PT-2023-29246

Name of the Vulnerable Software and Affected Versions pretix versions prior to 2023.7.2 Description The issue allows Pillow to parse EPS files. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this...

PT-2023-28908 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 8.1.2 Description: PrestaShop is an Open Source e-commerce web application. In affected versions, any module can be disabled or uninstalled from the back office, even with low user rights. This allows low privileg...

CVE-2023-43656

matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions those that have generic.allowJsTransformationFunctions in their config, may be vulnerable to an attack where it is possible to break out of...

CVE-2023-43656 Sandbox escape for instances that have enabled transformation functions in matrix-hookshot

matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions those that have generic.allowJsTransformationFunctions in their config, may be vulnerable to an attack where it is possible to break out of...

CVE-2023-41306

Vulnerability of mutex management in the bone voice ID trusted application TA module. Successful exploitation of this vulnerability may cause the bone voice ID feature to be unavailable...

CVE-2023-39376

SiberianCMS - CWE-284 Improper Access Control Authorized user may disable a security feature over the network...

Improper access control

SiberianCMS - CWE-284 Improper Access Control Authorized user may disable a security feature over the network...

Incorrect Authorization in User role

Description Incorrect Authorization in User role Proof of Concept 1 .Default, administrator User ID =1 cannot add user roles 2 .Remove the "disable" class at Inspect 3 .After that, add the user role success Video Poc https://drive.google.com/file/d/1vQPHZwaghByHsqEgQI9p3EiGeVCTbLK7/view?usp=shari...

PT-2023-28739 · Yzncms · Yzncms

Name of the Vulnerable Software and Affected Versions: YZNCMS version 1.3.0 Description: A stored cross-site scripting XSS issue in the cms/content/edit component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter. This enables...

PT-2023-27950 · Unknown · Phpkobo Ajaxnewticker

Name of the Vulnerable Software and Affected Versions: phpkobo AjaxNewTicker version 1.0.5 Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via a crafted payload to the subcmd parameter in the "index.php" component. Recommendations: For phpkobo...

PT-2023-23673 · Red Hat · Openshift Container Platform For Ibm Linuxone +4

Name of the Vulnerable Software and Affected Versions: undertow affected versions not specified jboss enterprise application platform affected versions not specified jboss enterprise application platform text-only advisories affected versions not specified openshift container platform affected...

PT-2023-5691

Name of the Vulnerable Software and Affected Versions: Cisco IOS and IOS XE Software affected versions not specified Description: A vulnerability in the Cisco Group Encrypted Transport VPN GET VPN feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacke...

PT-2023-29004 · Subrion · Subrion

Name of the Vulnerable Software and Affected Versions: Subrion version 4.2.1 Description: A Cross-site scripting XSS issue exists in the /panel/languages/ endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Title parameter. This enables...

PT-2023-26650 · Unknown · Gugoan Economizzer

Name of the Vulnerable Software and Affected Versions: gugoan Economizzer version 0.9-beta1 Description: The issue concerns a user enumeration vulnerability in the login and forgot password functionalities. The application reacts differently when a user or email address is valid, and when it's no...

PT-2023-5639 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 117.0.5938.132 Description: The issue is related to a use after free in the Extensions component of Google Chrome, which could allow an attacker to exploit heap corruption via a crafted HTML page if a user is...

PT-2023-28733 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 12.9 Description: The issue is related to an arbitrary file write vulnerability. This vulnerability is present in the component admin ip.php. Recommendations: For SeaCMS version 12.9, consider disabling access to the admin ip.p...

PT-2023-26905 · Unknown · Siberiancms

Name of the Vulnerable Software and Affected Versions: SiberianCMS affected versions not specified Description: The issue concerns improper access control, allowing an authorized user to disable a security feature over the network. Recommendations: At the moment, there is no information about a...

PT-2023-28721 · Macrob7 · Macrob7 Macs Framework Content Management System

Name of the Vulnerable Software and Affected Versions: Macrob7 Macs Framework Content Management System CMS version 1.1.4f Description: The issue is related to a PHP type confusion vulnerability due to loose comparison in the isValidLogin function during a login attempt. This vulnerability can le...

PT-2023-25090 · Accusoft · Accusoft Imagegear

Name of the Vulnerable Software and Affected Versions: Accusoft ImageGear version 20.1 Description: A heap-based buffer overflow vulnerability exists in the pictwread functionality. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file t...

PT-2023-19047 · Accusoft · Accusoft Imagegear

Name of the Vulnerable Software and Affected Versions: Accusoft ImageGear version 20.1 Description: A heap-based buffer overflow vulnerability exists in the CreateDIBfromPict functionality. This can be triggered by a specially crafted file, potentially leading to arbitrary code execution. An...