PT-2023-25368 · Ibm · Ibm Content Navigator

Name of the Vulnerable Software and Affected Versions: IBM Content Navigator version 3.0.13 Description: The issue allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. This is due to a server-side...

CVE-2023-20220

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. To exploit these vulnerabilities, the attacker must have valid device...

samba: "rpcecho" development server allows denial of service via sleep() call on AD DC

A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in...

Exploit for CVE-2023-5412

CVE-2023-5412 Image horizontal reel scroll slideshow = 13...

CVE-2023-5437

The WP fade in text news plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

SUSE CVE-2022-21611

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.30 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server...

PT-2023-32105 · WordPress · Vertical Marquee Plugin

Name of the Vulnerable Software and Affected Versions: Vertical marquee plugin for WordPress versions up to, and including, 7.1 Description: The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the plugin's...

VulnCheck KEV: CVE-2023-46748

F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747...

CVE-2023-5051

The CallRail Phone Call Tracking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callrailform' shortcode in versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping on the 'formid' user supplied attribute. This makes it possible fo...

CVE-2023-46748

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software...

PT-2023-23624 · WordPress · Totalpress.Org Custom Post Types

Name of the Vulnerable Software and Affected Versions: TotalPress.Org Custom post types, Custom Fields & more plugin versions 4.0.12 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges...

PT-2023-29837 · WordPress · Mammothology Wp Full Stripe Free

Name of the Vulnerable Software and Affected Versions: Mammothology WP Full Stripe Free plugin versions 1.6.1 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject malicious scripts...

CVE-2022-38484

An arbitrary file upload and directory traversal vulnerability exist in the file upload functionality of the System Setup menu in AgeVolt Portal prior to version 0.1. A remote authenticated attacker could leverage this vulnerability to upload files to any location on the target operating system...

PT-2023-6632

Name of the Vulnerable Software and Affected Versions F5 BIG-IP Configuration utility affected versions not specified Description An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility, which may allow an authenticated attacker with network access to the...

PT-2023-13612 · Unknown · Agevolt Portal

Name of the Vulnerable Software and Affected Versions: AgeVolt Portal versions prior to 0.1 Description: A directory traversal issue exists that leads to Information Disclosure. A remote authenticated attacker could leverage this issue to read files from any location on the target operating syste...

CVE-2023-4796

The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcjwpoption' shortcode in versions up to, and including, 7.1.0 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with...

CVE-2022-4290

The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the 'ctlsanitizetitle' function in versions up to, and including, 3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This potentially...

CVE-2023-31046

A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an authenticated attacker to achieve read-only access to the server's filesystem, because requests beginning with "GET /ui/static/..//.." reach...

PT-2023-9142 · Wyze +1 · Wyze Cam V3 +1

Name of the Vulnerable Software and Affected Versions: Roku Indoor Camera SE version 3.0.2.4679 Wyze Cam v3 version 4.36.11.5859 Description: A stack-based buffer overflow issue exists in the message parsing functionality. This can be triggered by a specially crafted message, leading to a...

EasyUse MailHunter Ultimate Code Issue Vulnerability

EasyUse MailHunter Ultimate is an accurate email finder tool from EasyUse China. A security vulnerability exists in EasyUse MailHunter Ultimate 2023 and prior versions, which stems from the presence of a Dangerous Types of Files Unrestricted Uploads vulnerability that could allow an authenticated...