PT-2023-25203 · Outline · Outline

Name of the Vulnerable Software and Affected Versions: outline/outline versions prior to 0.70.1 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation or escaping, allowing an...

PT-2023-22834 · Unknown · Personamanagerservice

Name of the Vulnerable Software and Affected Versions: PersonaManagerService versions prior to SMR Jul-2023 Release 1 Description: The issue is related to improper access control in the PersonaManagerService, allowing local attackers to change configuration. Recommendations: For versions prior to...

PT-2023-25767 · Travianz · Travianz

Name of the Vulnerable Software and Affected Versions: TravianZ versions 8.3.4 and earlier Description: The issue allows for XSS attacks through various means, including the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie. Recommendations: For...

PT-2023-24728 · Zimbra · Zimbra Zcs

Name of the Vulnerable Software and Affected Versions: Zimbra ZCS version 8.8.15 Description: The issue is a Cross Site Scripting vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the "/h/autoSaveDraft" function. This vulnerability is...

PT-2023-18459 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: A command injection issue exists in the check system user functionality of the ys thirdparty module. This can be triggered by a specially crafted set of network packets, potentially leading to...

PT-2023-5452 · Kofax · Kofax Power Pdf Advanced

Name of the Vulnerable Software and Affected Versions: Kofax Power PDF Advanced affected versions not specified Description: The issue is related to a heap-based buffer overflow in the parsing of PDF files, which can be exploited to execute arbitrary code on affected installations. This requires...

PT-2023-36208 · Unknown · Prometheus-Ha Cluster Exporter

Name of the Vulnerable Software and Affected Versions: prometheus-ha cluster exporter affected versions not specified Description: The issue is related to a security concern addressed by rebuilding the package with the go 1.20 security release. Recommendations: At the moment, there is no...

PT-2023-23916 · Unknown · Wl-Wn531Ax2

Name of the Vulnerable Software and Affected Versions: WL-WN531AX2 versions prior to 2023526 Description: The issue is related to improper authentication, allowing a network-adjacent attacker to obtain the password for the wireless network. Recommendations: For versions prior to 2023526, update t...

Improper Access Control

admidio/admidio is vulnerable to Improper Access Control. The vulnerability exists in the delete function of messages.php which allows an attacker to perform unauthorized message deletions...

Command Injection

admidio/admidio is vulnerable to CSV Injection. The vulnerability exists due to improper neutralization of formula elements in a CSV file which allows an attacker to execute arbitrary code via a crafted excel file...

PT-2023-17998 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to Android-13 Description: The issue is related to unsafe deserialization in multiple functions of sta iface.cpp, which could lead to a possible out of bounds read. This could result in local escalation of privilege, wi...

PT-2023-25060 · H3C · H3C Magic

Name of the Vulnerable Software and Affected Versions: H3C Magic B1STV100R012 affected versions not specified Description: A stack overflow in the EditWlanMacList function allows attackers to cause a Denial of Service DoS via a crafted POST request to the API endpoint. The issue is related to the...

PT-2023-25056 · H3C · H3C Magic

Name of the Vulnerable Software and Affected Versions: H3C Magic B1STV100R012 affected versions not specified Description: A stack overflow in the Edit BasicSSID function allows attackers to cause a Denial of Service DoS via a crafted POST request to the API endpoint. The issue is related to the...

PT-2023-5440 · Ibm · Ibm Robotic Process Automation For Cloud Pak

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation for Cloud Pak versions 21.0.1 through 21.0.7.3 IBM Robotic Process Automation for Cloud Pak versions 23.0.0 through 23.0.3 Description: The issue is related to insufficient security configuration, which may allo...

WordPress Image Map Pro Plugin <= 1.0.0 is vulnerable to Broken Access Control

Software Image Map Pro Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-3412 Patch priority High CVSS severity High 6.4 Developer Claim ownership PSID 0df94792877f Credits Unknown Required privilege...

SQL Injection

in2code/ipandlanguageredirect is vulnerable to SQL Injection attacks. A specifically crafted attack statement through the $ipAddress parameter in the getCountryCodeFromIpInDatabase function allows a malicious user to inject and execute arbitrary SQL queries on the target system...

PT-2023-22141 · Pi Websolution · Pi Websolution Conditional Cart Fee Plugin

Name of the Vulnerable Software and Affected Versions: PI Websolution Conditional cart fee plugin versions 1.0.96 and earlier Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations: For PI Websoluti...

PT-2023-22251 · Plainware · Plainware Shiftcontroller Employee Shift Scheduling

Name of the Vulnerable Software and Affected Versions: Plainware ShiftController Employee Shift Scheduling plugin versions = 4.9.23 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects...

PT-2023-18716 · Unknown · Contour Service

Name of the Vulnerable Software and Affected Versions: Contour Service affected versions not specified Description: The issue concerns a lack of permission checking in the Contour Service, allowing an attacker to create analyses for datasets they do not have permission for. This could lead to...

PT-2023-22612 · Openwb · Openwb

Name of the Vulnerable Software and Affected Versions: OpenWB versions 1.6 through 1.7 Description: The issue allows remote attackers to run arbitrary commands via crafted GET requests, potentially leading to command injection attacks. Recommendations: For OpenWB versions 1.6 through 1.7, update ...