SQL Injection in Admin Search Find API

Impact SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any...

CVE-2023-30849 Pimcore vulnerable to SQL Injection in Translation Export API

Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually...

PT-2023-18937 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.21 Description: This issue is related to Cross-site Scripting XSS - DOM, which has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or...

PT-2023-2564 · Illumina · Illumina Universal Copy Service

Name of the Vulnerable Software and Affected Versions: Illumina Universal Copy Service versions 2.x Description: The issue is related to the binding of Illumina Universal Copy Service to an unrestricted IP address, allowing an unauthenticated malicious actor to use the service to listen on all IP...

CVE-2023-29200 contao/core-bundle has path traversal vulnerability in the file manager

Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao...

SUSE-SU-2023:2003-1 Security update for runc

This update for runc fixes the following issues: Update to runc v1.1.5: Security fixes: - CVE-2023-25809: Fixed rootless /sys/fs/cgroup is writable when cgroupns isn't unshared bnc1209884. - CVE-2023-27561: Fixed regression that reintroduced CVE-2019-19921 vulnerability bnc1208962. -...

PT-2023-05: Unauth Buffer Overflow in sdwan_iface_ipc in Zyxel products

An issue was identified in Zyxel products affecting: ATP ZLD V5.10V5.32; USG FLEX ZLD V5.00V5.32; USG FLEX 50W/ USG20W-VPN ZLD V5.10V5.32; VPN ZLD V5.00V5.35. The discovered vulnerability of Buffer Overflow in sdwanifaceipc can be exploited by an unauthenticated attacker to dump the core with a...

Security Bulletin: IBM Safer Payments is vulnerable to multiple OpenSSL vulnerabilities (CVE-2021-23839, CVE-2021-23840, CVE-2021-23841)

Summary IBM Safer Payments uses OpenSSL. These OpenSSL vulnerabilities are addressed in IBM Safer Payments. Vulnerability Details CVEID:CVE-2021-23839 DESCRIPTION: OpenSSL could provide weaker than expected security, caused by incorrect SSLv2 rollback protection that allows for the inversion of t...

PT-2023-23126 · Unknown · Repetier Server

Name of the Vulnerable Software and Affected Versions: Repetier Server versions prior to 1.4.11 Description: The issue allows for execution as SYSTEM, which can be exploited for full compromise when combined with other vulnerabilities. Recommendations: For Repetier Server versions prior to 1.4.11...

PT-2023-18564 · Alf.Io · Alf.Io

Name of the Vulnerable Software and Affected Versions: alfio-event/alf.io versions prior to 2.0-M4-2304 Description: The issue is related to the improper neutralization of formula elements in a CSV file. This problem affects the GitHub repository alfio-event/alf.io. Recommendations: For versions...

PT-2023-19238 · WordPress · Google Maps V3 Shortcode

Name of the Vulnerable Software and Affected Versions: Google Maps v3 Shortcode plugin versions prior to 1.2.2 Description: The issue is related to a Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. This type of vulnerability allows attackers to...

PT-2023-21114 · Unknown · James Irving-Swift Electric Studio Client Login

Name of the Vulnerable Software and Affected Versions: James Irving-Swift Electric Studio Client Login plugin versions prior to 0.8.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with admin+ authentication. This type of vulnerability allo...

PT-2023-19155 · WordPress · George Gecewicz Portfolio Slideshow

Name of the Vulnerable Software and Affected Versions: George Gecewicz Portfolio Slideshow plugin versions prior to 1.13.0 Description: The issue is related to a Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. This type of vulnerability allows...

PT-2023-20488 · Flowmon · Flowmon Packet Investigator

Name of the Vulnerable Software and Affected Versions: Flowmon Packet Investigator versions prior to 12.1.0 Description: A path-traversal issue allows a Flowmon user with access to Flowmon Packet Investigator to retrieve files on the Flowmon appliance's local filesystem. Recommendations: For...

PT-2023-18187 · Nunjucks +1 · Nunjucks +1

Name of the Vulnerable Software and Affected Versions: Nunjucks versions prior to 3.2.4 Description: The issue allows bypassing the restrictions provided by the autoescape functionality in Nunjucks. If two user-controlled parameters are on the same line in the views, it is possible to inject...

SUSE-SU-2023:1903-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: grafana version update from 8.5.20 to 8.5.22: - Security issues fixed: CVE-2023-1410: Fix XSS in Graphite functions tooltip bsc1209645 CVE-2023-0507: Apply attribute sanitation to GeomapPanel bsc1208821 CVE-2023-0594: Avoid storing XSS in TraceView panel...

SUSE-SU-2023:1902-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: grafana version update from 8.5.20 to 8.5.22: - Security issues fixed: CVE-2023-1410: Fix XSS in Graphite functions tooltip bsc1209645 CVE-2023-0507: Apply attribute sanitation to GeomapPanel bsc1208821 CVE-2023-0594: Avoid storing XSS in TraceView panel...

PT-2023-3564 · Linux +9 · Linux Kernel +9

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions =5.4 Description: The issue is related to incorrect verifier pruning in BPF in the Linux Kernel, which leads to unsafe code paths being incorrectly marked as safe. This results in arbitrary read/write in kernel memory,...

Design/Logic Flaw

Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with " double...

PT-2023-14542 · WordPress · Gus Sevilla Wp Clictracker

Name of the Vulnerable Software and Affected Versions: Gus Sevilla WP Clictracker plugin versions 1.0.5 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Gus Sevilla WP...