PT-2023-19312 · Unknown · Swagpaypal +1

Name of the Vulnerable Software and Affected Versions: SwagPayPal versions prior to 5.4.4 Description: The issue affects JavaScript-based PayPal checkout methods, including PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, and Credit card. When these methods are used, the amount and ite...

PT-2023-12270 · Jocms · Jocms

Name of the Vulnerable Software and Affected Versions: jocms version 0.8 Description: The issue allows remote attackers to execute arbitrary SQL commands and view sensitive information. This is achieved via the jo json check function in jocms/apps/mask/inc/mask.php. Recommendations: For jocms...

PT-2023-2968 · Faronics · Faronics Insight

Name of the Vulnerable Software and Affected Versions: Faronics Insight version 10.0.19045 Description: The issue is related to insufficient protection of service data in the Enhanced Security mode of the Teacher Console and Student Console of the Faronics Insight platform. Exploitation of this...

PT-2023-15130 · Mura Cms · Mura Cms

Name of the Vulnerable Software and Affected Versions: Mura CMS versions prior to 10.0.580 Description: A vulnerability in the Remember Me function allows attackers to bypass authentication via a crafted web request. Recommendations: For versions prior to 10.0.580, update to version 10.0.580 or...

GSD-2023-1001804 btrfs: fix race between quota rescan and disable leading to NULL pointer deref

btrfs: fix race between quota rescan and disable leading to NULL pointer deref This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.230 by commi...

GSD-2023-1001672 btrfs: fix race between quota rescan and disable leading to NULL pointer deref

btrfs: fix race between quota rescan and disable leading to NULL pointer deref This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.8 by commit...

PT-2023-1267 · Dompdf +1 · Dompdf +1

Name of the Vulnerable Software and Affected Versions: Dompdf version 2.0.1 Dompdf versions prior to 8.0.0 Description: The issue is related to the incorrect order of authorization checks before syntax analysis and canonization when processing tags with uppercase letters in SVG parsing. This can...

PT-2023-19450 · Dromara · Dromara Hutool

Name of the Vulnerable Software and Affected Versions: Dromara Hutool version 5.8.11 Description: A deserialization issue allows an attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter. This enables the attacker to potentially gain control over the system. Recommendation...

PT-2023-15547 · Unknown · Limesurvey

Name of the Vulnerable Software and Affected Versions: LimeSurvey version 5.4.15 Description: A stored cross-site scripting XSS issue was discovered in the component "/index.php/surveyAdministration/rendersidemenulink?subaction=surveytexts". This issue allows attackers to execute arbitrary web...

PT-2023-16334 · Unknown · Sourcecodester Online Tours & Travels Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Tours & Travels Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown part of the file admin/abc.php. The manipulation of the id argument leads to SQL injection. I...

PT-2023-14420 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS version 7.64 Description: The issue is related to improper authentication. The application checks for a valid session when a user is not attempting to log in. A static secret in the generatePublicHash function allows an attacker...

github.com/openshift/apiserver-library-go Improper Input Validation vulnerability

A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context...

UBUNTU-CVE-2023-22500

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerability allow unauthorized access to inventory files. Thus, if anonymous access to FAQ is allowed, inventory files are accessbile by...

PT-2023-13933 · Siretta · Siretta Quartz-Gold

Name of the Vulnerable Software and Affected Versions: Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020 Description: Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality. A specially-crafted network packet can lead to arbitrary command...

PT-2023-13954 · Siretta · Siretta Quartz-Gold

Name of the Vulnerable Software and Affected Versions: Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020 Description: Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality. A specially-crafted network packet can lead to arbitrary command...

PT-2023-1300 · Vim +6 · Vim +6

Name of the Vulnerable Software and Affected Versions: vim versions prior to 9.0.1247 Description: The issue is related to a Divide By Zero error in the vim text editor, specifically associated with the smoothscroll function when the window size is small. This could potentially allow an attacker ...

PT-2023-13909 · Siretta · Siretta Quartz-Gold

Name of the Vulnerable Software and Affected Versions: Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020 Description: Several stack-based buffer overflow issues exist in the DetranCLI command parsing functionality. A specially-crafted network packet can lead to arbitrary command execution. An...

systemd security update

250-12.0.2.el91.1 - Backport upstream pstore dmesg fix Orabug: 34868110 - Remove upstream references Orabug: 33995357 - Disable unprivileged BPF by default Orabug: 32870980 - udev rules: fix memory hot add and remove Orabug: 31310273 - set 'RemoveIPC=no' in logind.conf as default for OL7.2 Orabug...

PT-2023-12672 · Smartctl · Smartctl

Name of the Vulnerable Software and Affected Versions: smartctl versions all Description: The issue is related to Command Injection via the info method due to improper input sanitization. This allows for potential exploitation. No information is provided about the estimated number of potentially...

PT-2023-15153 · Small Crm · Small Crm

Name of the Vulnerable Software and Affected Versions: Small CRM version 3.0 Description: A cross-site scripting XSS issue in the Create Ticket page allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject parameter. This enables attackers to...