PT-2023-18640 · Unknown · Hiroaki Miyashita Custom Field Template Plugin

Name of the Vulnerable Software and Affected Versions: Hiroaki Miyashita Custom Field Template plugin versions = 2.5.8 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2023-22066 · Wedevs · Wedevs Happy Addons For Elementor

Name of the Vulnerable Software and Affected Versions: weDevs Happy Addons for Elementor plugin versions = 3.8.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions o...

PT-2023-25944 · WordPress · Wp Dummy Content Generator

Name of the Vulnerable Software and Affected Versions: Deepak Anand WP Dummy Content Generator plugin versions prior to 2.3.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-22143 · David F. Carr · Rsvpmaker Plugin

Name of the Vulnerable Software and Affected Versions: David F. Carr RSVPMaker plugin versions prior to 10.5.5 Description: The issue is related to an SQL Injection vulnerability in the David F. Carr RSVPMaker plugin. This vulnerability can be exploited by an attacker with admin+ privileges...

PT-2023-22967 · WordPress · Mstore Api +1

Name of the Vulnerable Software and Affected Versions: MStore API WordPress plugin versions prior to 3.9.8 Description: The issue is related to a Blind SQL injection that can be exploited by unauthenticated users. This occurs because a parameter is not properly sanitised and escaped before being...

PT-2023-21780 · Softmed · Softmed Selfpatron

Name of the Vulnerable Software and Affected Versions: Softmed SelfPatron versions prior to 2.0 Description: The issue affects Softmed SelfPatron, allowing for Reflected XSS due to improper neutralization of input during web page generation. Recommendations: For versions prior to 2.0, update to...

LM-CUSTOM-ADMIN, , Other

Version: Old 2.7.3 / New 2.7.4 Update details: block cde php shellexec Update URL: https://lomart.fr/extensions-blog/38-modules-administrator/125-lm-custom-administrator Changelog URL:...

PT-2023-25203 · Outline · Outline

Name of the Vulnerable Software and Affected Versions: outline/outline versions prior to 0.70.1 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation or escaping, allowing an...

Duplicate Advisory: @fastify/oauth2 Oauth2 state parameter reuse

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g8x5-p9qc-cf95. This link is maintained to preserve external references. Original Description All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all...

PT-2023-14869 · WordPress · Nd Shortcodes

Name of the Vulnerable Software and Affected Versions: ND Shortcodes WordPress plugin versions prior to 7.0 Description: The issue is related to the lack of validation and escaping of numerous shortcode attributes in the ND Shortcodes WordPress plugin. This could allow users with the contributor...

PT-2023-23292 · WordPress · Tutor Lms

Name of the Vulnerable Software and Affected Versions: Tutor LMS WordPress plugin versions prior to 2.2.1 Description: The issue concerns inadequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly availabl...

kubernetes security update

kubernetes 1.25.11-1 - Added Oracle specific build files for Kubernetes olcne 1.6.2-1 - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11 - Add all modules to registry-image-helper - update yq to 4.x 1.6.1-9 - Updated the CVE ID's in Istio-1.16.4 changelog entry 1.6.1-8 - Update Istio...

PT-2023-11875 · WordPress · Wp Erp

Name of the Vulnerable Software and Affected Versions: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress versions up to, and including, 1.6.3 Description: The issue is due to missing or incorrect nonce validation on the handle leave...

PT-2023-11503 · Unknown · Semcms Php

Name of the Vulnerable Software and Affected Versions: SEMCMS PHP version 3.7 Description: The issue allows remote attackers to upload arbitrary files and gain escalated privileges. Recommendations: For SEMCMS PHP version 3.7, update to a version that fixes the file upload issue to prevent remote...

URI gem has ReDoS vulnerability

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396parser.rb and rfc3986parser.rb. NOTE: this issue exists becuse of a...

PT-2023-14538 · Unknown · Weblib Ucopia

Name of the Vulnerable Software and Affected Versions: Weblib Ucopia versions prior to 6.0.13 Description: An issue in Weblib Ucopia allows OS Command Injection to occur, related to chroot. Recommendations: For versions prior to 6.0.13, update to version 6.0.13 or later to resolve the issue...

PT-2023-24885 · Spina · Spina

Name of the Vulnerable Software and Affected Versions: spina versions prior to 2.15.1 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository spinacms/spina. Recommendations: For versions prior to 2.15.1, update to version 2.15.1 or later to...

CVE-2023-34099 Improper mail validation in Shopware

Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7....

PT-2023-22496 · WordPress · Jetpack

Name of the Vulnerable Software and Affected Versions: Jetpack WordPress plugin versions prior to 12.1.1 Description: The issue allows users with author roles or above to manipulate existing files on the site, including deleting arbitrary files. In rare cases, it can also lead to Remote Code...

PT-2023-20551 · WordPress · Kivicare

Name of the Vulnerable Software and Affected Versions: KiviCare WordPress plugin versions prior to 3.2.1 Description: The issue allows low-privilege users, such as subscribers, to retrieve sensitive information of other users, including email and hashed password, due to the lack of restriction on...