PT-2023-4996 · Unknown · Usememos/Memos

Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.13.2 Description: The issue is related to improper input validation in the usememos/memos GitHub repository. This can allow a remote attacker to gain unauthorized access to protected information...

PT-2023-30069 · Instantsoft · Icms2

Name of the Vulnerable Software and Affected Versions: instantsoft/icms2 versions prior to 2.16.1-git Description: The issue is related to Cross-site Scripting XSS - Stored. This means that an attacker can inject malicious scripts into a website, which are then stored on the server and executed b...

PT-2023-5223 · Ibm · Ibm Security Verify Information Queue

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Information Queue versions 10.0.4 through 10.0.5 Description: The issue is related to the storage of sensitive information in plain clear text, which can be accessed by a local user. This is due to a lack of encryption...

PT-2023-5247 · Gpac +2 · Gpac +2

Name of the Vulnerable Software and Affected Versions: gpac versions prior to 2.3-DEV Description: The issue is related to a NULL Pointer Dereference in the gpac multimedia platform. This can be exploited to cause a denial of service. The vulnerable components include utils/xml parser.c,...

PT-2023-24288 · WordPress · Woocommerce Returns/Warranty Requests

Name of the Vulnerable Software and Affected Versions: WooCommerce Returns and Warranty Requests plugin versions = 2.1.6 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

PT-2023-33035 · Unknown · Apollo Server

Name of the Vulnerable Software and Affected Versions: Apollo Server versions prior to the latest version Description: The issue concerns Apollo Server logging sensitive information, specifically Studio API keys, under certain conditions. This occurs when API keys are passed with leading or...

PT-2023-16430 · Unknown · Warp Mobile Client

Name of the Vulnerable Software and Affected Versions: WARP Mobile Client versions prior to 6.29 Description: The issue is due to a misconfiguration, making the WARP Mobile Client susceptible to a tapjacking attack. If an attacker installs a malicious application on a victim's device, they can...

PT-2023-4555 · Moxa · Iologik 4000 Series

Name of the Vulnerable Software and Affected Versions: ioLogik 4000 Series ioLogik E4200 versions v1.6 and prior Description: A vulnerability has been identified where the session cookies attribute is not set properly, potentially exposing user session data to unauthorized access and manipulation...

PT-2023-27807 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue. It appears to be a notification about a candidate number that is not in use...

PT-2023-27806 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue. It appears to be a notification about a candidate number that is not in use...

PT-2023-36248 · Mozilla · Ca-Certificates-Mozilla

Name of the Vulnerable Software and Affected Versions: ca-certificates-mozilla versions prior to 2.62 Description: The issue is related to an update of Mozilla SSL root CAs to the 2.62 state. This update adds several new root CAs, including Atos TrustedRoot Root CA ECC G2 2020, Atos TrustedRoot...

PT-2023-25967 · Riverbed · Edgeconnect Sd-Wan Orchestrator

Name of the Vulnerable Software and Affected Versions: EdgeConnect SD-WAN Orchestrator affected versions not specified Description: The web-based management interface of EdgeConnect SD-WAN Orchestrator contains multiple vulnerabilities that could allow an authenticated remote attacker to conduct...

PT-2023-12359 · Freeimage +1 · Freeimage +1

Name of the Vulnerable Software and Affected Versions: FreeImage versions prior to 1.18.0 Description: The issue is related to a null pointer dereference in the ReadPalette function located in PluginTIFF.cpp. This function is part of the FreeImage library, which is used for image processing. The...

PT-2023-4758 · Json-C +3 · Json-C +3

Name of the Vulnerable Software and Affected Versions: json-c versions 0.14 through 0.15-20200726 Description: A stack-buffer-overflow issue exists in the json parse auxiliary sample program, specifically in the parseit function. This issue is related to a buffer overflow in memory, which can be...

WordPress Master Addons for Elementor Plugin <= 2.0.5.3 is vulnerable to Broken Access Control

Software Master Addons for Elementor Type Plugin Vulnerable versions = 2.0.5.3 Fixed in 2.0.5.4.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-40679 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 6468506a04c1 Credits...

WP Adminify < 3.1.6 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Several fields in the plugin are...

Buffer Overflow

Matthias-Wandel jhead is vulnerable to Buffer Overflow, it is caused by allowing attackers to execute arbitary code causing denial of service DoS...

SQL Injection

org.jeecgframework.boot:jeecg-boot-base-core is vulnerable to SQL Injection attacks. This vulnerability allows a local attacker to cause a denial of service DoS attack by injecting malicious SQL code into specially crafted requests. The vulnerability is caused by improper input validation in the...

PT-2023-35958 · Git +1 · Ntopng

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read error. The crash occurs in the Flow::dissectMDNS function, which is called by...

Cross-site Scripting (XSS)

@excalidraw/excalidraw is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to improper input sanitization via embedded links in whiteboard object which allows an attacker to inject and execute arbitrary JavaScript...