PT-2023-20704 · Dupeoff.Com · Dupeoff

Name of the Vulnerable Software and Affected Versions: DupeOff.Com DupeOff plugin versions 1.6 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For DupeOff.Com DupeOff plugin...

PT-2023-17247 · Unknown · Firefly-Iii

Name of the Vulnerable Software and Affected Versions: firefly-iii/firefly-iii versions prior to 6.0.0 Description: The issue is related to improper input validation in the firefly-iii/firefly-iii GitHub repository. Recommendations: For versions prior to 6.0.0, update to version 6.0.0 or later to...

PT-2023-17215 · Unknown · Thorsten/Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue is related to Cross-site Scripting XSS - Generic. It affects the thorsten/phpmyfaq GitHub repository. Recommendations: For versions prior to 3.1.12, update to version 3.1.12 or...

PT-2023-17222 · Unknown · Thorsten/Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue concerns improper privilege management, allowing any user who can add a new user to create a user with super admin rights. This has been fixed in version 3.1.12. Recommendation...

PT-2023-19560 · Oceanwp · Oceanwp Ocean Extra

Name of the Vulnerable Software and Affected Versions: OceanWP Ocean Extra plugin versions = 2.1.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher authentication levels. There is no information provided about the...

PT-2023-20590 · Forcepoint · Forcepoint Web Security +1

Name of the Vulnerable Software and Affected Versions: Forcepoint Cloud Security Gateway CSG versions prior to 03/29/2023 Forcepoint Web Security versions prior to 03/29/2023 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site...

PT-2023-15314 · Unknown · Wpdevart Booking Calendar +1

Name of the Vulnerable Software and Affected Versions: WpDevArt Booking calendar, Appointment Booking System plugin versions 3.2.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by authenticated users with edit...

PT-2023-14646 · Thimpress · Thimpress Wp Pipes

Name of the Vulnerable Software and Affected Versions: ThimPress WP Pipes plugin versions prior to 1.34 Description: The issue is related to an SQL Injection vulnerability in the ThimPress WP Pipes plugin, which can be exploited by authenticated administrators. This vulnerability allows for the...

PT-2023-15419 · WordPress · Jeffrey-Wp Media Library Categories

Name of the Vulnerable Software and Affected Versions: Jeffrey-WP Media Library Categories plugin versions prior to 1.9.9 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability requires authentication with admin+ privileges. Recommendations: For...

PT-2023-17183 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.20 Description: The issue is related to Cross-site Scripting XSS - Generic in the GitHub repository pimcore/pimcore. This is a type of security vulnerability that can allow an attacker to inject maliciou...

SUSE-SU-2023:1628-1 Security update for containerd

This update for containerd fixes the following issues: - CVE-2022-23471: Fixed host memory exhaustion through Terminal resize goroutine leak bsc1206235. - Re-build containerd to use updated golang-packaging jsc1342. - Update to containerd v1.6.16 for Docker v23.0.0-ce...

PT-2023-20273 · Veracode · Veracode Scan Jenkins Plugin

Name of the Vulnerable Software and Affected Versions: Veracode Scan Jenkins Plugin versions prior to 23.3.19.0 Description: The issue allows users with access to view the job log to discover proxy credentials under specific configurations. This includes when the "Connect using proxy" option is...

PT-2023-16189 · WordPress · Ooohboi Steroids For Elementor

Name of the Vulnerable Software and Affected Versions: OoohBoi Steroids for Elementor WordPress plugin versions prior to 2.1.5 Description: The issue concerns CSRF and broken access control vulnerabilities. These vulnerabilities allow a user with a role as low as a subscriber to delete attachment...

PT-2023-21632 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.3 Description: A buffer overflow issue was addressed with improved memory handling. This issue may allow an app to cause unexpected system termination or write kernel memory. Recommendations: For macOS versions prio...

PT-2023-16308 · WordPress · Hm Portfolio

Name of the Vulnerable Software and Affected Versions: HT Portfolio WordPress plugin versions prior to 1.1.6 Description: The issue concerns a lack of CSRF check when activating plugins, which could allow attackers to make logged-in admins activate arbitrary plugins present on the blog via a CSRF...

PT-2023-15192 · WordPress · Contempoinc Real Estate 7

Name of the Vulnerable Software and Affected Versions: Contempoinc Real Estate 7 WordPress theme versions 3.3.1 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability allows for the execution of malicious scripts on the...

PT-2023-16238 · WordPress · Shortcode Menu

Name of the Vulnerable Software and Affected Versions: menu shortcode WordPress plugin version 1.0 and earlier Description: The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the plugin's failure to validate and escape some of its bloc...

CVE-2023-28448 Versionize is lacking bound checks, potentially leading to out of bounds memory access

Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for...

SUSE-SU-2023:1571-1 Security update for helm

This update for helm fixes the following issues: Update to version 3.11.1 bsc1208084: - CVE-2023-25165: Fixed a information disclosure problem via getHostByName injection inside a chart to get values to a malicious DNS server...

PT-2023-21720 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: Dataease versions prior to 1.18.5 Description: Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. Recommendations: For versions prior to 1.18.5, update to version...