PT-2023-18539 · Flarum · Flarum

Name of the Vulnerable Software and Affected Versions: Flarum versions prior to 1.6.3 Description: The issue allows an actor to read restricted or private content and bypass access checks by using the notifications feature. The notification-sending component does not verify if the subject of the...

PT-2023-14625 · Archibus · Archibus Web Central

Name of the Vulnerable Software and Affected Versions: Archibus Web Central version 2022.03.01.107 Description: An issue was discovered in the application where a service exposed allows a basic user to access the profile information of all connected users. Recommendations: For Archibus Web Centra...

mercurius has Uncaught Exception when using subscriptions

Impact Any users of Mercurius until version v11.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. Patches This was patched in https://github.com/mercurius-js/mercurius/pull/940. The patch was released as v11.5.0 and v8.13.2. Workarounds...

CVE-2023-22477

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in 940. As a workaround, users can disable subscriptions...

Code injection

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in 940. As a workaround, users can disable subscriptions...

CVE-2023-22477 Mercurius is vulnerable to denial of service (DoS) when using subscriptions

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in 940. As a workaround, users can disable subscriptions...

PT-2023-12829 · Wifey · Wifey

Name of the Vulnerable Software and Affected Versions: wifey affected versions not specified Description: The issue is related to Command Injection via the connect function due to improper input sanitization. This allows for potential exploitation. No information is provided about the estimated...

PT-2023-12412 · Webpa · Webpa

Name of the Vulnerable Software and Affected Versions: WebPA versions up to 3.1.1 Description: A critical issue affects some unknown processing, leading to sql injection. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world...

PT-2023-10136 · Unknown · Emmflo Yuko-Bot

Name of the Vulnerable Software and Affected Versions: emmflo yuko-bot affected versions not specified Description: A vulnerability was found in emmflo yuko-bot, declared as problematic. The manipulation of the title argument leads to denial of service. The attack can be initiated remotely...

PT-2023-10202 · Unknown · Fumon Trello-Octometric

Name of the Vulnerable Software and Affected Versions: Fumon trello-octometric affected versions not specified Description: A critical issue has been found in Fumon trello-octometric, affecting the main function of the file metrics-ui/server/srv.go. The manipulation of the num argument leads to s...

PT-2023-10332 · Forumhulp · Forumhulp

Name of the Vulnerable Software and Affected Versions: ForumHulp affected versions not specified Description: A critical issue was found in ForumHulp searchresults, affecting the list keywords function of the file event/listener.php. The manipulation of the word argument leads to SQL injection...

PT-2023-11815

Name of the Vulnerable Software and Affected Versions square squalor versions prior to v0.0.0 Description A critical issue was found in square squalor, affecting an unknown part, leading to sql injection. The manipulation with the table name parameter is potentially vulnerable to SQL injection...

PT-2023-10807 · Petermu · Nodebatis

Name of the Vulnerable Software and Affected Versions: PeterMu nodebatis versions up to 2.1.x Description: A critical issue has been found, affecting an unknown function, which leads to sql injection. Upgrading to version 2.2.0 can address this issue. Recommendations: For versions up to 2.1.x,...

PT-2023-10118 · Unknown · Kassi Xingwall

Name of the Vulnerable Software and Affected Versions: kassi xingwall affected versions not specified Description: A critical issue has been found in kassi xingwall, affecting some unknown processing of the file app/controllers/oauth.js. The manipulation leads to session fixiation. Recommendation...

PT-2023-12700 · Ibm · Ibm Security Verify Governance

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Governance version 10.0 Description: The issue allows a local user to read user credentials stored in plain clear text. Recommendations: For IBM Security Verify Governance version 10.0, consider restricting access to...

CVE-2022-46177 Discourse password reset link can lead to in account takeover if user changes to a new email

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 3.0.0.beta16 on the beta and tests-passed branches, when a user requests for a password reset link email, then changes their primary email, the old reset email is still valid. When the old...

CVE-2022-46177 Discourse password reset link can lead to in account takeover if user changes to a new email

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 3.0.0.beta16 on the beta and tests-passed branches, when a user requests for a password reset link email, then changes their primary email, the old reset email is still valid. When the old...

CVE-2022-46168

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 2.9.0.beta15 on the beta and tests-passed branches, recipients of a group SMTP email could see the email addresses of all other users inside the group SMTP topic. Most of the time this is n...

Design/Logic Flaw

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 2.9.0.beta15 on the beta and tests-passed branches, recipients of a group SMTP email could see the email addresses of all other users inside the group SMTP topic. Most of the time this is n...

CVE-2022-46168 Group SMTP user emails are exposed in CC email header

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 2.9.0.beta15 on the beta and tests-passed branches, recipients of a group SMTP email could see the email addresses of all other users inside the group SMTP topic. Most of the time this is n...