PT-2023-16514 · WordPress · Newsletter Popup

Name of the Vulnerable Software and Affected Versions: The Newsletter Popup WordPress plugin versions 1.2 and earlier Description: The issue concerns a lack of CSRF checks in certain areas of the plugin, which could allow attackers to perform unwanted actions on behalf of logged-in users through...

PT-2023-19798 · Riot-Os · Riot-Os

Name of the Vulnerable Software and Affected Versions: RIOT-OS versions prior to 2023.04 Description: The issue affects the network stack of RIOT-OS, specifically in the processing of 6LoWPAN frames. An attacker can send a crafted frame, resulting in an integer underflow and out of bounds access ...

PT-2023-22362 · Mindspore · Mindspore

Name of the Vulnerable Software and Affected Versions: MindSpore versions 2.0.0-alpha through 2.0.0-rc1 Description: A problematic vulnerability was found in MindSpore, affecting the JsonHelper::UpdateArray function of the file mindspore/ccsrc/minddata/dataset/util/json helper.cc. The manipulatio...

New GobRAT Remote Access Trojan Targeting Linux Routers in Japan

Linux routers in Japan are the target of a new Golang remote access trojan RAT called GobRAT. "Initially, the attacker targets a router whose WEBUI is open to the public, executes scripts possibly by using vulnerabilities, and finally infects the GobRAT," the JPCERT Coordination Center JPCERT/CC...

Host can instantly set rageQuitTimestamp and prevent members from rage quitting

Lines of code Vulnerability details Impact A malicious Host can front-run rage-quitting members and setRageQuitTimestamp to a time in the past and disable rageQuit. Proof of Concept Ragequit serves as a protective measure for members of a Party to do an emergency withdrawal of their assets in cas...

PT-2023-22307 · Sourcecodester · Sourcecodester Students Online Internship Timesheet System

Name of the Vulnerable Software and Affected Versions: SourceCodester Students Online Internship Timesheet System version 1.0 Description: A critical issue was found in the GET Parameter Handler component of the rendered report.php file. The manipulation of the sid argument leads to sql injection...

PT-2023-20508 · Unknown · Keep-Module-Latest

Name of the Vulnerable Software and Affected Versions: keep-module-latest versions all Description: The issue arises due to missing input sanitization or other checks and sandboxes being employed to the installModule function, leading to Command Injection. To potentially exploit this, an attacker...

PYSEC-2023-67

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disable...

PT-2023-24344 · Unknown · Sourcecodester Faculty Evaluation System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Faculty Evaluation System version 1.0 Description: The issue allows for arbitrary code execution via the "/eval/ajax.php?action=save user" API endpoint. This could potentially lead to unauthorized access and control of the...

Blind SSRF in the Mail app on avatar endpoint

None...

Error in calendar when booking an appointment reveals the full path of the website

None...

Contacts - PHOTO svg only sanitized if mime type is all lower case

None...

PT-2023-23730 · Synapse · Synapse

Name of the Vulnerable Software and Affected Versions: Synapse versions up to and including 1.73 Description: A malicious user on a Synapse homeserver with permission to create certain state events can disable outbound federation from one homeserver to another. This is possible due to the lack of...

PT-2023-24617 · Briar · Briar

Name of the Vulnerable Software and Affected Versions: Briar versions 1.5.3 and earlier Description: The Introduction Client in Briar does not implement out-of-band verification for the public keys of introducees. This allows an introducer to launch man-in-the-middle attacks against later private...

PT-2023-24488 · Netbox · Netbox

Name of the Vulnerable Software and Affected Versions: Netbox version 3.5.1 Description: A stored cross-site scripting XSS issue exists in the Create Rack Roles function, specifically at the /dcim/rack-roles/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a...

PT-2023-21929 · Unknown · Twister Antivirus

Name of the Vulnerable Software and Affected Versions: Twister Antivirus version 8 Description: A problematic issue has been found in the function 0x804f2158/0x804f2154/0x804f2150/0x804f215c/0x804f2160/0x80800040/0x804f214c/0x804f2148/0x804f2144/0x801120e4/0x804f213c/0x804f2140 in the library...

net-snmp security and bug fix update

5.8-27.0.1 - fix error index value when snmpget is used a proxy pass Orabug: 34905643 1:5.8-27 - fix memory leak due of proc file creating 2105957 - fix CVE-2022-44792 and CVE-2022-44793 2141901 and 2141905 - fix memory leak when ipv6 disable set to 1 2151537 - fix proxy timeout issue 2160723...

PT-2023-24490 · Netbox · Netbox

Name of the Vulnerable Software and Affected Versions: Netbox version 3.5.1 Description: A stored cross-site scripting XSS issue exists in the Create Tenant Groups function, specifically at the /tenancy/tenant-groups/ API endpoint, allowing attackers to execute arbitrary web scripts or HTML by...

PT-2023-13722 · Synapse +2 · Synapse +2

Name of the Vulnerable Software and Affected Versions: Synapse versions prior to 1.68.0 Description: The issue occurs when Synapse and a malicious homeserver are both joined to the same room. The malicious homeserver can trick Synapse into accepting previously rejected events into its view of the...

PT-2023-21936 · Unknown · Escan Antivirus

Name of the Vulnerable Software and Affected Versions: eScan Antivirus version 22.0.1400.2443 Description: A problematic vulnerability was found in the function 0x22E008u in the library PROCOBSRVESX.SYS of the component IoControlCode Handler. The manipulation leads to null pointer dereference. It...