PT-2023-20824 · Unknown · Textpattern

Name of the Vulnerable Software and Affected Versions: Textpattern versions 4.8.8 and below Description: An arbitrary file upload vulnerability in the upload plugin allows attackers to execute arbitrary code by uploading a crafted PHP file. Recommendations: For Textpattern versions 4.8.8 and belo...

PT-2023-15779 · Openbsd +1 · Openbsd +2

Name of the Vulnerable Software and Affected Versions: LibreSSL versions prior to 3.6.1 OpenBSD versions prior to 7.2 errata 001 Description: An issue was discovered in the x509/x509 verify.c file. The function x509 verify ctx add chain does not store errors that occur during leaf certificate...

PT-2023-22201 · Xwiki · Xwiki Commons

Name of the Vulnerable Software and Affected Versions: XWiki Commons versions prior to 13.10.10 XWiki Commons versions prior to 14.4.4 XWiki Commons versions prior to 14.8RC1 Description: It is possible to bypass the existing security measures put in place to avoid open redirect by using a redire...

PT-2023-9528 · Openlink +4 · Openlink Virtuoso-Opensource +4

Name of the Vulnerable Software and Affected Versions: openlink virtuoso-opensource version 7.2.9 Description: The issue in the stricmp component of openlink virtuoso-opensource allows attackers to cause a Denial of Service DoS via crafted SQL statements. This is due to the incorrect neutralizati...

PT-2023-22209 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions prior to 14.4.7 XWiki versions prior to 14.10 Description: Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper...

GHSA-7HJ9-RV74-5G92 Traefik HTTP header parsing could cause a denial of service

Impact There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service. References - CVE-2023-24534 Patches -...

PT-2023-6440 · Adobe · Acrobat Reader

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader versions 23.001.20093 and earlier Adobe Acrobat Reader versions 20.005.30441 and earlier Description: The issue is related to a use-after-free vulnerability that could result in arbitrary code execution in the context of...

PT-2023-6615 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension versions 3.4.8 and earlier Description: The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as...

PT-2023-2400 · Microsoft · Office Publisher +2

Name of the Vulnerable Software and Affected Versions: Microsoft Publisher affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Microsoft Office affected versions not specified Description: The issue is related to insufficient input validation in...

Siemens SCALANCE W1750D Improper Neutralization of Input During Web Page Generation (CVE-2018-7064)

A reflected cross-site scripting XSS vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to trick an IAP administrator into clicking a link which could then take administrative actions on the Instant cluster, or expose the session...

Siemens SCALANCE X Switches Use of Hard-Coded Cryptographic Key (CVE-2020-28395)

A vulnerability has been identified in SCALANCE X-200RNA switch family All versions V3.2.7, SCALANCE X-300 switch family incl. X408 and SIPLUS NET variants All versions V4.1.0. Devices do not create a new unique private key after factory reset. An attacker could leverage this situation to a...

PT-2023-6436 · Adobe · Acrobat 2020 +3

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat versions prior to 23.001.20094 Adobe Acrobat Reader versions 23.001.20093 and earlier Adobe Acrobat 2020 versions prior to 20.005.30442 Adobe Acrobat Reader 2020 versions 20.005.30441 and earlier Description: The issue is relate...

PT-2023-22156 · Sap · Sap Web Dispatcher +1

Name of the Vulnerable Software and Affected Versions: ABAP Platform versions 7.85 through 7.91 SAP Web Dispatcher versions 7.85 through 7.89 Description: The IP filter in ABAP Platform and SAP Web Dispatcher may be vulnerable due to erroneous IP netmask handling, potentially enabling access to...

Siemens SCALANCE W1750D Exposure of Sensitive Information to an Unauthorized Actor (CVE-2018-7083)

If a process running within Aruba Instant crashes, it may leave behind a core dump, which contains the memory contents of the process at the time it crashed. It was discovered that core dumps are stored in a way that unauthenticated users can access them through the Aruba Instant web interface...

Flask-AppBuilder Has No Rate Limiting on Login AUTH DB

Impact Lack of rate limiting will allow an attacker to brute-force user credentials. Patches Ability to enable rate limiting on Flask-AppBuilder = 4.3.0. Use AUTHRATELIMITED = True and RATELIMITENABLED = True set the limit itself by using AUTHRATELIMIT. Will apply only to database authentication...

PT-2023-3303 · Linux +6 · Linux Kernel +6

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.3.2 Description: The issue is related to a use-after-free vulnerability in the rkvdec remove function within the Rockchip Video Decoder driver in the Linux kernel. This vulnerability is caused by a race...

PT-2023-9521 · Openlink +4 · Openlink Virtuoso-Opensource +4

Name of the Vulnerable Software and Affected Versions: openlink virtuoso-opensource version 7.2.9 Description: The issue is related to the mp box deserialize string function, which is vulnerable due to improper neutralization of special elements used in SQL commands. This can be exploited by a...

PT-2023-20847 · Unknown · Delight Nashorn Sandbox

Name of the Vulnerable Software and Affected Versions: delight-nashorn-sandbox versions 0.2.4 through 0.2.5 Description: The issue allows for sandbox escape when allowExitFunctions is set to false. The loadWithNewGlobal function can be used to invoke the exit and quit methods, leading to the exit...

PT-2023-20789 · Unknown · Sales Tracker Management System

Name of the Vulnerable Software and Affected Versions: Sales Tracker Management System version 1.0 Description: An issue in the Sales Tracker Management System allows a remote attacker to access sensitive information via the "admin/reports" endpoint, specifically through the sales.php component...

PT-2023-7317 · Nginx · Nginx Njs

Name of the Vulnerable Software and Affected Versions: Nginx NJS version 0.7.10 Description: The issue is related to an illegal memcpy via the function njs vmcode return at src/njs vmcode.c in the Nginx NJS interpreter. This can lead to a buffer overflow in memory. Exploitation of this issue may...