PT-2023-4115 · B&R Industrial Automation · B&R Automation Runtime

Name of the Vulnerable Software and Affected Versions: B&R Automation Runtime versions prior to G4.93 Description: The issue is related to improper initialization implementation in the Portmapper service used in B&R Industrial Automation Automation Runtime. This allows unauthenticated network-bas...

PT-2023-24694 · Jenkins · Jenkins Plug-In For Servicenow Devops +1

Name of the Vulnerable Software and Affected Versions: Jenkins Plug-in for ServiceNow DevOps versions prior to 1.38.1 Description: A cross-site request forgery issue exists that could cause the unwanted exposure of sensitive information if exploited successfully. Recommendations: For versions pri...

PT-2023-26542 · Unknown · Paddlepaddle

Name of the Vulnerable Software and Affected Versions: PaddlePaddle versions prior to 2.5.0 Description: The issue is related to a use after free condition in the paddle.diagonal function. This resulted in a potentially exploitable condition. Recommendations: For versions prior to 2.5.0, update t...

PT-2023-26546 · Unknown · Paddlepaddle

Name of the Vulnerable Software and Affected Versions: PaddlePaddle versions prior to 2.5.0 Description: The issue allows for command injection in the fs.py module, resulting in the ability to execute arbitrary commands on the operating system. Recommendations: For versions prior to 2.5.0, update...

GHSA-M8FW-P3CR-6JQC Cross-Site Scripting in CKEditor4 WordCount Plugin

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C 4.4 Problem The WordCount plugin npm:ckeditor-wordcount-plugin for CKEditor4 is vulnerable to cross-site scripting when switching to the source code mode. This plugin is enabled via the Full.yaml configuration present, but is not...

PT-2023-25566 · WordPress · Wpxpo Postx – Gutenberg Post Grid Blocks

Name of the Vulnerable Software and Affected Versions: wpxpo PostX – Gutenberg Post Grid Blocks plugin versions = 2.9.9 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into ...

PT-2023-25861 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 1.18.9 Description: DataEase is an open source data visualization analysis tool. It has a SQL injection vulnerability that can bypass blacklists. Recommendations: For versions prior to 1.18.9, update to version 1.18...

thunderbird security update

102.13.0-2.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build 102.13.0-2 - Update to 102.13.0 build2 102.13.0-1 - Update to 102.13.0 build1...

SUSE-SU-2023:2917-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: grafana: - Update to version 9.5.5: CVE-2023-3128: Fix authentication bypass using Azure AD OAuth bsc1212641, jscPED-3694 Bug fixes: Auth: Show invite button if disable login form is set to false. Azure: Fix Kusto auto-completion for Azure datasources. RBAC...

PT-2023-24122 · Hashicorp +1 · Hashicorp Nomad Enterprise +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad Enterprise versions 1.2.11 through 1.5.6 HashiCorp Nomad Enterprise version 1.4.10 Description: A vulnerability exists where the API caller's ACL token secret ID is exposed to Sentinel policies. Additionally, ACL policies usin...

PT-2023-7418

Name of the Vulnerable Software and Affected Versions aiohttp versions prior to 3.9.0 Description The issue arises from improper validation, allowing an attacker to modify the HTTP request or create a new one if they control the HTTP version. This can lead to CRLF injection and Request Smuggling...

PT-2023-26163 · Pluginpress · Pluginpress Shortcode Imdb

Name of the Vulnerable Software and Affected Versions: PluginPress Shortcode IMDB plugin versions 6.0.8 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended action...

PT-2023-15082 · Sitealert · Sitealert

Name of the Vulnerable Software and Affected Versions: SiteAlert plugin versions = 1.9.7 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that...

PT-2023-24105 · WordPress · Crudlab Jazz Popups

Name of the Vulnerable Software and Affected Versions: CRUDLab Jazz Popups plugin versions 1.8.7 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...

PT-2023-21484 · Ibm · Bigfix Webui Api App

Name of the Vulnerable Software and Affected Versions: Bigfix WebUI API App versions prior to 14 Description: The issue is related to insufficient validation, allowing an authenticated WebUI user to issue SQL queries via an unparameterized SQL query. Recommendations: For versions prior to 14,...

PT-2023-18894 · WordPress · Caldera Forms Google Sheets Connector

Name of the Vulnerable Software and Affected Versions: Caldera Forms Google Sheets Connector WordPress plugin versions prior to 1.3 Description: The issue is related to the lack of a CSRF check when updating the Access Code in the Caldera Forms Google Sheets Connector WordPress plugin. This could...

PT-2023-19100 · WordPress · Wp Life Album Gallery

Name of the Vulnerable Software and Affected Versions: A WP Life Album Gallery – WordPress Gallery plugin versions = 1.4.9 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2023-26216 · WordPress · Faboba Falang Multilanguage

Name of the Vulnerable Software and Affected Versions: Faboba Falang multilanguage for WordPress plugin versions = 1.3.39 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that...

PT-2023-18888

Name of the Vulnerable Software and Affected Versions WooCommerce Google Sheet Connector WordPress plugin versions prior to 1.3.6 Description The issue concerns a lack of CSRF check when updating the Access Code, allowing attackers to potentially make logged-in admins change the access code to an...

PT-2023-20893 · WordPress · Gravity Forms

Name of the Vulnerable Software and Affected Versions: Gravity Forms WordPress plugin versions prior to 2.7.5 Description: The issue is related to Reflected Cross-Site Scripting, which occurs because the plugin does not properly escape generated URLs before outputting them in attributes. This cou...