PT-2023-21310 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.106 Description: A SQL injection issue was found in DedeCMS via the component /dede/sys sql query.php. This allows for potential exploitation. Recommendations: For DedeCMS version 5.7.106, update to a version that fixes th...

PT-2023-22767 · Nextcloud · Nextcloud Talk

Name of the Vulnerable Software and Affected Versions: Nextcloud Talk versions prior to 15.0.5 Description: The issue allows a user added later to a conversation to access data that was deleted before they were added. This is a problem in Nextcloud Talk, a chat, video, and audio call extension fo...

PT-2023-17820 · Unknown · Easyappointments

Name of the Vulnerable Software and Affected Versions: alextselegidis/easyappointments versions prior to 1.5.0 Description: The issue is related to stored Cross-site Scripting XSS in the GitHub repository alextselegidis/easyappointments. A patch is available, and it is anticipated to be part of...

CVE-2023-23591

The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs when debug logging is enabled. The fixed versions are 8.2.18.7, 8.2.18.2.2, 8.3.11.1, and 8.3.14.1...

PT-2023-11730 · Sqlite3 +4 · Sqlite3 +4

Name of the Vulnerable Software and Affected Versions: SQLite3 versions 3.27.1 and earlier Description: A Buffer Overflow issue allows a local attacker to cause a denial of service via a crafted script. This issue can be exploited to disrupt service. Recommendations: For SQLite3 versions 3.27.1 a...

PT-2023-16261 · WordPress · Wordpress Amazon S3 Plugin

Name of the Vulnerable Software and Affected Versions: WordPress Amazon S3 Plugin versions prior to 1.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This...

PT-2023-16260 · WordPress · Article Directory Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Article Directory WordPress plugin versions prior to 1.4 Description: The issue arises from improper sanitization of the publish terms text setting, which can be exploited to conduct Stored XSS attacks, particularly in multisite environments...

PT-2023-19877 · Kiboko · Kiboko Labs Chained Quiz Plugin

Name of the Vulnerable Software and Affected Versions: Kiboko Labs Chained Quiz plugin versions prior to 1.3.2.6 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions prior to 1.3.2.6...

PT-2023-20269 · Unknown · Gqevu6Bsiz Announce From The Dashboard

Name of the Vulnerable Software and Affected Versions: gqevu6bsiz Announce from the Dashboard plugin versions = 1.5.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability allows an attacker to inject malicious scripts into the website, which can...

PT-2023-19336 · WordPress · Wpgear.Pro Wpfrom Email

Name of the Vulnerable Software and Affected Versions: WPGear.Pro WPFrom Email plugin versions 1.8.8 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the WPGear.Pro WPFrom Email plugin. This vulnerability requires authentication with...

PT-2023-19285 · Oceanwp · Oceanwp Ocean Extra +1

Name of the Vulnerable Software and Affected Versions: OceanWP Ocean Extra plugin versions = 2.1.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with contributor or higher privileges. It affects the OceanWP Ocean Extra plugin whe...

PT-2023-22243 · Bzip3 · Bzip3

Name of the Vulnerable Software and Affected Versions: bzip3 versions prior to 1.3.0 Description: An issue was discovered in libbzip3.a in bzip3. A denial of service process hang can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with libsais...

CVE-2023-1412

An unprivileged non-admin user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows = 2022.12.582.0 to perform privileged operations with SYSTEM context by working with a combination of opportunistic locks oplock and symbolic links which can both be creat...

CVE-2023-1412

An unprivileged non-admin user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows = 2022.12.582.0 to perform privileged operations with SYSTEM context by working with a combination of opportunistic locks oplock and symbolic links which can both be creat...

PT-2023-17312 · Unknown · Thorsten/Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue is related to Cross-site Scripting XSS due to the failure to sanitize user input in the stopword parameter. This allows for potential exploitation. The estimated number of...

PT-2023-16209 · Helpy · Helpy

Name of the Vulnerable Software and Affected Versions: Helpy version 2.8.0 Description: The issue allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the attachments sent by customers in the...

PT-2023-14003 · Peepso · Peepso Community

Name of the Vulnerable Software and Affected Versions: PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin versions = 6.0.2.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing...

CVE-2023-28854 nophp vulnerable to shell command injection on httpd user when sending a password-setting mail or mail-login mail

nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made available at commit e5409aa2d441789cbb35f6b119bef97ecc3986aa on 2023-03-30. Users should update index.php to 2023-03-30 or later or, as a workaround, add a function...

PT-2023-9329 · Apache +5 · Apache Http Server +5

Name of the Vulnerable Software and Affected Versions: mod auth openidc versions 2.0.0 through 2.4.13.1 Description: The issue is related to the mod auth openidc module for the Apache 2.x HTTP server, which implements OpenID Connect Relying Party functionality. When OIDCStripCookies is set and a...

PT-2023-21997 · Wagtail · Wagtail

Name of the Vulnerable Software and Affected Versions: Wagtail versions 1.5 through 4.1.3 Wagtail versions 1.5 through 4.2.1 Description: A stored cross-site scripting XSS vulnerability exists on ModelAdmin views within the Wagtail admin interface. A user with a limited-permission editor account...