PT-2023-30798 · WordPress · Wordpress File Sharing Plugin

Name of the Vulnerable Software and Affected Versions: WordPress File Sharing Plugin versions prior to 2.0.5 Description: The issue allows users to gain access to files and folders by manipulating IDs, which can be easily brute forced, due to a lack of authorization checks. Recommendations: For...

PT-2023-5886 · Libcurl +13 · Libcurl +13

Name of the Vulnerable Software and Affected Versions: libcurl versions prior to 8.4.0 Description: This issue allows an attacker to insert cookies at will into a running program using libcurl, if specific series of conditions are met. libcurl performs transfers and provides a function call that...

PT-2023-31987 · Dedebiz · Dedebiz

Name of the Vulnerable Software and Affected Versions: DedeBIZ version 6.2 Description: A critical vulnerability was found in DedeBIZ, affecting an unknown part of the file /src/admin/tags main.php. The manipulation of the ids argument leads to SQL injection. It is possible to initiate the attack...

sudo: Multiple Vulnerabilities

Background sudo allows a system administrator to give users the ability to run commands as other users. Description Multiple vulnerabilities have been discovered in sudo. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for detail...

PT-2023-28909 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 8.1.2 Description: The issue concerns the PrestaShop Back office interface, where an employee can list all modules without any access rights due to the method ajaxProcessGetPossibleHookingListForModule not checkin...

PT-2023-5533 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L B1 version 2.02 Description: The issue is related to a buffer overflow vulnerability in the formSetWAN Wizard56 function. This vulnerability can be exploited by a remote attacker to cause a denial of service. The vulnerability...

PT-2023-5527 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.02 Description: The issue is related to a buffer overflow in the formSetWanPPPoE function of the D-Link DIR-619L router's firmware. This can be exploited by a remote attacker to cause a denial of service. The...

PT-2023-5529 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L B1 version 2.02 Description: The issue is related to a buffer overflow in the formSetWanDhcpplus function, which can be exploited to cause a denial of service. This can be achieved by a remote attacker, allowing them to disrup...

PT-2023-28736 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS versions 5.7.111 and earlier Description: An arbitrary file upload vulnerability in dede/baidunews.php allows attackers to execute arbitrary code via uploading a crafted PHP file. Recommendations: For DedeCMS versions 5.7.111 and...

PT-2023-5526 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.02 Description: The issue is related to a buffer overflow in the formSetWanPPTP function, which can be exploited to cause a denial of service. This can be triggered by a remote attacker, allowing them to disrupt...

PT-2023-5528 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L B1 version 2.02 Description: The issue is related to a buffer overflow in the formSetWanNonLogin function, which can be exploited to cause a denial of service. This can be triggered by a remote attacker, allowing them to disru...

PT-2023-31582

Name of the Vulnerable Software and Affected Versions Hospital management system version 378c157 Description The hospital management system is vulnerable to SQL injection SQLI, which allows attackers to bypass authentication. This issue is related to the application's susceptibility to SQLI...

GHSA-6JQW-JWF5-RP8H Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Impact In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was...

CVE-2023-33972

Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue...

CVE-2023-33972 Privilege escalation from having CREATE access on a keyspace in Scylladb

Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue...

CVE-2023-33972 Privilege escalation from having CREATE access on a keyspace in Scylladb

Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue...

CVE-2023-20034

Vulnerability in the Elasticsearch database used in the of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to access the Elasticsearch configuration database of an affected device with the privileges of the elasticsearch user. These vulnerability is due to the presen...

Cisco IOS and IOS XE Software Command Authorization Bypass Vulnerability

A vulnerability in the Authentication, Authorization, and Accounting AAA feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to bypass command authorization and copy files to or from the file system of an affected device using the Secure Copy...

Cisco Wireless LAN Controller AireOS Software Denial of Service Vulnerability

A vulnerability in the memory buffer of Cisco Wireless LAN Controller WLC AireOS Software could allow an unauthenticated, adjacent attacker to cause memory leaks that could eventually lead to a device reboot. This vulnerability is due to memory leaks caused by multiple clients connecting under...

UBUNTU-CVE-2023-42453

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event if they knew the room ID and event ID. Note that the users were not able to view the events, but simply mark it as read. This could be confusing as...