PT-2023-23381 · Alkacon · Alkacon Opencms

Name of the Vulnerable Software and Affected Versions: alkacon-OpenCMS version 11.0.0.0 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module. This enables...

PT-2023-4256 · Tenda · Tenda Ac8

Name of the Vulnerable Software and Affected Versions: Tenda AC8 versions prior to V16.03.34.06 Description: The issue is related to a buffer overflow in the saveParentControlInfo function when handling the deviceId parameter. This can be exploited by a remote attacker to execute arbitrary code o...

PT-2023-23492 · Unknown · Sourcecodester Online Computer/Laptop Store

Name of the Vulnerable Software and Affected Versions: Sourcecodester Online Computer and Laptop Store version 1.0 Description: The issue allows unrestricted file upload, which can lead to remote code execution. The vulnerability path is "/classes/Users.php?f=save". Recommendations: For version...

PT-2023-21085 · Tongda Oa · Tongda Oa

Name of the Vulnerable Software and Affected Versions: Tongda OA version 11.10 Description: A critical vulnerability has been found in Tongda OA, affecting the actionGetdata function of the GatewayController.php file. This vulnerability leads to unrestricted upload and can be initiated remotely...

PT-2023-28311 · Unknown +2 · Openimageio +2

Name of the Vulnerable Software and Affected Versions: OpenImageIO oiio version 2.4.12.0 Description: The issue allows a remote attacker to execute arbitrary code and cause a denial of service via the read subimage data function. Recommendations: For OpenImageIO oiio version 2.4.12.0, consider...

PT-2023-23517 · Unknown · Jerryscript

Name of the Vulnerable Software and Affected Versions: Jerryscript version 3.0 commit 1a2c047 Description: An Assertion Failure was discovered in Jerryscript via the jmem heap finalize function at jerry-core/jmem/jmem-heap.c. Recommendations: For Jerryscript version 3.0 commit 1a2c047, consider...

PT-2023-20773 · Sourcecodester · Sourcecodester Lost/Found Information System

Name of the Vulnerable Software and Affected Versions: SourceCodester Lost and Found Information System version 1.0 Description: A problematic issue affects the Contact Form component, specifically the file classes/Master.php?f=save inquiry. The manipulation of the fullname, contact, or message...

PT-2023-22353 · Extplorer · Extplorer

Name of the Vulnerable Software and Affected Versions: eXtplorer version 2.1.15 Description: The issue allows for insecure permissions, specifically through the file upload feature in the file manager. This vulnerability enables the upload of zip files that contain PHP pages, which can lead to...

PT-2023-20759 · Sourcecodester · Sourcecodester Online Computer/Laptop Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Computer and Laptop Store version 1.0 Description: A critical vulnerability has been found in the SourceCodester Online Computer and Laptop Store, affecting the file view categories.php. The manipulation of the c argumen...

PT-2023-26177 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 14.6-rc-1 through 14.10.3 XWiki versions prior to 15.0 RC1 Description: The issue concerns the cleaning of attributes during XHTML rendering in XWiki, which allowed the injection of arbitrary HTML code and thus cross-site...

PT-2023-20735 · Unknown · Sourcecodester Online Computer/Laptop Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Computer and Laptop Store version 1.0 Description: A problematic issue was found in the products.php file, where the manipulation of the search argument leads to cross-site scripting. This can be exploited remotely...

PT-2023-20764 · Xpdf +1 · Xpdf +1

Name of the Vulnerable Software and Affected Versions: Xpdf versions 4.04 and earlier Description: A PDF object loop in the page label tree leads to infinite recursion and a stack overflow. Recommendations: For Xpdf versions 4.04 and earlier, consider updating to a newer version to mitigate the...

PT-2023-19913 · Unknown · Skybridge Mb-A100/110

Name of the Vulnerable Software and Affected Versions: SkyBridge MB-A100/110 versions 4.2.0 and earlier Description: The issue involves cleartext transmission of sensitive information. If the telnet connection is enabled, a remote unauthenticated attacker may eavesdrop on or alter the...

kernel: octeontx2-pf: Avoid use of GFP_KERNEL in atomic context

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Avoid use of GFPKERNEL in atomic context Using GFPKERNEL in preemption disable context, causing below warning when CONFIGDEBUGATOMICSLEEP is enabled. 32.542271 BUG: sleeping function called from invalid context at...

kernel: iavf: Fix reset error handling

A deadlock condition exists in the linux kernel such that when calling iavfclose in iavfresettask error handling,doing so can lead to double call of napidisable thereby leading to a denial of service due to the deadlock...

kernel: stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove()

In the Linux kernel, the following vulnerability has been resolved: stmmac: intel: Add a missing clkdisableunprepare call in intelethpciremove Commit 09f012e64e4b "stmmac: intel: Fix clock handling on error and remove paths" removed this clkdisableunprepare This was partly revert by commit...

PT-2023-23361 · Frrouting +5 · Frrouting Bgpd +5

Name of the Vulnerable Software and Affected Versions: Frrouting bgpd version 8.4.2 Description: An issue in Frrouting bgpd allows a remote attacker to cause a denial of service via the bgp capability llgr function. Recommendations: For version 8.4.2, consider disabling the bgp capability llgr...

PT-2023-23170 · Unknown · Postgresnio

Name of the Vulnerable Software and Affected Versions: PostgresNIO versions prior to 1.14.2 Description: The issue affects users of PostgresNIO who connect to servers with TLS enabled, allowing a man-in-the-middle attacker to inject false responses to the client's first few queries despite the us...

PT-2023-22532 · Cesanta · Cesanta Mjs

Name of the Vulnerable Software and Affected Versions: Cesanta MJS version 1.26 Description: A Buffer Overflow issue allows a local attacker to cause a denial of service via the mjs mk string function in mjs.c. This issue can be exploited to disrupt service. Recommendations: For Cesanta MJS versi...

PT-2023-22529 · Libming · Libming

Name of the Vulnerable Software and Affected Versions: Libming swftophp version 0.4.8 Description: A Buffer Overflow issue allows a local attacker to cause a denial of service via the newVar N function in util/decompile.c. This issue can be exploited to disrupt service. Recommendations: For Libmi...