PT-2023-29705

Name of the Vulnerable Software and Affected Versions ArchiveBox affected versions not specified Description The issue affects users of the wget extractor who view the content it outputs. If a user is logged in to the ArchiveBox admin site in the same browser session and views an archived malicio...

PT-2023-6360 · Connectize · Connectize Ac21000 G6

Name of the Vulnerable Software and Affected Versions: Connectize AC21000 G6 version 641.139.1.1256 Description: An issue in the change password functionality of the Connectize AC21000 G6 allows attackers to gain control of the device without prompting for the current password. This is related to...

PT-2023-29020 · Unknown · Subrion Cms

Name of the Vulnerable Software and Affected Versions: Subrion CMS version 4.2.1 Description: Multiple Cross-Site Scripting XSS vulnerabilities in the installation of Subrion CMS allow a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser...

PT-2023-29538 · Prestashop · Creative Popup

Name of the Vulnerable Software and Affected Versions: Creative Popup versions up to 1.6.9 Description: A SQL injection issue exists in the Creative Popup module for PrestaShop, allowing a guest to perform SQL injection via the cp download popup function. Recommendations: For versions up to 1.6.9...

PT-2023-29709 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions prior to 10.6.2 Description: Directus is a real-time API and App dashboard for managing SQL database content. In affected versions, any Directus installation that has websockets enabled can be crashed if the websocket server...

Synchrony deobfuscator prototype pollution vulnerability leading to arbitrary code execution

Impact A proto pollution vulnerability exists in synchrony versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. Summary A proto pollution vulnerability exists in the LiteralMap transformer allowing crafted input to modify properties in the Object prototype. When...

SUSE CVE-2023-45150

Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended th...

PT-2023-29703

Name of the Vulnerable Software and Affected Versions Torbot versions prior to 4.0.0 Description The issue concerns the torbot.modules.validators.validate link function, which uses the python-validators URL validation regex. This regular expression has exponential complexity, allowing an attacker...

PT-2023-31977 · WordPress · Chatbot

Name of the Vulnerable Software and Affected Versions: ChatBot plugin for WordPress versions up to, and including, 4.8.9 Description: The issue allows unauthenticated attackers to extract sensitive data, including confirmation of whether a user name exists on the site and order information for...

CVE-2023-45811 Prototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscator

Synchrony deobfuscator is a javascript cleaner & deobfuscator. A proto pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A proto pollution vulnerability exists in the LiteralMap transformer allowing crafted input to modify...

CVE-2023-45811 Prototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscator

Synchrony deobfuscator is a javascript cleaner & deobfuscator. A proto pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A proto pollution vulnerability exists in the LiteralMap transformer allowing crafted input to modify...

urllib3's request body not stripped after redirect from 303 status changes request method to GET

urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 303 "See Other" after the request had its method changed from one that could accept a request body like POST to GET as is required by HTTP RFCs. Although the behavior of removing the request body ...

PYSEC-2023-212

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body like POST to GET as is required by HT...

PYSEC-2023-212

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body like POST to GET as is required by HT...

Design/Logic Flaw

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body like POST to GET as is required by HT...

UBUNTU-CVE-2023-45803

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body like POST to GET as is required by HT...

CVE-2023-45803

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body like POST to GET as is required by HT...

CVE-2023-45803 Request body not stripped after redirect in urllib3

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body like POST to GET as is required by HT...

CVE-2023-45803 Request body not stripped after redirect in urllib3

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body like POST to GET as is required by HT...

CVE-2023-45803

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body like POST to GET as is required by HT...