PT-2023-32868 · Kylinsoft · Kylin-System-Updater

Name of the Vulnerable Software and Affected Versions: KylinSoft kylin-system-updater versions up to 2.0.5.16-0k2.33 Description: A critical vulnerability has been found in the KylinSoft kylin-system-updater. The issue is related to the manipulation of the SetDownloadspeedMax argument, which lead...

PT-2023-31887 · Unknown · Activeadmin

Name of the Vulnerable Software and Affected Versions: ActiveAdmin versions prior to 3.2.0 Description: The issue allows CSV injection, which can lead to remote code execution and private data exfiltration when maliciously crafted spreadsheet formulas are uploaded and imported into a spreadsheet...

GHSA-VF5M-XRHM-V999 Nautobot missing object-level permissions enforcement when running Job Buttons

Impact When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have permission to run Jobs in general?. Object-level permissions i.e., does the user have permission to run this specific Job? are not enforced by the URL/view used ...

PT-2023-8237 · Siemens · Jt2Go +1

Name of the Vulnerable Software and Affected Versions: JT2Go versions prior to 14.3.0.6 Teamcenter Visualization V13.3 versions prior to 13.3.0.13 Teamcenter Visualization V14.1 versions prior to 14.1.0.12 Teamcenter Visualization V14.2 versions prior to 14.2.0.9 Teamcenter Visualization V14.3...

PT-2023-8525 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti versions 1.2.25 and prior Description: The issue is related to a lack of protection in the SQL query structure of the Cacti network monitoring tool, specifically in the pollers.php script. This allows an authorized user to execute...

PT-2023-32855 · Unknown · Phpgurukul Online Notes Sharing System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Notes Sharing System version 1.0 Description: A problematic issue affects the processing of the file /user/add-notes.php, leading to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed t...

PT-2023-32859 · Sourcecodester · Sourcecodester Simple Student Attendance System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Student Attendance System version 1.0 Description: A critical issue has been found in the system, affecting an unknown functionality. The manipulation of the page argument leads to path traversal, allowing access to...

PT-2023-31743 · Totolink · Totolink Ex1800T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1800T version 9.1.0cu.2112 B20220316 Description: The issue concerns unauthorized arbitrary command execution. It is related to the apcliChannel parameter of the "setWiFiExtenderConfig" interface in the "cstecgi.cgi"...

PT-2023-13720 · Hertzbeat · Hertzbeat

Name of the Vulnerable Software and Affected Versions: Hertzbeat versions 1.20 and prior Description: Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless capabilities. The system has a permission bypass issue,...

Arduino: Remote Code Execution

Background Arduino is an open-source AVR electronics prototyping platform. Description A vulnerability has been discovered in Arduino. Please review the CVE identifier referenced below for details. Impact Arduino bundles a vulnerable version of log4j that may lead to remote code execution...

PT-2023-31290 · Unknown · Job Portal

Name of the Vulnerable Software and Affected Versions: Job Portal version 1.0 Description: The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. Specifically, the cmbQual parameter of the "Employer/InsertWalkin.php" resource does not validate the characters received, and they...

PT-2023-8145

Name of the Vulnerable Software and Affected Versions Barracuda ESG Appliance versions 5.1.3.001 through 9.2.1.001 Description The issue is related to a case of arbitrary code execution that resides within a third-party and open-source library named Spreadsheet::ParseExcel, used by the Amavis...

PT-2023-31576 · Unknown · Nos Client

Name of the Vulnerable Software and Affected Versions: nos client version 0.6.6 Description: An issue was discovered in the nos client, allowing remote attackers to escalate privileges via the getRPCEndpoint.js file. Recommendations: For nos client version 0.6.6, consider disabling the...

PT-2023-31286 · Unknown · Job Portal

Name of the Vulnerable Software and Affected Versions: Job Portal version 1.0 Description: The issue concerns an Unauthenticated SQL Injection vulnerability. Specifically, the txtDesc parameter of the "Employer/InsertJob.php" resource does not validate the characters received, and they are sent...

impossible to open a position with a large marginTo

Lines of code Vulnerability details Description marginTo/From is a way to both cover your position and increase your premium when opening a position. There is however a unintended limit on how much marginTo you can provide when opening a position. When doing the swap to increase leverage, the...

PT-2023-32461

Name of the Vulnerable Software and Affected Versions LioXERP versions prior to 146 Description The issue affects LioXERP, allowing Reflected XSS due to improper neutralization of input during web page generation. This can lead to cross-site scripting attacks. Recommendations For versions prior t...

PT-2023-29419 · Unknown · Online Examination System

Name of the Vulnerable Software and Affected Versions: Online Examination System version 1.0 Description: The issue concerns multiple Authenticated SQL Injection vulnerabilities. Specifically, the qid parameter of the "/update.php?q=quiz&step=2" resource does not validate the characters received,...

PT-2023-30704 · Smartertools · Smartermail

Name of the Vulnerable Software and Affected Versions: SmarterTools SmarterMail versions 8495 through 8664 before 8747 Description: The issue allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainText are set in the same request. Recommendations: Fo...

Grails data binding causes JVM crash and/or other denial of service

Impact A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. Patches Patches are available for Grails 3 and later. Workarounds No workaround is possible except to avoid data binding to request data...

PT-2023-22279 · Heimdal · Heimdal Thor Agent

Name of the Vulnerable Software and Affected Versions: Heimdal Thor agent versions 3.4.2 and before on Windows Heimdal Thor agent versions 2.6.9 and before on macOS Description: An issue in the Heimdal Thor agent allows attackers to cause a denial of service DoS via the Threat To Process...