PT-2023-24269 · Marval · Marval Msm

Name of the Vulnerable Software and Affected Versions: Marval MSM versions 14.19.0.12476 and earlier Marval MSM version 15.0 Description: The issue allows a remote attacker, authenticated as any user, to execute code in the context of the web server. This is a Remote Code Execution vulnerability...

PT-2023-4251 · Sap · Sap Powerdesigner

Name of the Vulnerable Software and Affected Versions: SAP PowerDesigner version 16.7 Description: The issue is related to insufficient protection of service data due to the handling of password hashes during login attempts. This may allow a remote attacker to gain unauthorized access to protecte...

PT-2023-11369 · Unknown +1 · Materialis +1

Name of the Vulnerable Software and Affected Versions: Mesmerize versions up to, and including, 1.6.89 Materialis versions up to, and including, 1.0.172 Description: The issue allows authenticated attackers to change restricted options due to the companion disable popup function only checking the...

PT-2023-16948 · Ta · Ta

Name of the Vulnerable Software and Affected Versions: TA versions prior to 5.7.9 Description: A heap-based overflow issue allows a remote user to alter the page heap in the macmnsvc process memory block, resulting in the service becoming unavailable. Recommendations: For versions prior to 5.7.9,...

PT-2023-24403 · Unknown · Imperial Cms

Name of the Vulnerable Software and Affected Versions: Imperial CMS version 7.5 Description: The issue allows for arbitrary file deletion via the DelspReFile function in the /sp/ListSp.php API endpoint. Attackers can exploit this by sending a crafted POST request to the vulnerable endpoint...

PT-2023-12447 · WordPress · Unauthenticated Account Creation

Name of the Vulnerable Software and Affected Versions: Unauthenticated Account Creation plugin for WordPress versions up to, and including, 1.6.6 Description: The issue allows unauthenticated attackers to create accounts, including those with administrator privileges, due to the stm listing...

PT-2023-15935 · WordPress · Adsanity

Name of the Vulnerable Software and Affected Versions: AdSanity plugin for WordPress versions up to, and including, 1.8.1 Description: The issue is related to missing file type validation in the ajax upload function, allowing authenticated attackers with Contributor+ level privileges to upload...

CVE-2023-32683 URL deny list bypass via oEmbed and image URLs when generating previews in Synapse

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the urlpreviewurlblacklist setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresses allowed by the...

GHSA-6W63-H3FJ-Q4VW fast-xml-parser vulnerable to Regex Injection via Doctype Entities

Impact "fast-xml-parser" allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for DoS attacks. By crafting an entity name that results in an...

PT-2023-4213 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R version 9.1.0cu.2350 B20230313 Description: The issue is related to a command injection vulnerability via the setWanCfg function. This vulnerability is associated with a lack of input data sanitization measures in the TOTOLINK...

PT-2023-4040

Name of the Vulnerable Software and Affected Versions Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs. xattrs" Description The issue is related to the overlayfs file system in Ubuntu kernels, where an unprivileged user may se...

PT-2023-24438 · Nanomq · Nanomq

Name of the Vulnerable Software and Affected Versions: NanoMQ version 0.17.2 Description: A heap buffer overflow issue exists, which can be triggered by calling the function nmq subinfo decode in the file mqtt parser.c. This can be exploited to cause a denial of service attack. Recommendations: F...

PT-2023-10294 · Unknown · Realfavicongenerator Favicon Plugin

Name of the Vulnerable Software and Affected Versions: RealFaviconGenerator Favicon Plugin versions up to 1.2.12 Description: A problematic vulnerability has been found in the RealFaviconGenerator Favicon Plugin, affecting the install new favicon function of the file...

PT-2023-24327 · Marsctf · Marsctf

Name of the Vulnerable Software and Affected Versions: MarsCTF version 1.2.1 Description: The issue is related to an arbitrary file upload vulnerability in the interface for uploading attachments in the background. This allows for potential malicious file uploads. Recommendations: For MarsCTF...

PT-2023-11511 · Unknown · Emlog Emlogcms

Name of the Vulnerable Software and Affected Versions: Emlog EmlogCMS version 6.0.0 Description: A remote attacker can gain access to sensitive information via the "/admin/plugin.php" function. This issue allows unauthorized access, potentially leading to data breaches. Recommendations: For Emlog...

PT-2023-23072 · Code Projects · Agro-School Management System

Name of the Vulnerable Software and Affected Versions: code-projects Agro-School Management System version 1.0 Description: A critical issue has been found in the system. The doUpdateQuestion function of the file btn functions.php is affected. The manipulation of the question id argument leads to...

CVE-2023-23597

A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the file:// context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file read. This vulnerability affects Firefo...

PT-2023-2998 · Mitsubishi · Melsec Iq-R Series Ethernet/Ip Module Rj71Eip91 +1

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 affected versions not specified Mitsubishi Electric Corporation MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP affected versions not specified Description: The...

PT-2023-4212 · Tenda · Tenda Ac8

Name of the Vulnerable Software and Affected Versions: Tenda AC8 versions prior to V16.03.34.06 Description: The issue is related to a buffer overflow in the fromSetWifiGusetBasic function of the Tenda AC8 router's firmware. This could allow a remote attacker to cause a denial of service. The...

PT-2023-24460 · Microworld Technologies · Escan

Name of the Vulnerable Software and Affected Versions: Microworld Technologies eScan management console version 14.0.1400.2281 Description: The issue concerns a Reflected Cross Site Scripting XSS in the view dashboard detail feature, allowing a remote attacker to inject arbitrary code via the URL...