PT-2023-19164 · Formilla · Formilla Live Chat

Name of the Vulnerable Software and Affected Versions: Formilla Live Chat by Formilla plugin versions prior to 1.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Formilla Live Chat by...

PT-2023-22699 · Atlassian +1 · Confluence +1

Name of the Vulnerable Software and Affected Versions: MoroSystems EasyMind - Mind Maps plugin versions prior to 2.15.0 for Confluence Description: The issue allows persistent XSS when saving a Mind Map with the hyperlink parameter. This can lead to the execution of malicious scripts within the...

PT-2023-19119 · WordPress · File Gallery

Name of the Vulnerable Software and Affected Versions: File Gallery plugin versions = 1.8.5.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. This allows for malicious scripts to be stored on the serve...

CVE-2023-32308 SQL Injection Vulnerability in anuko timetracker

anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for error...

SUSE: Security Advisory (SUSE-SU-2023:2187-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-21702 · Apexchat · Apexchat

Name of the Vulnerable Software and Affected Versions: ApexChat plugin versions = 1.3.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For ApexChat plugin versions = 1.3.1, update to a...

Boxo bitswap/server: DOS unbounded persistent memory leak

Impact An attacker is able allocate arbitrarily many bytes in the Bitswap server by sending many WANTBLOCK and or WANTHAVE requests which are queued in an unbounded queue, with allocations that persist even if the connection is closed. This affects users accepting untrusted connections with the...

PT-2023-22194 · Vitess +2 · Vitess +2

Name of the Vulnerable Software and Affected Versions: Vitess versions prior to 16.0.2 Description: The issue allows users to create a shard containing / characters from VTAdmin, which can cause errors when trying to create new shards or view keyspaces. Creating a shard using vtctldclient does no...

CVE-2023-32070 Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers

XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting XSS attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. Ther...

Multiple vulnerabilities in MicroEngine Mailform

Overview MicroEngine Mailform provided by MicroEngine Inc. contains multiple vulnerabilities listed below. Unrestricted upload of file with dangerous type CWE-434 - CVE-2023-27397 Path traversal CWE-22 - CVE-2023-27507 Yuji Tounai of Mitsui Bussan Secure Directions, Inc. and hibiki moriyama of...

PT-2023-14001 · Intel · Intel Qat Drivers

Name of the Vulnerable Software and Affected Versions: IntelR QAT drivers for Windows versions prior to 1.9.0 Description: The issue is related to improper access control in IntelR QAT drivers for Windows, which may allow an authenticated user to potentially enable information disclosure via loca...

PT-2023-21395 · Unknown · Liquid Speech Balloon

Name of the Vulnerable Software and Affected Versions: LIQUID SPEECH BALLOON versions prior to 1.2 Description: A cross-site request forgery CSRF issue allows a remote unauthenticated attacker to hijack the authentication of a user and perform unintended operations by having a user view a malicio...

PT-2023-18406 · Intel · Intel Server Board Bmc Firmware

Name of the Vulnerable Software and Affected Versions: IntelR Server Board BMC firmware versions prior to 2.90 Description: The issue allows a privileged user to enable escalation of privilege via local access due to access of memory location after end of buffer in the firmware. Recommendations:...

PT-2023-19294 · Intel · Intel Trace Analyzer/Collector

Name of the Vulnerable Software and Affected Versions: IntelR Trace Analyzer and Collector software versions prior to 2021.8.0 Description: The issue is related to an out-of-bounds read that may allow an authenticated user to potentially enable information disclosure via local access...

PT-2023-14016 · Intel · Intel Quartus Prime Pro

Name of the Vulnerable Software and Affected Versions: IntelR QuartusR Prime Pro edition software versions prior to 22.3 Description: The issue is related to an uncontrolled search path in the software, which may allow an authenticated user to potentially enable escalation of privilege via local...

PT-2023-14015 · Intel · Intel Retail Edge Mobile Ios

Name of the Vulnerable Software and Affected Versions: IntelR Retail Edge Mobile iOS application versions prior to 3.4.7 Description: The issue is related to improper access control, which may allow an authenticated user to potentially enable escalation of privilege via local access...

PT-2023-14059 · Intel · Intel Dcm

Name of the Vulnerable Software and Affected Versions: IntelR DCM software versions prior to 5.1 Description: The issue is related to an uncontrolled search path in the IntelR DCM software, which may allow an authenticated user to potentially enable escalation of privilege via local access...

Node.js: Regular Expression Denial of Service in Headers fetch API

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set and Headers.append methods are vulnerable to Regular Expression Denial of Service ReDoS attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normali...

PT-2025-25912 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.4.0-1086-azure 9118.04.1-Ubuntu Description: The issue is related to the storvsc error wq workqueue in the Linux kernel, which was incorrectly marked as WQ MEM RECLAIM. This marking may cause a deadlock while...

PT-2023-7428 · Intel · Intel Nuc P14E Laptop Element

Name of the Vulnerable Software and Affected Versions: Intel NUC P14E Laptop Element software versions prior to 1.0.0.156 Description: The issue is related to incorrectly used default permissions in the Audio Service of the Intel NUC P14E Laptop Element software. This could allow an authenticated...