plugin versions prior to 4.0.9 Description: The issue is related to a lack of proper CSRF checks when managing the license of the plugin. This could allow attackers to make logged-in admins update and...

PT-2023-24714 · WordPress · Chilexpress Chilexpress Woo Oficial Plugin

Name of the Vulnerable Software and Affected Versions: Chilexpress Chilexpress woo oficial plugin versions 1.2.9 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability allows for the execution of malicious scripts on the...